The one thing I learned is that you can actually get Malware without having to click the ad. It got to the point where even the FBI themselves recommend users to use an ad-blocker because of this. Although it's not widespread and only targets high profile users, it's scary to think about that it's even possible to begin with and crazy how it's not patched.
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
One thing that stood out while building OmniGuard was how easily deceptive elements can blend into an otherwise normal-looking webpage.
A countdown timer, a misleading button, or a tiny pre-selected checkbox might not look like much on its own, but these little design decisions can completely change what a user ends up doing.
We built OmniGuard to make these tricks easier to spot, but I'm sure there are plenty of dark patterns we haven't thought of yet.
What's one website or app experience that made you feel genuinely tricked? I'd love to hear some real examples! 👀
Passionate full stack developer, course author for Educative, book author for Packt.
Find my work and get to know me on my Linktree: https://linktr.ee/thormeier
What's the rate of false positives? For example, high-demand concert tickets: Let's say a very famous pop star comes to town and the local ticket vendor only allows tickets to be in the cart for ~10 minutes, so black market resellers don't hoard them to create artificial scarcity and inflate the price later on. Will such a countdown be flagged? Not saying that it's a good thing per se, it does create urgency, but it's actually a "necessary evil" to protect legitimate fans from illegitimate resellers and it actually does function as information to the user.
Same goes for false negatives: A page that looks like it would have a working download button, because the page content implies a download and the button looks and feels legit enough to be the download button, although it's an ad - will this be flagged?
Although you're not using a database, won't Google store these screenshots anyways when you send them to Gemini, or am I missing something? Or perhaps there's a way to redact certain parts of the screen beforehand?
And now for the opinion part: The best way to get rid of these dark patterns is by having functioning consumer protection laws and actually fining the living heck out of companies that don't oblige. I know that such laws are next to impossible to install everywhere, let alone enforce, but I like to dream...
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
Passionate full stack developer, course author for Educative, book author for Packt.
Find my work and get to know me on my Linktree: https://linktr.ee/thormeier
No worries, even more impressive that you've managed to build it in 24 hours! Would love to see this flourish and get developed into a real product one day!
Full stack developer with experience in building production ready web and desktop applications using React.js, Next.js, JavaScript, TypeScript, Node.js, Express.js and PostgreSQL.
While reading through this, my first concern was about privacy and whether the extension captures the entire screen or potentially sensitive information. I was relieved to see that you've addressed this by limiting screenshots to the active viewport and using a stateless, zero-database architecture.
That said, one thing I'd be curious about is how screenshot data is handled during transmission and by Gemini itself. Even if your backend doesn't store anything, the screenshots could potentially contain sensitive information visible in the viewport. Clarity around API-side data retention, logging, and processing would make the privacy story even stronger.
Also, I find the distinction between traditional ad blockers and AI-powered visual detection particularly interesting. Tools like Brave already do a great job with trackers and malicious content, but detecting psychological manipulation at the UI level is a different challenge altogether.
Really interesting project! Great work by the team. 👏
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
Absolutely! It may not eradicate dark patterns, but awareness is the first step towards resisting manipulation. The more informed users become, the harder it gets for deceptive design to succeed. Have a great day too!
This is a great example of how AI can make the web more user-friendly. Dark patterns don't just hurt user trust; they also damage the overall user experience. I really like the idea of using visual AI to identify deceptive design elements in real time. Technology should help users make informed decisions, not manipulate them. Great work!
The fake timer example makes me want a separate uncertain result. From one screenshot I can see urgency language, but I can’t tell whether the deadline is genuine or whether the timer resets on another visit. Would you consider showing the visual evidence and confidence beside the warning, instead of treating both cases as equally established?
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
Actually to be completely honest, I'd consider it, but thing is this was a one day hackathon project and we've not tried anything different, better edge cases.
But I'll definitely look into this if I go back to this project!
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
The worst one I've seen recently: a 'free' PDF converter that let you upload, process, and preview the file — and then demanded a subscription to download it. The preview was the trap. That's a variant of forced continuity that I'd love to see OmniGuard catch.
Dark patterns live in desktop installers too — the fake 'download now' buttons and pre-checked bundle offers show up in Electron apps and their update prompts, where there's no DOM to inspect, only pixels, so a visual approach like this is exactly the right shape. Pairing the detector with an on-device model would close the screenshot-privacy gap even further at the cost of some latency. And the Shadow DOM injection is a nice detail — it keeps host-page CSS from bleeding into your overlay.
Dark patterns in checkout flows are the worst, especially when the extra cost only shows up at the final step. I'd be curious how well this catches things that only appear after a few clicks, not just in the current viewport.
Hi, I’m Shikha Shukla, a final-year B.Tech CSE (AI) student passionate about AI, problem-solving, and technology. I enjoy building projects and contributing to open-source.
Developer since the 80s (BASIC, C, Java). Studied Computer Science and Master's in Software Development, Chalmers. Pro. experienced in TypeScript, JavaScript, Python, PHP, and Full-Stack development.
