top | item 7310705

German freemail sites trick Firefox and Chrome users into removing AdBlock

191 points| ttaubert | 12 years ago |gebloggendings.wordpress.com

140 comments

order

eik3_de|12 years ago

This is so embarrassing and disgusting. For reference, here's a list of United Internet properties to avoid:

        1&1 (aka 1and1.com)
	GMX
	WEB.DE
	InterNetX
	united-domains
	Sedo
	mail.com
	Fasthosts
	affilinet
	Arsys

donrhummy|12 years ago

+1. Stay far away from 1and1.com! I had the worst experiences with them of any tech company. Customer service doesn't get worse than them.

scurvy|12 years ago

Anyone who does business with 1&1 deserves what they get. They're known to generally be amongst the worst in the industry.

iancarroll|12 years ago

Has anyone had bad experiences with sedo? I haven't.

teleclimber|12 years ago

This shows very clearly why browser warnings (aka "permission infobars") that are embedded on the page are bad.

http://chromespot.com/wp-content/uploads/2014/02/screen_quot...

By getting the user accustomed to seeing browser warnings and info there, you make it impossible for them to distinguish a legit browser warning from a fake one crafted by an unscrupulous site owner.

Browser warnings and notifications should significantly overlap the browser chrome (embedded in the address bar for example) so that no web page can make something that looks like it.

edit: image link

nollidge|12 years ago

Similarly, this is a major problem with Chrome showing settings in a browser page.

rjzzleep|12 years ago

oh web.de easily the most dangerous free mail sites there is.

it belongs to 1&1[1] one of the bigger internet companies in germany.

it's really odd that no one ever shot them down. they are famous for tricking users into shady 2 year contracts, if they wanted to upgrade their 12 mb mailbox.

they also upgraded the freemail to 500mb if and only if you would install their browser toolbar, which would change the mail server etc. now it's 1gb with toolbar i think.

they tried to force my mum into a contract, because she clicked on a banner while logging(for free xxx mb click here style banners). then promptly closed the account should she not pay.

the result was her saying fuck it i'll use gmail.

http://en.wikipedia.org/wiki/1%261_Internet

http://www.teltarif.de/web-de-freemail-speichererweiterung/n...

mironathetin|12 years ago

Confirmed. I use web.de since 1998 as a spam-box, to keep my real account clean. During the last years they indeed try all tricks (we have a present for you, 3 weeks of free membership blah, blah..). If you leave this page now, the present will expire. There is a way to simply ignore this sh..t. All of it.

But I agree that it takes discipline (germans are good at that :o). Gmail, on the other hand, cannot be trusted either. While web.de is evil, google is evil too, but google is bigger and google is not an european company. All of the data is used abroad thus circumventing civilized laws.

The real problem is this: these companies offer a service and everybody expects free services online. Of course the companies have to make money. Ask yourself: would you pay for an email account (I do)? If not, you have to accept ads. Or googles snooping in your data and selling your profile to everyone who pays. There is no free beer online. At least web.de shows us how ugly it gets, if things have to look like they were free.

This is not intended to excuse the primitive tricks we.de uses. But if you have a solution, post it here and I'll get rich.

Trufa|12 years ago

I live in Austria now and it is amazing the amount of people who use GMX.

I've been on a crusade to try to make people switch to, well, whatever but not that.

I think it was one of the first ones around here and people got used to it and the status quo, most don't even know or care about how bad they've got it.

blueskin_|12 years ago

mail.com recently had their outbound servers listed on Spamhaus for the best part of a week.

I noticed as a mail.com user was trying to email me and the message was being rejected, saw the spamhaus listing in my logs. Asked the sender, and they said that their messages to gmail were going into spam too.

I emailed postmaster@, support@, sysadmin@ etc. to try and inform them, as well as trying two contact forms; never heard anything back and it took several more days for the listing to disappear.

ckoepp|12 years ago

Well, 1&1/United Internet has a reputation for such bad behavior [1,2].

