New Update 3P-Matrix-lite new version is available in Chrome Webstore with improved functionality

Thread details
Extension store page
https://chromewebstore.google.com/detail/3p-matrix-lite/oljiiikeojepiiaoaicpddpgpfiloejj?pli=1
Sampei.Nihira said:
What is the security benefit of using Level 3 when 90%–95% of daily browsing occurs on websites included in the TLD Safe Regions list?:unsure:
In this specific case, Level 2 is equivalent.
Click to expand...
The advantage of level 3 compared to level 4 is less breaking sites. One can make the list of safer TLD's as restrictive as one wants. For me the default list isn't restrictive enough. My primary goal of using level 3 is not security but privacy. If I want more security, I use level 4.
 
Last edited:
Jan Willy said:
The advantage of level 3 compared to level 4 is less breaking sites. One can make the list of safer TLD's as restrictive as one wants. For me the default list isn't restrictive enough. My primary goal of using level 3 is not security but privacy. If I want more security, I use level 4.
Click to expand...

;)

You're right, but I was just “thinking out loud” about Level 2 and Level 3.
When the conditions I already mentioned are met, Level 2 could be comparable to Level 3.

Of course, we should consider that some websites with TLDs,certainly in Safe Regions,might use domains not on the list; so in this case, perhaps Level 3 offers an added benefit.

But can this scenario be quantified as an advantage in terms of compatibility versus security?

I prefer Level 2 and would place every website with a TLD within the Safe Regions but considered “at risk” (com, org, etc.) at Level 4.

Let’s consider all websites on that list,those that have been compromised in the past, and/or those where we download software updates for programs we’ve installed, or websites that, by their very nature, are subject to greater risk than other types of websites.

I don’t think all 3P-Matrix users will be able to grasp this subtle difference right away.

The sole advantage of Level 3 is therefore outside the Safe Regions.

So if there is a need to add an intermediate level to better protect average users, only the developer can decide that.

The purpose of these posts of mine is, as usual, to encourage thinking outside the box.(y);):)
 
Like Jan Willy I have reduced my safer regions list to 10. I never run into problems (never did in the past when achieving the same in uBO-Mv2). The additional outside safer regions protections close the 1P gap uBO-Mv2 had in the past.

The intermediate solution is the current automatic country code detection and the wide/broad set of generic TLD´s for level3.

Latest version: only code optimalization and clean up
 
Last edited:
An interesting example of the work done by developer (TH) for the most widely used platforms that unintentionally distribute malware:

hxxps://urlhaus.abuse.ch/url/4055889/

2.png

1.png

Everyone will notice that no DNS is blocking the malware as usual, and during the download test, it isn't even blocked by MD.

An Overall Risk Score of 100% is fantastic.(y)
 
BTW, I found a solution for the download protection not working with the FluxDown download manager. As it turns out, you can set it per site if downloads can be intercepted for auto download. I can set per site that I want that on that Fluxdown can not auto intercept downloads, but it can sniff for downloads and show those in the floating bubble on the right side of the browser screen. That way the download protection works for downloads, but if I want to use Fluxdown, I can start the download with FluxDown manually. Especially useful for big downloads. :)
 
Version 10.5.7 internal whitelist update and added an heuristic (download larger than 50 mb, from websites often used for download distribution)

@Morro I am glad you found a solution, because I could not find a workaround within 3PM, but the new heuristic is added because of your issue, thanks (y)
Thanks for posting (my fruitless attempts to find a solution is also the reason for the bump in version numbering)

@Sampei.Nihira I also changed the warning (adding malware)
1793947383817.png

1793947455097.png
 
@LinuxFan58

You know that I use a partitioned third-party dynamic filtering system.
uBo handles websites outside my 9 TLDs.
The Void Script Stop API handles websites within the 9 TLDs.

uBo has superior dynamic filtering compared to SS, as you well know.

Well, these days,and especially these nights,:oops::oops:I’m becoming increasingly convinced that the concept (which you also use with 3P Matrix) is flawed.

Since we all spend 90–95% of our time browsing within the TLDs we’ve chosen, there are far more potential dangers within those TLDs than outside them.

3P Matrix has helped me better understand this concept.
And I’m grateful to you for that.(y)(y);)

So now I can say that I use 3P Matrix not only to protect downloads but also to enhance security on certain websites within the TLDs that, by their very nature, are at greater risk than others.(y)

That’s why I use Level 2 and have placed many high-risk websites (including those within my 9 TLDs) at Level 4,and among these websites are all the sites where I download the software I use and need to update.


The recommended use of Level 3 would seem to make sense.
But on closer inspection, it provides a false sense of security.:unsure:

In my country, there’s a proverb that goes:

"Sleep is the best counselor"

Think about it,maybe even tonight.:giggle:
 
Last edited:
Sampei.Nihira said:
@LinuxFan58

Since we all spend 90–95% of our time browsing within the TLDs we’ve chosen, there are far more potential dangers within those TLDs than outside them.
Click to expand...
1. The 90-95% assumption is on the conservative side, it heads more to 99%.
2. There are far more dangers outside this "routinely browsing cocoon", this is is not an opinion but a factual observation.
3. The extra outside safer region protections also apply to first-party outside safer refions without impacting regular functionality, something you can´t achieve with uBO

But as already posted earlier, since you are using uBO Mv2 with risky scriptlets and blocking first-party frames using ScripSafe, you don´t qualify as a 3PM or uBD user ;)
 
Last edited:
LinuxFan58 said:
1. The 90-95% assumption is on the conservative side, it heads more to 99%.
2. There are far more dangers outside this "routinely browsing cocoon", this is is not an opinion but a factual observation.
3. The extra outside safer region protections also apply to first-party outside safer refions without impacting regular functionality, something you can´t achieve with uBO

But as already posted earlier, since you are using uBO Mv2 with risky scriptlets and blocking first-party frames using ScripSafe, you are don´t qualify as a 3PM or uBD user ;)
Click to expand...

