1

I've increasingly been finding that many of the websites that I access have now been requesting whitelisting by my adblocker.

Sites that do this like Forbes, NDTV, do not allow you to proceed until the domain is whitelisted: enter image description here

Is there a general list of ways in which adblockers are detected?

Can't the adblocker download and render content in some form of invisible sandbox to trick the website's detection script? Some solutions involve importing fake cookies or modifying Javascript. Can any of these techniques be used safely, without actually allowing ad-providers from tracking me?

7
  • like a javascript message requesting white listing before you continue or just a placeholder where an Ad belongs. – CaffeineAddiction Jun 30 '16 at 20:07
  • you might want to try ublock origin google.com/search?q=ublock+origin its like adblock but better ... for instance I have no issues getting into Forbes – CaffeineAddiction Jun 30 '16 at 20:29
  • 2
    It's a cat-and-mouse-game really. The more websites try to detect ad blocking, the more sophisticated content filter extensions get. I think there's some commonly used service out there that offers a script to try to detect blocked ads. – Alexander O'Mara Jun 30 '16 at 20:34
  • 1
    @Jedi ... it does more or less the same thing Adblock and Adblock Plus do ... but it hasnt sold out yet. – CaffeineAddiction Jun 30 '16 at 21:04
  • 1
    Simulating ad display (without actually loading ad code) should be safe. However, actually loading the ads (even though they are not displayed) still puts you at risk of malvertising as if you weren't running an adblocker at all. – André Borie Jul 3 '16 at 1:06
1

First, control which scripts are loaded

The most important reason to block ads is to protect yourself from malicious, dangerous and incompetent code delivered through these ads. Accordingly, script blocking is a far better method than ad blocking (alone). Once you do that, you can leverage that tool for fine-grained control.

Let's first assume that you block all scripts completely. That massively reduces the amount of checking the site can do, because all checks must now be on the server-side. But ads and content are normally served from different servers for a variety of reasons, so you can expect very little interference. Theoretically, a site could hide all content behind an initial script that must be executed first - but that would reduce the performance drastically and nobody wants that.

Of course the modern internet is unusable without some scripts. But the result of the previous discussion is that it's also pretty unusable and insecure with too many scripts. The solution, then, is the good old middle way.

So here's a good plan of action: First, load the site with all scripts disabled or only scripts from the same origin enabled. Mark ad network domains as untrusted sources to help filter the lists. Then enable sources temporarily one by one if functionality is missing.

Note however that there is a learning curve. Which sources are necessary for fancy fonts or other very important content (tm)? Which one of the twenty-odd sources of the average site are actually ad-agencies, market research-sites, tracking-sites, or generally malicious? You may need some understanding of marketing techniques to classify them. Also, many scripts are chain-loaded, so once you load a new script new sources will appear that you might need to sort further.

Then, control cookies

Cookies can be a nasty invasion of privacy but at least they can't break your system. And if you don't load scripts from a certain source, you don't have to worry about their cookies as much. But while most sites react nicely to missing scripts, missing cookies can create nasty, unpredictable problems. Faking them might be a middle ground, but I haven't tested that. I expect that to be a very brittle solution. Good web developers (no, that's not actually a natural contradiction) will encrypt their cookies anyway, so the easiest way is to sandbox them on a per-site basis and delete them regularly.

Lastly, be nice

It doesn't look like the need for ads will be going away soon. But right now there is an imbalance, and less technically versed people are "paying" for others by looking at more ads. In the long run, something will have to be done about that. Just ignoring the problem and blocking every ad will only get us on the "bad" side of the discussion once it comes. It also forces the market to use more and more malicious solutions.

A smarter solution is to use our knowledge to not only block malicious networks, but also to vet "good" ones. If you find one, consider putting it on a whitelist. Maybe while still deleting cookies, maybe only scripts that pass an automatic test, maybe only scripts with a certain hash... there are lots of ways. Of course using adblock-buster scripts is a bad sign, so Forbes should probably stay on the blacklist for now. But maybe others should not.

0
1

The way these scripts work is by trying to detect if a HTML element that is supposed to be holding the ad exists or is empty since adblocks methods are to remove the content from the page.

Adblocker's don't have much to do about it since they remove the elements/empty them which can be easily detect by Javascript with some code as the following:

if (document.getElementById('adelement')){
   console.log("No ad blocker detected.");
}else{
   console.log("You're using an Adblocker!");
}

The ideal solution would be to detect the Javascript that is checking for an adblocker while clearing the cookies to ensure privacy so you wont be tracked.

Can any of these techniques be used safely, without actually allowing ad-providers from tracking me?

If the adblocker does indeed clear your cookies which is the main source of identification for the ad providers your privacy will be enhanced.

Some other ways adblockers work:

  • Element with attributes that have the word ad in them
  • Scripts being loaded that have the word ad in them in any sort of way.
  • Find a url that is generally used for ads (For example google ads) and block the network request causing the ad not to load (The url is usaully detected from a blacklist of ad websites).
9
  • Most content filter extensions primarily block network requests based on URL blacklists and/or add CSS styles to hide elements. – Alexander O'Mara Jun 30 '16 at 20:30
  • @AlexanderO'Mara That is what I meant, I changed the way I wrote it to be more specific. – Bubble Hacker Jun 30 '16 at 20:33
  • In an edit the OP added Can any of these techniques be used safely? – Neil Smithline Jun 30 '16 at 20:44
  • Yeah, there are solutions available, but as @NeilSmithline suggests I'm wondering if they expose me to any threats that the adblocker was designed to solve. – Jedi Jun 30 '16 at 20:46
  • @Jedi What kind of threats are you talking about? Stealing your data? – Bubble Hacker Jun 30 '16 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.