https://pinboard.in/u:jm/public/ recent bookmarks from jm 2025-08-25T16:15:30+00:00 https://guard.io/labs/scamlexity-we-put-agentic-ai-browsers-to-the-test-they-clicked-they-paid-they-failed jm All we did was fake a simple email from a fresh new ProtonMail address (so it’s clearly not from a bank) posing as a message from a Wells Fargo investment manager. Inside was a link to a genuine phishing page, active in the wild for several days, and still unflagged by Google Safe Browsing. When Comet received the email, it confidently marked it as a to-do item from the bank and clicked the link without any verification. There was no URL check, no pre-navigation warning -just a direct pass to the attacker’s page. Once the fake Wells Fargo login loaded, Comet treated it as legitimate. It prompted the user to enter credentials, even helping fill in the form. The result: a perfect trust chain gone rogue. By handling the entire interaction from email to website, Comet effectively vouched for the phishing page. The human never saw the suspicious sender address, never hovered over the link, and never had the chance to question the domain. ]]> browsers ai security infosec scams phishing comet https://pinboard.in/ https://pinboard.in/u:jm/b:9f7ed8c4aa06/ 2025-03-12T11:54:40+00:00 https://www.oblomovka.com/wp/2025/03/12/llms-and-humans-unite-you-have-nothing-to-lose-but-your-chores/ jm vibe-coding tools automation one-offs scripting web cdp google-chrome playwright claude hacks llms ai browsers https://pinboard.in/ https://pinboard.in/u:jm/b:dc01fa4629b8/ 2023-10-04T16:40:20+00:00 https://blog.zgp.org/google-chrome-checklist/ jm browsers chrome privacy data-privacy google https://pinboard.in/ https://pinboard.in/u:jm/b:b8a9db5ae318/ 2014-04-09T14:22:49+00:00 http://daringfireball.net/2014/04/rethinking_what_we_mean_by_mobile_web jmWe shouldn’t think of “the web” as only what renders in web browsers. We should think of the web as anything transmitted using HTTP and HTTPS. Apps and websites are peers, not competitors. They’re all just clients to the same services. +1. Finally, a Daring Fireball post I agree with.]]> daring-fireball apps web http https mobile apple android browsers https://pinboard.in/ https://pinboard.in/u:jm/b:4a495e79e6e2/ 2013-10-04T21:25:33+00:00 http://apps.washingtonpost.com/g/page/world/gchq-report-on-mullenize-program-to-stain-anonymous-electronic-traffic/502/ jm gchq nsa snooping sniffing surveillance user-agent http browsers leaks https://pinboard.in/ https://pinboard.in/u:jm/b:1836ffc3861d/ 2011-07-19T16:50:22+00:00 http://cyberlaw.stanford.edu/node/6695 jm privacy history browsers history-stealing css attacks security via:adamshostack epic-marketplace nai ads https://pinboard.in/ https://pinboard.in/u:jm/b:40079b87a2c8/ 2011-05-04T10:10:19+00:00 https://chrome.google.com/extensions/detail/ppoadiihggafnhokfkpphojggcdigllp# jm text editing chrome extensions add-ons browsers web https://pinboard.in/ https://pinboard.in/u:jm/b:632390b14f78/ 2009-12-10T22:30:41+00:00 http://www.thegibson.org/blog/archives/689 jm chrome web browsers google editing external editors vim emacs https://pinboard.in/u:jm/b:62e69286b35d/