Upcoming Trainee Engineer @ Simform 🚀
Building, experimenting, and writing my way through tech.
AI • Web • Open Source • Challenges
If I find something interesting, I'll probably write about it. 😄
Ingo Steinke is a Berlin-based senior web developer focusing on front-end web development to create and improve websites and make the web more accessible, sustainable, and user-friendly.
Theoretically, this tool solves the problem at the wrong end, however it's the only end that end-users control. If such guards and blockers become widespread and popular, our industry's stakeholder must eventually adjust their priorities or audiences. Developers can then fix the root cause when they won't be pushed again and again to add misfeatures like obtrusive popovers to every other website and web app.
Fake countdowns are the one category you can catch without any model: reload the page in a fresh session, and if the timer snaps back to 05:00, it was never real. Pairing cheap deterministic checks like that with the multimodal pass would cut API calls and give users hard evidence instead of a judgment call. Confirmshaming is the one I'd most love to see flagged. "No thanks, I hate saving money" buttons need to go.
The flip side of this that I keep noticing: the pages I actually trust are the ones that show their work. I was looking at a Key West water page earlier today — 81.3°F, observed 1:12 PM EDT, the station named right next to the number, next high tide at 3:46 PM, and a plain Coastal Flood Advisory banner instead of a popup. No countdown, no guilt-trip dismiss button, nothing pre-checked. It made me realize how much of the gross stuff here is really about hiding provenance: if a page won't tell you when a number was measured or where it came from, that's already a small dark pattern, even before the fake timers show up. The example I had open: Key West water temperature & tides
Disclosure: this comment was written with AI assistance.
I write about Next.js + TypeScript + AI engineering, with a focus on making sites discoverable to LLMs and AI search. Long-form notes at mudassirkhan.me
sending a viewport screenshot to a multimodal model instead of reading the DOM makes sense here, since dark patterns are mostly about visual weight and not markup. what i would worry about is latency on scroll: a round trip per viewport means the fake timer is gone or the page already shifted by the time the red box lands.
we saw the same drift when overlaying boxes from stale coordinates on dynamic pages.
are you mapping boxes back to DOM nodes after detection, and what does the false positive rate look like on legit urgency like real stock counts?
Implementation Specialist and Database Developer with over 15 years of experience in the IT industry, specializing in the design, implementation and management of relational databases.
The one thing I learned is that you can actually get Malware without having to click the ad. It got to the point where even the FBI themselves recommend users to use an ad-blocker because of this. Although it's not widespread and only targets high profile users, it's scary to think about that it's even possible to begin with and crazy how it's not patched.
Here is a video that explains it.
Otherwise, good stuff :)
Its True!
Today my dad told me that if you get any msg from X guy, don't open it!
Apparently his whatsapp profile got hacked and sent malicious .apk files to a lot of contacts.
Its pretty common in my part of the world.
I actually haven't tried any ad blockers, I just use brave for streaming or spotify, so as to avoid pop ups and ads.
But I'll definitely try one!
Thanks
One thing that stood out while building OmniGuard was how easily deceptive elements can blend into an otherwise normal-looking webpage.
A countdown timer, a misleading button, or a tiny pre-selected checkbox might not look like much on its own, but these little design decisions can completely change what a user ends up doing.
We built OmniGuard to make these tricks easier to spot, but I'm sure there are plenty of dark patterns we haven't thought of yet.
What's one website or app experience that made you feel genuinely tricked? I'd love to hear some real examples! 👀
Great piece of technology you people built there!
What's the rate of false positives? For example, high-demand concert tickets: Let's say a very famous pop star comes to town and the local ticket vendor only allows tickets to be in the cart for ~10 minutes, so black market resellers don't hoard them to create artificial scarcity and inflate the price later on. Will such a countdown be flagged? Not saying that it's a good thing per se, it does create urgency, but it's actually a "necessary evil" to protect legitimate fans from illegitimate resellers and it actually does function as information to the user.
Same goes for false negatives: A page that looks like it would have a working download button, because the page content implies a download and the button looks and feels legit enough to be the download button, although it's an ad - will this be flagged?
Although you're not using a database, won't Google store these screenshots anyways when you send them to Gemini, or am I missing something? Or perhaps there's a way to redact certain parts of the screen beforehand?
And now for the opinion part: The best way to get rid of these dark patterns is by having functioning consumer protection laws and actually fining the living heck out of companies that don't oblige. I know that such laws are next to impossible to install everywhere, let alone enforce, but I like to dream...
Actually Sir, it was built for a hackathon and we haven't added any features like this cause it was just 24 hours long.
But yeah if we'll go back to this project again, we can definitely have a lot of good enhancements and features like you suggested.
Current MVP just finds dark patterns on web page and flags it!
Have A Great Day!
No worries, even more impressive that you've managed to build it in 24 hours! Would love to see this flourish and get developed into a real product one day!
