[{"data":1,"prerenderedAt":885},["ShallowReactive",2],{"learn-index":3},[4,224,442,656],{"id":5,"title":6,"body":7,"category":198,"description":199,"draft":200,"extension":201,"meta":202,"navigation":203,"path":204,"publishedAt":205,"readingTime":206,"seo":207,"sources":208,"stem":221,"updatedAt":222,"__hash__":223},"learn\u002Flearn\u002Fwhat-are-dark-patterns.md","What are dark patterns? A plain-language field guide",{"type":8,"value":9,"toc":180},"minimark",[10,14,17,22,30,33,41,45,48,51,54,57,61,66,69,73,76,80,83,87,90,94,103,107,110,114,117,120,123,126,130,133,167,170,174,177],[11,12,13],"p",{},"You meant to cancel. You ended up subscribed for another year. You meant to reject the cookies.\nYou ended up accepting all 847 \"partners\". You meant to buy one thing. There were three things\nin the basket at checkout.",[11,15,16],{},"You are not careless. The interface was built that way.",[18,19,21],"h2",{"id":20},"the-definition","The definition",[11,23,24,25,29],{},"A ",[26,27,28],"strong",{},"dark pattern"," is an interface deliberately designed to get you to do something you didn't\nmean to do — spend more, share more, or stay subscribed longer than you intended.",[11,31,32],{},"UX designer Harry Brignull coined the term in 2010, naming an initial set of twelve specific\ninterface tricks. The word stuck because it named something everyone had experienced but nobody\nhad a word for. It has since been written into European law through the Digital Services Act and\ninto US Federal Trade Commission enforcement guidance. Brignull himself now prefers \"deceptive\npatterns\", which is clearer about what is going on.",[11,34,35,36,40],{},"The key word is ",[37,38,39],"em",{},"deliberately",". A confusing checkout built by a rushed team is bad design. A\ncheckout where the \"no thanks\" link is grey, small, and below the fold is a decision somebody\nmade, tested, and kept because it worked.",[18,42,44],{"id":43},"why-they-work-on-you-specifically","Why they work on you, specifically",[11,46,47],{},"It is tempting to think this only happens to people who don't read carefully. That is not what\nthe research shows.",[11,49,50],{},"Nobody reads an interface the way they read a book. We skim for the thing we came to do, we\nfollow the brightest button, and we decide in under a second. Interfaces are designed around\nthose habits. A dark pattern doesn't defeat your intelligence; it exploits the gap between how\nfast you decide and how fast you could reason if you stopped to.",[11,52,53],{},"And stopping to reason isn't enough either. A 2021 study surveyed 406 people and found they were\ngenerally aware that manipulative designs influence their behaviour online — but being aware did\nnot equip them to resist it. Participants often recognised that a design was manipulative while\nremaining unsure what harm it would actually cause them. Knowing about the trap and being able to\nstep around it turn out to be two different skills.",[11,55,56],{},"That finding is the reason this tool exists. If awareness were sufficient, an article would be\nenough. It isn't. Help has to arrive at the moment of the decision.",[18,58,60],{"id":59},"the-common-types","The common types",[62,63,65],"h3",{"id":64},"confirmshaming","Confirmshaming",[11,67,68],{},"The opt-out is worded to make you feel bad. \"No thanks, I don't want to save money.\" \"I prefer\npaying full price.\" The decline option works perfectly well — it just costs you a small\nhumiliation to use it.",[62,70,72],{"id":71},"roach-motel","Roach motel",[11,74,75],{},"Easy to get in, hard to get out. Signing up takes one click and no confirmation. Cancelling takes\nfour screens, a retention offer, a phone call during office hours, and an email you have to\nreply to. The asymmetry is the tell: if creating an account is instant, deleting it can be\ninstant too.",[62,77,79],{"id":78},"fake-urgency","Fake urgency",[11,81,82],{},"\"Only 2 left!\" \"Offer ends in 09:58.\" Sometimes true, often not. The giveaway is a countdown that\nresets when you reload the page, or a scarcity notice that has said \"2 left\" for three weeks.