Actually it's quite easy to just enter some address and order some useless premium services "in behalf" of other people - this actually happened to a member of my family. According to consumer protection organizations this seems to be their business model [3,4].

Note that those links are in German: [1] http://de.wikipedia.org/wiki/Web.de#Kritik [2] http://de.wikipedia.org/wiki/Gmx.de#Kritik [3] http://www.augsburger-allgemeine.de/digital/Glueckwunsch-Abz... [4] http://www.verbraucherzentrale-niedersachsen.de/link1811119A...

adrianmn|12 years ago

As someone that has been involved in online publishing for over 10 years I have a strong opinion about ad blockers.

In my opinion using ad blockers is borderline piracy. Refusing the content creator his revenue by blocking his ads is little different than downloading music, books... without rewarding the creator. On top of that most of the quality content this days is on websites that have decent ads.

I am not trying to start a dispute if piracy is good or bad just wanted to express an opinion on ad blockers that many seem to miss.

skue|12 years ago

> In my opinion using ad blockers is borderline piracy.

Once upon a time I agreed with you... now I view all online ads as threats.

Unfortunately, marketing companies have gotten greedy and the degree to which they fingerprint and track us as we surf the web has gotten completely out of hand. This is an industry that cannot even follow their own watered-down initiatives like DoNotTrack.

And because ad networks use layers of affiliates, sites typically have no visibility nor control over what their visitors are being served. That's why you end up with a marketing company like Evidon buying Ghostery - just so they can help companies monitor the garbage on their own pages![3]

And to top it off, ads are now a common attack vector for viruses and malware that not even the big companies can control:

1. Just last week, Youtube was serving banking malware via its online ads. [1]

2. Last month Yahoo got a lot of attention serving Bitcoin malware via online ads on their site. [2]

I know that online publishing is important, and we need a strong press. But publishing desperately needs to find a new business model because online ads are a failed experiment and it's time to stick a fork in them.

[1]: http://labs.bromium.com/2014/02/21/the-wild-wild-web-youtube...

[2]: http://www.cnn.com/2014/01/05/tech/yahoo-malware-attack/inde...

[3]: https://www.ghostery.com/faq#q15

adrianb|12 years ago

Also people shouldn't be allowed to change the channel on tv when the ad breaks begin or even leave to use the toilet! They should be forced to sit and watch everything or else the ratings of the ads will not match the ones for the show.

My point it: people mostly hated ads since they were invented. Be it by not looking at them on the street, changing channels on tv or installing AdBlock on your computer, they do their best to avoid them.

mindslight|12 years ago

As someone who has used an ad blocker for over 10 years, I have a strong opinion about the ad industry.

Die out, go away, and let us get back to the point where the motivation to publish something on the 'net stems from the desire to share knowledge. To hell with the cacophonous status quo of doing the bare minimum to trick people into giving you their attention in order to fill their head with garbage for a fraction of a penny. And if hosting honest content using central servers costs too much to be sustainable, then let that dead-end approach leave us and make room for decentralized software to deliver information.

rcfox|12 years ago

Personally, I find that people who directly depend on ad revenue contribute very little to my life. In the software industry, content creators who are paid to participate in the field tend to produce much better content than those who are paid to produce content.

mschuster91|12 years ago

The problem is that without adblockers the web is basically useless due to too many publishers becoming too greedy and torturing their users with sometimes dozens of layer,banner,popup,popunder and scareware ads on one(!) page.

mendelk|12 years ago

ABP for Chrome has the "Allow some non-intrusive advertising" flag for precisely this reason: to reward creators who use ads deemed "acceptable".

This flag is checked by default.

More Info: https://adblockplus.org/en/acceptable-ads

marcosdumay|12 years ago

I'm more than happy to see your ads. I'll even click on it, and buy things from the target if I like what I see. I've done that several times in the past. In fact, when they are relevant, and in moderated amounts, I do like ads.

Now, I'm sure that you took care to guarantee that your ads won't track me, or try to invade my computer, right? Because if you didn't, it's blocked and you can whine and call me bad names the entire day, it won't change a thing.