Have a great day as well! :)
While reading through this, my first concern was about privacy and whether the extension captures the entire screen or potentially sensitive information. I was relieved to see that you've addressed this by limiting screenshots to the active viewport and using a stateless, zero-database architecture.
That said, one thing I'd be curious about is how screenshot data is handled during transmission and by Gemini itself. Even if your backend doesn't store anything, the screenshots could potentially contain sensitive information visible in the viewport. Clarity around API-side data retention, logging, and processing would make the privacy story even stronger.
Also, I find the distinction between traditional ad blockers and AI-powered visual detection particularly interesting. Tools like Brave already do a great job with trackers and malicious content, but detecting psychological manipulation at the UI level is a different challenge altogether.
Really interesting project! Great work by the team. 👏
Brilliant initiative! The web should earn our trust, not manipulate us. Could tools like OmniGuard become the new standard for ethical design?
I don't think this will stop dark patterns on web pages but will definitely make people make aware!
Have A Great Day!!
Absolutely! It may not eradicate dark patterns, but awareness is the first step towards resisting manipulation. The more informed users become, the harder it gets for deceptive design to succeed. Have a great day too!
This is a great example of how AI can make the web more user-friendly. Dark patterns don't just hurt user trust; they also damage the overall user experience. I really like the idea of using visual AI to identify deceptive design elements in real time. Technology should help users make informed decisions, not manipulate them. Great work!
The fake timer example makes me want a separate uncertain result. From one screenshot I can see urgency language, but I can’t tell whether the deadline is genuine or whether the timer resets on another visit. Would you consider showing the visual evidence and confidence beside the warning, instead of treating both cases as equally established?
Actually to be completely honest, I'd consider it, but thing is this was a one day hackathon project and we've not tried anything different, better edge cases.
But I'll definitely look into this if I go back to this project!
Thanks! Have A Great Day!
Another tip for anyone dealing with ads, use AdGuard (the green shield), honestly the best blocker imo.
For me the best thing is "Brave" browser, never disappoints!😂
On android, firefox, with ublock origin, works really well too.
I'll try them!
Have A Great Day!
Likewise!
The worst one I've seen recently: a 'free' PDF converter that let you upload, process, and preview the file — and then demanded a subscription to download it. The preview was the trap. That's a variant of forced continuity that I'd love to see OmniGuard catch.
Dark patterns live in desktop installers too — the fake 'download now' buttons and pre-checked bundle offers show up in Electron apps and their update prompts, where there's no DOM to inspect, only pixels, so a visual approach like this is exactly the right shape. Pairing the detector with an on-device model would close the screenshot-privacy gap even further at the cost of some latency. And the Shadow DOM injection is a nice detail — it keeps host-page CSS from bleeding into your overlay.
Dark patterns in checkout flows are the worst, especially when the extra cost only shows up at the final step. I'd be curious how well this catches things that only appear after a few clicks, not just in the current viewport.
Great topic of discussion
Yes, this is all too true 😆🙃
Would be nice if a AI was made to de-slopify AI generated code to make appealing UI.
Bro, very early for this post. This project was made just yesterday!
Yeah, my bad I had this draft since weeks but I don't know I forgot to publish it!😅
Man, that looks awesome!
Amazing
Theoretically, this tool solves the problem at the wrong end, however it's the only end that end-users control. If such guards and blockers become widespread and popular, our industry's stakeholder must eventually adjust their priorities or audiences. Developers can then fix the root cause when they won't be pushed again and again to add misfeatures like obtrusive popovers to every other website and web app.
Fake countdowns are the one category you can catch without any model: reload the page in a fresh session, and if the timer snaps back to 05:00, it was never real. Pairing cheap deterministic checks like that with the multimodal pass would cut API calls and give users hard evidence instead of a judgment call. Confirmshaming is the one I'd most love to see flagged. "No thanks, I hate saving money" buttons need to go.
The flip side of this that I keep noticing: the pages I actually trust are the ones that show their work. I was looking at a Key West water page earlier today — 81.3°F, observed 1:12 PM EDT, the station named right next to the number, next high tide at 3:46 PM, and a plain Coastal Flood Advisory banner instead of a popup. No countdown, no guilt-trip dismiss button, nothing pre-checked. It made me realize how much of the gross stuff here is really about hiding provenance: if a page won't tell you when a number was measured or where it came from, that's already a small dark pattern, even before the fake timers show up. The example I had open: Key West water temperature & tides
Disclosure: this comment was written with AI assistance.
sending a viewport screenshot to a multimodal model instead of reading the DOM makes sense here, since dark patterns are mostly about visual weight and not markup. what i would worry about is latency on scroll: a round trip per viewport means the fake timer is gone or the page already shifted by the time the red box lands.
we saw the same drift when overlaying boxes from stale coordinates on dynamic pages.
are you mapping boxes back to DOM nodes after detection, and what does the false positive rate look like on legit urgency like real stock counts?
Hi, how fast is one scan round-trip, and is auto-scan on scroll practical?