\nReal scarcity is a fact about inventory. Fake urgency is a fact about the page.",[62,84,86],{"id":85},"sneaking","Sneaking",[11,88,89],{},"Something gets added that you didn't ask for. An extra item in the basket, insurance pre-selected\non a flight, a \"donation\" rounded up by default. Nothing is hidden exactly — it's simply placed\nwhere you have no reason to look.",[62,91,93],{"id":92},"obstruction","Obstruction",[11,95,96,97,102],{},"The path you want is made deliberately longer. The unsubscribe link at the bottom of an email\nin 6pt grey. The privacy settings spread across nine separate pages. The reject button one layer\ndeeper than the accept button, which is the specific version that shows up in\n",[98,99,101],"a",{"href":100},"\u002Flearn\u002Fcookie-banners-real-rejection","cookie banners",".",[62,104,106],{"id":105},"trick-wording","Trick wording",[11,108,109],{},"The sentence is constructed so the obvious reading is the wrong one. \"Uncheck this box if you do\nnot wish to not receive marketing emails.\" Read it twice. Now read it the way you would if you\nwere in a hurry.",[18,111,113],{"id":112},"how-common-is-this-really","How common is this, really?",[11,115,116],{},"Common enough that \"some apps do this\" understates it badly.",[11,118,119],{},"Researchers analysed 240 popular mobile apps in 2020 and found that 95% contained at least one\ndark pattern. The average app used at least seven different types. Not one trick per app — seven,\nlayered, in the apps most people have on their phones right now.",[11,121,122],{},"Regulators noticed. The FTC's September 2022 staff report, \"Bringing Dark Patterns to Light\",\ndocumented four tactics it sees most often: disguising ads as ordinary content, making\nsubscriptions hard to cancel, burying key terms and junk fees, and tricking people into handing\nover data. The report drew on cases across e-commerce, cookie consent banners, children's apps\nand subscription sales.",[11,124,125],{},"Enforcement is real but slow, and it works at the level of companies rather than the level of\nyour Tuesday evening.",[18,127,129],{"id":128},"how-to-spot-them","How to spot them",[11,131,132],{},"A few habits catch most of it:",[134,135,136,143,149,155,161],"ul",{},[137,138,139,142],"li",{},[26,140,141],{},"Compare the two buttons."," If yes and no are not the same size, colour, and weight, somebody\nhas a preference about your answer.",[137,144,145,148],{},[26,146,147],{},"Look for the asymmetry."," Count the clicks to opt in, then the clicks to opt out. That ratio\nis the whole story.",[137,150,151,154],{},[26,152,153],{},"Reload the page."," A countdown that starts over was never counting anything.",[137,156,157,160],{},[26,158,159],{},"Read the sentence with the checkbox twice."," Especially if it contains \"not\".",[137,162,163,166],{},[26,164,165],{},"Check the basket, not the product page."," Sneaking happens between the two.",[11,168,169],{},"None of this is difficult. It is just effortful, every time, on every site, forever — which is\nprecisely why almost nobody sustains it.",[18,171,173],{"id":172},"where-we-come-in","Where we come in",[11,175,176],{},"Can I Throw This? is being built to do the noticing for you. When a page uses a pattern from this\nguide, the extension names it in plain language, right where it happens — not in a report you\nread afterwards, but at the moment you were about to click.",[11,178,179],{},"It runs entirely on your device. Recognising a countdown timer doesn't require anyone to know\nwhat you were shopping for.",{"title":181,"searchDepth":182,"depth":182,"links":183},"",2,[184,185,186,195,196,197],{"id":20,"depth":182,"text":21},{"id":43,"depth":182,"text":44},{"id":59,"depth":182,"text":60,"children":187},[188,190,191,192,193,194],{"id":64,"depth":189,"text":65},3,{"id":71,"depth":189,"text":72},{"id":78,"depth":189,"text":79},{"id":85,"depth":189,"text":86},{"id":92,"depth":189,"text":93},{"id":105,"depth":189,"text":106},{"id":112,"depth":182,"text":113},{"id":128,"depth":182,"text":129},{"id":172,"depth":182,"text":173},"dark-patterns","A dark pattern is an interface designed to get you to do something you didn't mean to do. Here's how to recognise the common ones.",false,"md",{},true,"\u002Flearn\u002Fwhat-are-dark-patterns","2026-09-22",6,{"title":6,"description":199},[209,212,215,218],{"label":210,"url":211},"Di Geronimo et al., \"UI Dark Patterns and Where to Find Them\", CHI 2020","https:\u002F\u002Fdoi.org\u002F10.1145\u002F3313831.3376600",{"label":213,"url":214},"Bongard-Blanchy et al., \"I am definitely manipulated, even when I am aware of it\", DIS 2021","https:\u002F\u002Fdoi.org\u002F10.1145\u002F3461778.3462086",{"label":216,"url":217},"FTC staff report, \"Bringing Dark Patterns to Light\" (September 2022)","https:\u002F\u002Fwww.ftc.gov\u002Freports\u002Fbringing-dark-patterns-light",{"label":219,"url":220},"Deceptive Patterns (Harry