Mohammad Ghasemisharif

Some browsers offer a reader mode option that removes page bloat, Ads and trackers and displays only the necessary (textual) content. While the end result is visually pleasant, it does not solve page load time since they render the entire page before making the decision (whether the page contains readable subsets). So we approached this problem by shifting the decision point prior to full rendering (on initial HTML). Our trained model outperformed comparable heuristic methods and resulted in speeding up page loading by 27×, and reducing network use by 84×. We did this project over my internship at Brave.

In a nutshell, Single Sign-On is an easy way of using multiple independent services (e.g. Quora) with one account (e.g. Facebook). In this project, we measured the prevalence of SSO in the wild and investigated the attacks SSO enables even when it is implemented correctly. We showed that the interplay between local account management and SSO can result in strange corner cases that can make recovering from IdP account compromise very hard or even impossible. We provided a PoC for Facebook account compromise to demonstrated the practicality of the attacks. bug bounty

While "non-session" HTTP cookies seems benign, they can reveal personally identifiable information as previous study showed. We investigated large-scale crowd de-anonymization through "non-session" HTTP cookies and KARMA attack. We disclosed a WebKit vulnerability for mishandling cookies in private browsing and captive portal. CVE-2017-7144