I didn't analyze the executable at all. Probably just adware.

@forest lol. On which SE site?

I don't remember, it was something on HNQ.

Like Workplace.SE or something.

Hmm

@RoryAlsop security.meta.stackexchange.com/q/3214/165253

This guy is wondering why his answer was deleted. Frankly, it seems fine to me.

@forest The two deleted posts do not answer the question - all they do is show how to generate a CSP script hash. That isn't the question. The accepted answer which states "UPDATE: it seems script hashes are not supported in the Chrome release version. My test only works in Chrome Canary (when using script-src, not default-src)" does provide an answer

@forest Wait wait wait wait. You are telling me that you saw an ad that attempted to trick you to download an exe on a StackExchange site???

@reed - That question would never make it on an SE site. @forest's comment up there nails it :-)

@forest I think I saw a post on meta from SE on this. I think they have realised the new ad policy has issues and are tightening up now. Let me see if I can find it

@RoryAlsop I saw multiple post discussing the advertisement test but none of them mentioned actual "malware" downloads.

There are report of scam advertisement (like "Learn any language in two weeks" "make 100000$/day working from home" etc) , I saw firsthand an ads that attempted full page redirect... but nothing at that level.

I mean, it is already bad to see online casino ads and lot of scam ads, but actual attempts to get the users to download malware/adware would be at a total different level.

@forest - if you saw an ad that forced you to download an exe, please follow Juan's guidance: If you see any ads that are inappropriate or have any questions about this experiment, please let me know by starting a new question and tagging it with advertising.

from meta.stackexchange.com/q/329763/154443

@JuanM ^ you may need to look at this. Ads that get you to download an exe are never acceptable

Is there a list of "canonical answers" somewhere on the meta? Sometimes I feel like there are a few questions that come up over and over and over

Like "How can I implement <thing you should do on the server> on the client?"

@MechMK1 meta is only for questions about how stack exchange works. There is a meta for each site, and an overall meta for stackexchange as a whole. So if you have a question about how the site works, the main meta is the best place to see if it has already been asked and answered

@MechMK1 there are some canonical answers for various topics, but I don't think that is one.

@RoryAlsop But wouldn't a canonical list for canonical answers bring value to the site?

@MechMK1 oh, sorry, I misundersood - that does sound like a good idea

I'm surprised that anyone in this community actually sees ads, unless they want to see them for research purposes

Anyone got any comments?

So for example, some data is encrypted with the key "username:password" (placeholders, obviously) and then sent to the client.

I can't find obvious flaws with that answer.

@MechMK1, I might be insane (I definitely am), but that question makes no sense to me. Authentication implies that you authenticate to someone or something. So client-side authentication makes no sense. It's like saying: can I ask a question to nobody?

If the issue is instead like "can I authenticate to the server without ever sending the password", then I guess you can do it with a so-called zero-knowledge proof

but that question in the end was interpreted by everybody as "can I let the client tell me if the authentication is ok?", and of course the answer is NO WAY (because as you said you can't trust the client)

and maybe that's what the OP meant anyway, since they said "validate credentials without involving the server".