Brignull)","https:\u002F\u002Fdeceptive.design\u002F","learn\u002Fwhat-are-dark-patterns",null,"kp2bgQrL45OUpDTnKGgsC4Hh3xJJhXE_ttLsJApwTmw",{"id":225,"title":226,"body":227,"category":426,"description":427,"draft":200,"extension":201,"meta":428,"navigation":203,"path":100,"publishedAt":429,"readingTime":430,"seo":431,"sources":432,"stem":440,"updatedAt":222,"__hash__":441},"learn\u002Flearn\u002Fcookie-banners-real-rejection.md","Cookie banners and how to actually say no",{"type":8,"value":228,"toc":418},[229,232,235,239,242,245,248,252,255,260,263,281,284,287,291,300,306,312,318,324,328,331,334,341,344,347,350,354,361,364,402,405,409,412,415],[11,230,231],{},"Everyone hates cookie banners. Almost nobody reads them. Most people click whatever makes the\nbox go away fastest — which is exactly the behaviour the boxes are designed around.",[11,233,234],{},"Here is what they are for, what has gone wrong with them, and what saying no properly actually\ninvolves.",[18,236,238],{"id":237},"why-the-banners-exist","Why the banners exist",[11,240,241],{},"Under EU law — the GDPR together with the ePrivacy Directive — a site needs your permission\nbefore storing or reading non-essential information on your device. That covers advertising\ncookies, analytics cookies, and most of the tracking technology that follows you between sites.\nIt does not cover the strictly necessary things, like remembering you are logged in or what is in\nyour basket. Those need no banner.",[11,243,244],{},"The law asks for consent that is freely given, specific, informed, and unambiguous. In interface\nterms that means roughly three things: nothing is pre-ticked, saying no is as easy as saying yes,\nand you know what you are agreeing to before you agree to it.",[11,246,247],{},"That is the standard. Now the reality.",[18,249,251],{"id":250},"what-the-banners-actually-do","What the banners actually do",[11,253,254],{},"In 2020 researchers scraped the consent pop-ups of the five most popular consent management\nplatforms across the UK's top 10,000 websites — 680 sites in all — and checked them against the\nminimum requirements of European law.",[11,256,257],{},[26,258,259],{},"11.8% met them.",[11,261,262],{},"The specifics are worse than the headline:",[134,264,265,271,274],{},[137,266,267,270],{},[26,268,269],{},"50.1% of the notices had no \"reject all\" button anywhere in the interface."," Not buried, not\nhidden — simply absent.",[137,272,273],{},"Where a reject option existed, it was one layer deeper than accept in 74.3% of cases.",[137,275,276,277,280],{},"An \"accept all\" button was ",[26,278,279],{},"never"," buried in a second layer. Not once.",[11,282,283],{},"That last detail is the one to hold onto. The asymmetry is not an accident of different teams\nmaking different choices. In a large sample, the convenient option was never the one that took\nan extra click. Somebody decided, consistently, which answer should be easy.",[11,285,286],{},"The study also ran a field experiment with real participants and found that these design choices\nmeasurably change what people consent to. Removing the opt-out from the first page increased\nconsent. Nudging with pre-selection increased consent. The designs work, which is why they\npersist.",[18,288,290],{"id":289},"the-tricks-by-name","The tricks, by name",[11,292,293,296,297,299],{},[26,294,295],{},"No reject button on the first screen."," You get \"Accept all\" and \"Manage preferences\". One is a\nclick; the other is a chore. This is ",[98,298,92],{"href":204},", applied to a\nlegal right.",[11,301,302,305],{},[26,303,304],{},"Pre-ticked boxes."," You open the preferences panel and the toggles are already on. Consent that\nyou have to withdraw was never consent you gave.",[11,307,308,311],{},[26,309,310],{},"\"Legitimate interest\" toggles."," A separate set of switches, often on by default, on a separate\ntab, which some vendors argue don't require consent at all. The practical effect is that turning\neverything off requires finding a second list of things to turn off.",[11,313,314,317],{},[26,315,316],{},"Sheer volume."," \"We and our 1,438 partners.