By the way, I never saw adblockers blocking properly applied, safe to load ads. Maybe they do, I don't use them for quite a long time (I use other tech).

DanAndersen|12 years ago

I agree there are some parallels between ad-blocking and piracy (though they do tend to be in the realm of the "piracy = theft" idea rather than copyright-related parallels).

However, I think it's also important to recognize that by similarly-strong analogy, advertisements in general are inherently a sort of mental manipulation or brainwashing.

Now, I'm not saying that mental manipulation is inherently a bad or evil thing. When I'm writing this post, I hope that those reading it will become in some way more mentally accepting of my point of view. But I think we don't look enough at how susceptible we are to advertising, and how much advertising depends on exploiting cognitive biases or implying untruths that are not explicitly stated.

We (humans) are really bad at not being affected by advertising, even if we know we're being advertised to, and even if we know the ad is deceptive. When sites depend on ad revenue, they're saying "We're offering this content for free, but in exchange we want to be able to bias/prime your brain so that when you see Product X, even far in the future, you are more likely to desire it." That's a very powerful thing, and while it's certainly necessary for many business models today, I think we should think of this as a "necessary evil."

There are sites where I disable ad-blocking, often in response to a genuine plea on the part of the website. If it's a site I particularly care about and feel that I trust, then I allow ads as a way of helping them out. But if ad-blocking is piracy, then ads themselves are brainwashing -- exploiting failings in human cognition to unconsciously guide people into actions or purchases that may or may not be optimal for them -- and with the subject having limited defenses against it once infected.

__david__|12 years ago

You act like there's some sort of contract that says I have to download and display everything in your html.

There is not.

fauigerzigerk|12 years ago

I also want the ad funding model to be viable. I'm happy to consider ads on my screen as a form of payment and I would not block them out of convenience alone.

But if the advertising industry starts to act like one huge criminal enterprise without any limits to the kind of deceptive practices they use I'm forced to defend myself.

I see no reason to be fair to those who deceive me whenever they can.

mistercow|12 years ago

As someone who has paid for advertising on websites, I'm happy that some of the users who are definitely not going to click on the ad aren't served them.

But beyond that, this is pretty irrelevant to the topic at hand. However you feel about ad blockers, tricking people into turning them off is still completely unacceptable.

r0h1n|12 years ago

What if users don't block ads but never click on one either?

bencollier49|12 years ago

Doesn't claiming that Adblock is "malicious" come under the remit of libel laws?

chalst|12 years ago

I haven't found that exact claim on the site. It does list these blockers as "Liste von bekannten seitenmanipulierenden Add-ons" (known site-manipulating add-ons) [2] and on the main page "Diese seitenmanipulierenden Add-ons stellen ein erhebliches Sicherheitsrisiko für Sie dar!" (these site-manipulating add-ons put you in a situation of increased security risk) [1]. Together, these two assertions might be libellous, but because they are not together, I guess it is not as straightforward as the words of Michael Büker's post suggests.

[1]: http://www.browsersicherheit.info

[2]: http://www.browsersicherheit.info/addons.html

userbinator|12 years ago

What I don't get is why something like AdBlock should even be detectable...

Incidentally, I remember reading before that Germany had the largest percentage of users using AdBlock, so it makes sense that the pushback is starting here.

DanBC|12 years ago

I don't understand it.

Someone has said that they do not view advertising. They have modified their browser to avoid ads.

A marketer choses to ignore that person's choice and choses to use tricky technical means to ignore that person's wishes in order to show an ad.

How is that in any way beneficial to the product being advertised?

I am ad tolerant (don't run ad blockers etc) but behaviour like that fills me with rage. It is exactly the same kind of attitude that said it is fine to spew email to anyone whether they want it or not.

