Any meaningful UX testing in 2023 needs to account for ad blockers and password managers.

If your site or app doesn’t work with popular ad blockers, or it refuses to allow logins pasted in from password managers, it’s broken.

Yes, some executive type will want to argue about this because they think ad blocking will go away or they misunderstood some now outdated infosec guidance. They’re wrong. Users use ad blockers and password managers and if your stuff doesn’t work with them, it’s broken.

I’m not uninstalling my ad blocker. I’m not making an exception for your site. Your password complexity requirements are a waste of time. Blocking pasting into password fields is bad. You’ve made your site worse for incredibly silly reasons. Maybe don’t do that.
@tommorris I have suggested to a site owner or two that I would consider un-blocking if they run the ad infrastructure. Nobody really does now though. I'm not unblocking for ad-auction processes that will send me whatever nonsense the auction winner chooses.

@tim_lavoie @tommorris One argument I've heard for using an external ad server is as an audit mechanism for the number of impressions/clicks.

If you do everything in-house, then the advertisers need to take your word for it that their ad was actually displayed.

@jamesh @tommorris Does an advertiser get this today from Google or Facebook? Is there any assurance that the ad was viewed by a person?

Even still, none of this requires surveillance-based ads, which are the dominant variety today. Opt out.

@tim_lavoie @tommorris For a website, their ad space is more valuable if there is more certainty about how many times they've been viewed. And for the advertiser, it's nice if theres fewer people to audit or trust.

This isn't saying that the current mess of third party cookie user tracking is necessary: just that there are reasons besides cross-site user tracking why a site might outsource ad serving.