\" Nobody is reviewing 1,438 partners. The number is\nitself the deterrent.",[11,319,320,323],{},[26,321,322],{},"The visual thumb on the scale."," Accept is a solid, coloured, high-contrast button. Reject is\ngrey text that doesn't look clickable. Both technically present. Only one designed to be pressed.",[18,325,327],{"id":326},"hiding-a-banner-is-not-rejecting-it","Hiding a banner is not rejecting it",[11,329,330],{},"This is the part that surprises people, and it matters more than any of the tricks above.",[11,332,333],{},"A lot of popular tools — the cosmetic filter lists in ad blockers, \"I don't care about cookies\"\nstyle extensions — work by hiding the banner element. The box disappears and the page looks\nclean.",[11,335,336,337,340],{},"But the banner was only ever the ",[37,338,339],{},"interface",". Underneath it sits a consent management platform\nthat records a decision and passes it to advertisers. Hide the box without answering it and,\ndepending on the site, one of two things happens: no consent is recorded and some sites treat\ncontinued browsing as implied consent, or the default state — frequently \"accept\" — stands.",[11,342,343],{},"You have removed the question from your screen, not the tracking from your browser. The\nrelief is genuine and the protection is imaginary.",[11,345,346],{},"Rejecting properly means interacting with the consent platform the way the law intends: finding\nthe reject control, including the legitimate-interest toggles, and submitting a negative answer\nthat gets recorded. Done by hand, on every site, that is the chore everyone is trying to escape.\nDone automatically — as tools like Consent-O-Matic have demonstrated, by learning each platform's\ninterface and filling it in correctly — it takes no effort at all.",[11,348,349],{},"That is the difference between hiding and rejecting, and it's the one to insist on.",[18,351,353],{"id":352},"what-a-fair-banner-looks-like","What a fair banner looks like",[11,355,356,357,360],{},"You are looking at one. If you haven't seen our consent prompt yet, open ",[26,358,359],{},"Privacy settings"," in\nthe footer of this page and it will come back.",[11,362,363],{},"Here is what we committed to, and what you can check:",[134,365,366,372,378,384,390,396],{},[137,367,368,371],{},[26,369,370],{},"Accept and Reject are the same component."," Same size, same colour, same font weight, side by\nside. Not \"similar\" — literally the same button with different text, so they cannot drift apart\nas the site changes.",[137,373,374,377],{},[26,375,376],{},"Nothing is pre-selected."," There is no default answer sitting there waiting for you to not\nnotice it.",[137,379,380,383],{},[26,381,382],{},"Closing the banner counts as rejecting."," The × is not \"ask me later\" and it is not a quiet\nyes. It is a no, and the button says so.",[137,385,386,389],{},[26,387,388],{},"It never blocks the page."," No overlay, no scroll lock. You can ignore it entirely and read\nthe site, and ignoring it means nothing loads.",[137,391,392,395],{},[26,393,394],{},"Withdrawing is as easy as consenting."," One link in the footer of every page, always there.",[137,397,398,401],{},[26,399,400],{},"There are no partners."," There is one analytics tool, it is named, and it does not run until\nyou say yes.",[11,403,404],{},"We are not claiming credit for this. It is roughly what the law asked for in the first place. It\nis only remarkable because 88.2% of the sites in that study didn't manage it.",[18,406,408],{"id":407},"what-the-extension-will-do","What the extension will do",[11,410,411],{},"Can I Throw This? will handle consent properly on your behalf: recognising the major consent\nplatforms, submitting a genuine rejection rather than hiding the box, and turning off the\nlegitimate-interest toggles that hide on the second tab.",[11,413,414],{},"Where a banner uses one of the tricks above, it will say which one, so the pattern becomes\nvisible instead of just annoying.",[11,416,417],{},"And when we ask you a question on our own site, we will ask it the way we just did.",{"title":181,"searchDepth":182,"depth":182,"links":419},[420,421,422,423,424,425],{"id":237,"depth":182,"text":238},{"id":250,"depth":182,"text":251},{"id":289,"depth":182,"text":290},{"id":326,"depth":182,"text":327},{"id":352,"depth":182,"text":353},{"id":407,"depth":182,"text":408},"cookie-consent","Half of consent pop-ups never offer a reject button at all. Here's what the law asks for, what sites do instead, and why hiding a banner isn't the same as rejecting it.",{},"2026-09-21",7,{"title":226,"description":427},[433,436,439],{"label":434,"url":435},"Nouwens et al., \"Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence\", CHI 2020","https:\u002F\u002Fdoi.org\u002F10.1145\u002F3313831.3376321",{"label":437,"url":438},"Consent-O-Matic (Aarhus