Marketers need a code of conduct to say that this behaviour is unacceptable.

mediumdeviation|12 years ago

Why wouldn't it be detectable? Ad blockers do their job by removing elements from the page, blocking requests to URLs that match those used to serve advertisements, or a combination both, and either one of those are easily detectable by client-side JavaScript.

shimfish|12 years ago

I drove myself insane for a morning recently when I couldn't work out why a site of mine that had happily been working for years suddenly stopped displaying some images in the carousel. They were there in the HTML but Chrome reckoned they were zero size. Eventually, it hit me that I should try turning off adblock. Turns out, I had called the imgs containg divs "#ad1", "#ad2". "#ad3", etc were all fine for some reason.

Anyway, the point is that you could probably easily check for adblock by checking the image size of something within a div named "advert".

fizz_and_buzz|12 years ago

They add a little javascript function that they call advertisment.js or something similar which just adds a div to the page (e.g.: document.write('<div id="test"></div>'); ). They then check if the div exists when the document is ready and notify the server. Adblock has a filter feature where you can enable specific javascript functions on a site, which allows you to circumvent this trick.

patal|12 years ago

Can we update the AdBlock list to suppress said yellow bar from display?

marcosdumay|12 years ago

It would be better to update browsers, to display a different warning, in a place where a page can't change at all. (And while we are there, Firefox, please, do the same with the master password dialog.)

But I doubt any of them will do that because, security be damed, it messes with the minimalist fashion.

frik|12 years ago

GMX plans to show a fake Firefox warning page, screenshot: http://www.browsersicherheit.info/img/anleitungen/ff_win/fir...

  The GMX website is disrupted by a plugin

  (orginal: Die GMX Website wird durch ein Plugin gestört)
As you can see on their "information campaign" page: http://www.browsersicherheit.info/sicherheit_ff.html

They also faked press articles: http://www.browsersicherheit.info/pressestimmen.html (two websites are related to "1&1"-company and they other one is "Bild")

inanov|12 years ago

> The requested URL / was not found on this server.

webpages at http://browsersicherheit.info/ seems to be removed.

http://web.archive.org/web/20140226224721/http://www.browser... says that adblock "Filters page content"

RamiK|12 years ago

Really a shame for them to resort to such unscrupulous tactics. I quite like 1&1 too. Their mail.com mobile interface ( https://m.mail.com/int/ ) works with NoScript and is perfect as far as my needs are concerned. Quite nice looking too. Very flat and minimal while being completely functional.

Such a shame...

mistercow|12 years ago

There's only one appropriate response to this from browser vendors: add those sites with to the malicious site list so that they show the big "danger ahead" warning when you visit them.

This kind of social engineering approach to removing an extension is not significantly different from a browser exploit that achieves the same result.

blueskin_|12 years ago

I doubt even many users will be stupid enough to not only click some random fake error ad, but follow the advice of a dodgy site. Almost everyone who has adblock installed it knowingly, wanting the effect and knowing what it does.

Perseids|12 years ago

What about all those friends and relatives we do tech support for. Most of them have not installed their addons on their own.

sweedy|12 years ago

some years ago i worked for 1 & 1, and when I think back to their customers, i can imagine that it would work. And I see the reason also because they were one of the first to have offered in Germany emails that were in vain financed by massive advertising, and AdBlock is certainly no fun for them. Just to compare, this looks my Landing Page with, and without AdBlock.. http://i.imgur.com/bgTCRJN.png

slipstream-|12 years ago

Socialing people to remove adblock?!

I'm amazed they don't just social people to download toolbar claiming to fix the "security compromises".

r00fus|12 years ago

Because a) one is already known as being scammy and b) doing the latter might get the site listed as a ad/malware provider, which may run into browser and protection suites labeling the site.

hiphopyo|12 years ago

Are there any ways for websites to bypass AdBlock? Anybody know of any JS projects on GitHub or similar that do this?

__david__|12 years ago

What's the point? It's just an arms race you could never win...

agapos|12 years ago

Wouldn't be possible to sue them for misleading of customers (users) or something similar?

BrownBuffalo|12 years ago

Those pesky Germans. Always up to something sneaky.