University)","https:\u002F\u002Fgithub.com\u002Fcavi-au\u002FConsent-O-Matic",{"label":216,"url":217},"learn\u002Fcookie-banners-real-rejection","cBrvooFyZnGIi606cCb0OGpDTypek34p-WaAaZhjn6g",{"id":443,"title":444,"body":445,"category":638,"description":639,"draft":200,"extension":201,"meta":640,"navigation":203,"path":641,"publishedAt":642,"readingTime":206,"seo":643,"sources":644,"stem":654,"updatedAt":222,"__hash__":655},"learn\u002Flearn\u002Fclickfix-fake-captcha.md","ClickFix: the fake CAPTCHA that makes you hack yourself",{"type":8,"value":446,"toc":629},[447,450,457,461,464,478,481,485,488,510,513,516,519,523,526,533,536,539,543,554,557,560,564,567,574,577,580,583,597,604,608,615,618,620,623,626],[11,448,449],{},"There is an attack going around that doesn't break into your computer. It asks you to do it, and\nyou agree, because the request looks completely routine.",[11,451,452,453,456],{},"It's called ",[26,454,455],{},"ClickFix",", and in the first half of 2025 it grew by 517%.",[18,458,460],{"id":459},"the-setup","The setup",[11,462,463],{},"You land on a page. Something small is wrong, in a way you've seen a hundred times before:",[134,465,466,469,472,475],{},[137,467,468],{},"A \"verify you are human\" box that spins and fails.",[137,470,471],{},"A video that won't play: \"your browser is missing a codec\".",[137,473,474],{},"A document that won't open: \"click to fix the display error\".",[137,476,477],{},"A site that says your browser is out of date.",[11,479,480],{},"None of it is alarming. That's the design. A dramatic warning makes people suspicious; a minor\ntechnical hiccup makes people compliant. You've fixed a dozen of these before.",[18,482,484],{"id":483},"the-ask","The ask",[11,486,487],{},"Then comes the instruction, presented as the fix:",[489,490,491],"blockquote",{},[492,493,494,500,505],"ol",{},[137,495,496,497],{},"Press ",[26,498,499],{},"Windows + R",[137,501,496,502],{},[26,503,504],{},"Ctrl + V",[137,506,496,507],{},[26,508,509],{},"Enter",[11,511,512],{},"On a Mac it's Terminal instead of the Run dialog. On Linux, a shell. Sometimes it's dressed up as\na \"verification code\" you need to paste to prove you're not a bot.",[11,514,515],{},"What you don't see is that the page already put something on your clipboard. Ctrl+V isn't pasting\na verification code. It's pasting a command — usually one that downloads and runs a program from\nsomewhere else, padded with enough spaces that the visible part looks harmless if you glance at\nit.",[11,517,518],{},"Press Enter and you have installed it. Personally. With your own permissions.",[18,520,522],{"id":521},"why-your-antivirus-doesnt-stop-it","Why your antivirus doesn't stop it",[11,524,525],{},"This is the clever part, and it's worth understanding rather than just fearing.",[11,527,528,529,532],{},"Security software is built around a question: ",[37,530,531],{},"did something happen that the user didn't ask\nfor?"," A program writing to a system folder unprompted, a download executing itself, a browser\nspawning a shell — all suspicious, all flagged.",[11,534,535],{},"ClickFix produces none of those signals. There is no exploit, no drive-by download, no software\nvulnerability anywhere in the chain. A human opened a legitimate system dialog and ran a command.\nFrom the operating system's point of view, that is Tuesday.",[11,537,538],{},"The attack doesn't defeat your security software. It goes around it, using you as the delivery\nmechanism. This is why it's often described as social engineering rather than hacking — the only\nthing being exploited is the reasonable assumption that a small technical problem deserves a\nsmall technical fix.",[18,540,542],{"id":541},"how-big-is-this","How big is this?",[11,544,545,546,549,550,553],{},"ESET's threat report for the first half of 2025 put the growth at ",[26,547,548],{},"517%"," compared with the\nprevious period. That made ClickFix the ",[26,551,552],{},"second most common attack vector",", behind only\nphishing, and it accounted for close to 8% of all blocked threats.",[11,555,556],{},"It works on Windows, macOS and Linux, because the technique doesn't depend on the platform — it\ndepends on the person.",[11,558,559],{},"What arrives afterwards varies: infostealers that empty password managers and crypto wallets,\nransomware, remote access trojans, cryptominers, and tooling used by nation-state groups.\nClickFix is the front door. What comes through it is whoever bought access.",[18,561,563],{"id":562},"the-one-rule","The one rule",[11,565,566],{},"Almost all of this collapses to a single sentence, and it's worth memorising rather than\nreasoning about in the moment:",[489,568,569],{},[11,570,571],{},[26,572,573],{},"A real CAPTCHA never asks you to open a Run dialog, a terminal, or paste anything.",[11,575,576],{},"That's it. Verifying you're human happens entirely inside the web page — you click a checkbox,\nyou pick the bicycles, you do nothing at all while it checks how your mouse moved. It has never\ninvolved your operating system, because a web page proving you're human has no business\nexecuting commands on your computer.",[11,578,579],{},"The same applies to fixing a video, a codec, a font, or a display error. Legitimate sites do not\nsolve their problems by having you run commands. If a page walks you through a keyboard sequence\nthat leaves the browser, the page is the problem.",[11,581,582],{},"Two supporting habits:",[134,584,585,591],{},[137,586,587,590],{},[26,588,589],{},"Treat a pre-filled clipboard as a warning."," If you didn't copy anything and something is\nthere, close the tab.",[137,592,593,596],{},[26,594,595],{},"Never paste into a terminal without reading it",", in full, scrolled to the right. The\ndangerous part is often pushed off-screen behind whitespace.",[11,598,599,600,603],{},"If you already ran one: disconnect from the network, change passwords from a ",[37,601,602],{},"different"," device —\nstarting with email and anything financial — and run a full scan. Infostealers work in seconds,\nso assume anything saved in the browser is gone.",[18,605,607],{"id":606},"browsers-are-starting-to-help","Browsers are starting to help",[11,609,610,611,614],{},"Until recently, none of this was the browser's problem. That changed on 2 July 2026, when Opera\nshipped ",[26,612,613],{},"Paste Protect",", the first native defence against clipboard attacks in a major browser.\nIt watches for suspicious commands being copied from web pages, blocks the content before it\nreaches the clipboard, and tells you an attempt was made. It's on by default.",[11,616,617],{},"It's a good feature and it demonstrates the point: the moment of protection has to be the moment\nof the copy, not an article you read last month. Most people are not using Opera, though, and the\nother major browsers have not yet followed.",[18,619,408],{"id":407},[11,621,622],{},"Can I Throw This? will watch for the ClickFix shape specifically: a page writing a command to\nyour clipboard, and instructions telling you to open a system dialog and paste it.",[11,624,625],{},"When it sees that combination, it will say plainly what is happening — that the page has put a\ncommand on your clipboard and is asking you to run it, and that no genuine verification ever\nrequires this — at the moment you're being asked, which is the only moment the warning is any\nuse.",[11,627,628],{},"Detection runs on your device. Recognising this pattern requires looking at the page in front of\nyou, not at your browsing history.",{"title":181,"searchDepth":182,"depth":182,"links":630},[631,632,633,634,635,636,637],{"id":459,"depth":182,"text":460},{"id":483,"depth":182,"text":484},{"id":521,"depth":182,"text":522},{"id":541,"depth":182,"text":542},{"id":562,"depth":182,"text":563},{"id":606,"depth":182,"text":607},{"id":407,"depth":182,"text":408},"security-threats","A fake \"verify you're human\" box asks you to paste a command and press Enter. Your antivirus stays quiet, because you ran it yourself. One rule stops all of it.",{},"\u002Flearn\u002Fclickfix-fake-captcha","2026-09-20",{"title":444,"description":639},[645,648,651],{"label":646,"url":647},"ESET Threat Report H1 2025","https:\u002F\u002Fwww.welivesecurity.com\u002Fen\u002Feset-research\u002Feset-threat-report-h1-2025\u002F",{"label":649,"url":650},"ESET newsroom: ClickFix fake error surges, spreads ransomware and other malware (June 2025)","https:\u002F\u002Fwww.eset.com\u002Fus\u002Fabout\u002Fnewsroom\u002Fresearch\u002Feset-threat-report-clickfix-fake-error-surges-spreads-ransomware-and-other-malware\u002F",{"label":652,"url":653},"Opera: introducing Paste Protect (2 July 2026)","https:\u002F\u002Fblogs.opera.com\u002Fnews\u002F2026\u002F07\u002Fopera-introduces-paste-protect-to-keep-you-safe-from-clipboard-attacks\u002F","learn\u002Fclickfix-fake-captcha","Pliaw_sI2-r7R2EfHizY8tMVhZs04b1i7T1oAME7gGo",{"id":657,"title":658,"body":659,"category":867,"description":868,"draft":200,"extension":201,"meta":869,"navigation":203,"path":870,"publishedAt":871,"readingTime":430,"seo":872,"sources":873,"stem":883,"updatedAt":222,"__hash__":884},"learn\u002Flearn\u002Fmanifest-v3-your-adblocker.md","Your ad blocker changed: the Manifest V3 story",{"type":8,"value":660,"toc":859},[661,664,668,680,683,687,722,725,729,732,741,750,753,777,780,784,790,796,799,805,809,815,824,830,836,839,843,846,849,856],[11,662,663],{},"If your ad blocker stopped working, or quietly got worse, you're not imagining it. The rules\nchanged underneath it.",[18,665,667],{"id":666},"what-a-manifest-is","What a manifest is",[11,669,670,671,675,676,679],{},"Every browser extension ships with a file called ",[672,673,674],"code",{},"manifest.json",". It's the extension's\ndeclaration of itself: its name, its version, what permissions it wants, and which browser\ncapabilities it uses. The manifest ",[37,677,678],{},"version"," is which edition of the rulebook the extension is\nwritten against — what it's allowed to ask for, and how.",[11,681,682],{},"Manifest V2 was the rulebook for over a decade. Manifest V3 replaced it. The change matters\nbecause of one specific capability that went away.",[18,684,686],{"id":685},"the-timeline","The timeline",[134,688,689,698,704,710,716],{},[137,690,691,694,695,102],{},[26,692,693],{},"2018–2019"," — Google publishes the first Manifest V3 proposals. Developers of content\nblockers immediately object to the removal of blocking ",[672,696,697],{},"webRequest",[137,699,700,703],{},[26,701,702],{},"2020–2024"," — Repeated delays. Manifest V3 becomes mandatory for new submissions, then for\nupdates, while existing V2 extensions keep working.",[137,705,706,709],{},[26,707,708],{},"2025"," — Chrome begins disabling Manifest V2 extensions. Users see their blocker switched\noff, often with a prompt suggesting a replacement.",[137,711,712,715],{},[26,713,714],{},"Chrome 139"," — Manifest V2 support is gone from the browser entirely. Extensions still\ninstalled on Chrome 138 or earlier survive, but stop receiving updates.",[137,717,718,721],{},[26,719,720],{},"31 August 2026"," — The remaining Manifest V2 extensions, including the full uBlock Origin,\nare removed from the Chrome Web Store. Version 1.74 was the last stable uBO release to reach\nit.",[11,723,724],{},"If you installed uBlock Origin before the cutoff and stayed on an old Chrome, you technically\nstill have it — unpatched, unupdatable, and unable to be reinstalled if it's ever removed. That\nis not a plan.",[18,726,728],{"id":727},"what-manifest-v3-actually-limits","What Manifest V3 actually limits",[11,730,731],{},"This is where the discussion usually goes wrong in both directions. MV3 is neither the end of ad\nblocking nor a harmless bit of housekeeping.",[11,733,734,735,740],{},"Under MV2, an extension could use ",[26,736,737,738],{},"blocking ",[672,739,697],{},": the browser handed it each network\nrequest before it happened, ran the extension's own code, and did whatever the extension decided.\nArbitrary logic, at the moment of the request.",[11,742,743,744,749],{},"Under MV3, that's replaced by ",[26,745,746],{},[672,747,748],{},"declarativeNetRequest",". The extension registers its rules in\nadvance and the browser does the matching. The extension never sees the individual request and\nnever makes the decision.",[11,751,752],{},"The practical consequences:",[134,754,755,761,771],{},[137,756,757,760],{},[26,758,759],{},"Rule caps."," An extension can only register so many rules, with a further cap on dynamic ones\nadded at runtime. Large community filter lists used to run to hundreds of thousands of entries.",[137,762,763,766,767,770],{},[26,764,765],{},"No decisions based on what's happening."," A rule can say \"block this URL pattern\". It cannot\nsay \"block this ",[37,768,769],{},"if"," the response looks like a tracker\" or \"if this script tries that\".",[137,772,773,776],{},[26,774,775],{},"Slower responses to new tricks."," Under MV2, a filter list update fixed things immediately.\nUnder MV3, some changes need an extension update and a store review.",[11,778,779],{},"What still works: blocking by URL pattern, hiding elements with CSS, and the large majority of\nordinary ad and tracker blocking. Most people's day-to-day experience of a good MV3 blocker is\nfine. It's the adversarial edge — sites that actively fight blockers, and newly-invented tracking\ntechniques — where the ceiling is real.",[18,781,783],{"id":782},"the-argument","The argument",[11,785,786,787,789],{},"Google's case: performance, security, and privacy. Extensions with blocking ",[672,788,697],{}," can read\nevery request you make, including sensitive ones, and a slow or malicious extension sits directly\nin the path of every page load. Declarative rules can't spy on traffic and can't stall it.",[11,791,792,793,795],{},"That case is not nonsense. A compromised extension with blocking ",[672,794,697],{}," is genuinely\ndangerous, and extensions do get sold to new owners who add surveillance to them.",[11,797,798],{},"The counter-argument: Google's revenue is overwhelmingly advertising, and it is writing the rules\nfor the software that removes advertising. Even if every engineering justification is offered in\ngood faith, the company deciding how capable ad blockers may be is the company that sells the\nads. Critics also note that the limits fall hardest on exactly the blocking that works best,\nwhile the stated security benefits could have been pursued with narrower permissions.",[11,800,801,802,804],{},"Both things are true at once: there were real problems with blocking ",[672,803,697],{},", and the\nsolution happened to constrain a category of software that costs Google money. You don't have to\npick a villain to notice the conflict of interest.",[18,806,808],{"id":807},"your-options-today","Your options today",[11,810,811,814],{},[26,812,813],{},"uBlock Origin Lite"," — the MV3 version from the same developer, still in the Chrome Web Store.\nDeliberately simpler: it does less per-site fiddling and has no dynamic filtering. For most\npeople, most of the time, it's good. It is not the same tool.",[11,816,817,820,821,823],{},[26,818,819],{},"Firefox"," — still supports the full uBlock Origin with blocking ",[672,822,697],{},". Mozilla\nimplemented MV3 while keeping the capability. If your blocking matters more than anything else,\nthis is the straightforward answer.",[11,825,826,829],{},[26,827,828],{},"Brave"," — Chromium-based, with blocking built into the browser rather than delegated to an\nextension, so it isn't bound by the extension rulebook in the same way.",[11,831,832,835],{},[26,833,834],{},"Safari"," — its own extension system and its own limits, which is a different article.",[11,837,838],{},"There is no option that is both \"stay in Chrome\" and \"keep exactly what you had\". That trade is\ngone.",[18,840,842],{"id":841},"why-were-building-for-manifest-v3-from-day-one","Why we're building for Manifest V3 from day one",[11,844,845],{},"We could have written an MV2 extension. It would have been more capable on paper and dead on\narrival.",[11,847,848],{},"Can I Throw This? is being built MV3-native: declarative rules where they fit, and effort spent\non the part MV3 doesn't restrict at all — reading the page in front of you.",[11,850,851,852,855],{},"That's worth being precise about, because it's the strategic bet behind this whole project. MV3\nlimits what an extension may do to ",[37,853,854],{},"network requests",". It does not limit an extension's ability\nto look at the page you're already on and tell you what it's doing to you. A countdown timer that\nresets on reload, a reject button buried a layer deeper than accept, a clipboard that filled\nitself — all of that is visible in the page, on your device, with no network interception\nrequired.",[11,857,858],{},"So the ceiling MV3 imposes on blocking doesn't apply to the thing we think matters most. We'd\nrather build the part that can't be legislated away by a rulebook change, and be honest that\nblocking under MV3 has limits nobody can engineer around.",{"title":181,"searchDepth":182,"depth":182,"links":860},[861,862,863,864,865,866],{"id":666,"depth":182,"text":667},{"id":685,"depth":182,"text":686},{"id":727,"depth":182,"text":728},{"id":782,"depth":182,"text":783},{"id":807,"depth":182,"text":808},{"id":841,"depth":182,"text":842},"browser-landscape","On 31 August 2026 Google removed the last Manifest V2 extensions, including the full uBlock Origin, from the Chrome Web Store. Here's what changed, what it limits, and what your options are.",{},"\u002Flearn\u002Fmanifest-v3-your-adblocker","2026-09-19",{"title":658,"description":868},[874,877,880],{"label":875,"url":876},"Chrome for Developers: Manifest V2 support timeline","https:\u002F\u002Fdeveloper.chrome.com\u002Fdocs\u002Fextensions\u002Fdevelop\u002Fmigrate\u002Fmv2-deprecation-timeline",{"label":878,"url":879},"uBlock Origin: Manifest V2 and the Chrome Web Store","https:\u002F\u002Fgithub.com\u002Fgorhill\u002FuBlock\u002Fwiki\u002FManifest-V2-and-the-Chrome-Web-Store",{"label":881,"url":882},"CyberInsider: Google removes uBlock Origin from Chrome Web Store in final Manifest V2 purge (September 2026)","https:\u002F\u002Fcyberinsider.com\u002Fgoogle-removes-ublock-origin-from-chrome-web-store-in-final-manifest-v2-purge\u002F","learn\u002Fmanifest-v3-your-adblocker","0y2QJgmU4tNMn0Y01Wx2c2EPzLxQn0oNIbCzZ3LpYfI",1790177868640]