2 - You use NextDNS, just like me.
With the new features + setting up a list of high-risk TLDs (.ru, .cn, .kp...) + non-European characters

I think the assumption that:

Higher risk = TLDs extra list

is greatly overstated.

P.S.
You'll see,you won't get much sleep tonight.....:);)
 
Last edited:
Pushed version 4.6 with new protections

Improved fake service and support scam protection
  • 3. Browser-locker scams: fake “your PC is infected” pages can no longer lock your keyboard, force fullscreen back on, nag “Leave site?” or trap your Back button.
New protections 11, 14. and 24 against phishing, 18 is a generic protection against tricking users into allowing something (also used for phising and support scams)

Level 2 and onward
  • 11. Messaging bots: stops (fake) login pages from sending what you typed to scammers’ chat apps (Telegram, Discord, Slack), and shows a warning.
  • 14. Password forms: asks before a login form sends your password to a different website.
  • 18. Notification prompts: stops “click Allow” pop-ups that appear before you’ve clicked anything.
Level 3 and onward
  • 24. Web services: stops (fake) login pages from sending what you typed to automation services, but only outside safer regions.
EDIT: already available on CWS (y)
 
Last edited:
LinuxFan58 said:
Pushed version 4.6 with new protections

Improved fake service and support scam protection
  • 3. Browser-locker scams: fake “your PC is infected” pages can no longer lock your keyboard, force fullscreen back on, nag “Leave site?” or trap your Back button.
New protections 11, 14. and 24 against phishing, 18 is a generic protection against tricking users into allowing something (also used for phising and support scams)

Level 2 and onward
  • 11. Messaging bots: stops (fake) login pages from sending what you typed to scammers’ chat apps (Telegram, Discord, Slack), and shows a warning.
  • 14. Password forms: asks before a login form sends your password to a different website.
  • 18. Notification prompts: stops “click Allow” pop-ups that appear before you’ve clicked anything.
Level 3 and onward
  • 24. Web services: stops (fake) login pages from sending what you typed to automation services, but only outside safer regions.
EDIT: already available on CWS (y)
Click to expand...

WOW.:)

Congratulations.(y)(y);)

I have 2 questions:

Could the “Back-button trap” technique:

“Counts the history entries added without user interaction and tries to skip them when the Back button is pressed”

in the new Protection 3 feature cause incompatibility with some websites and thus cause the Back button to malfunction?

Do you think this is a common occurrence?:unsure:

____________________________________________________________________________

The new Protection 24, which in my case would be applied at Level 4 even to some websites within my TLDs, is currently disabled to prevent a standard contact form from stopping working.

P.S.

It seems to me that in the “Cover Your Tracks” test, the result for “Protecting you from fingerprinting?” is blocked by some L2 protection from 3P Matrix.

Check it out.;)(y)
 
Last edited:
Sampei.Nihira said:
The new Protection 24, which in my case would be applied at Level 4 even to some websites within my TLDs, is currently disabled to prevent a standard contact form from stopping working.
Click to expand...
Can you provide a link, because I am busy with 3PM right now? A standard contact form should not be affected.

Fun thing with AI is that by adding rules to he conscript makes it behave more and more like I want it to,so I am working on a overhaul, making high risk websites protections really agnostic, not just limited to the 25 porn websites which are used as a fixed list right now.

The 25 porn websites are on that list not because members actively involved in the development of my extensions asked for it, but my former neighbor told me that there were 5 known cases of high level executives ignoring their own security policies to see adult content. Poisoned images/gifs/videos luring executives are one of the knight mares of security experts he told me (because the temptation in the spur of the moment is high and the user permissions of those spear phish targets are so high).
 
Last edited:
Sampei.Nihira said:
P.S.

It seems to me that in the “Cover Your Tracks” test, the result for “Protecting you from fingerprinting?” is blocked by some L2 protection from 3P Matrix.

Check it out.;)(y)
Click to expand...
Must be the double suffix (.eff.org) and the bunch of fingerprint signals they insert at once. I will have a look at it why fingerprinting test is halted (possibly the new agnostic high risk websites analysis, which is partially live). :)

This is such a nonsense test,
1793975280610.png
 
LinuxFan58 said:
Can you provide a link, because I am busy with 3PM right now? A standard contact form should not be affected.

Fun thing with AI is that by adding rules to he conscript makes it behave more and more like I want it to,so I am working on a overhaul, making high risk websites protections really agnostic, not just limited to the 25 porn websites which are used as a fixed list right now.

The 25 porn websites are on that list not because members actively involved in the development of my extensions asked for it, but my former neighbor told me that there were 5 known cases of high level executives ignoring their own security policies to see adult content. Poisoned images/gifs/videos luring executives are one of the knight mares of security experts he told me (because the temptation in the spur of the moment is high and the user permissions of those spear phish targets are so high).
Click to expand...

When I wrote that, it was just my impression, so I can't provide you with a link.
But I had ChatGPT analyze the zip file of your extension for Protections 11/24, and I can paste the response for you:


#24 – Data Exfiltration to Web Services​

This protection is similar to #11, but targets a different group of destinations:

ServiceBlocked destination
FormSubmitformsubmit.co
Formspreeformspree.io
Getformgetform.io
EmailJSapi.emailjs.com
Web3Formsapi.web3forms.com
Power Automate / Logic Appslogic.azure.com and powerplatform.com, with URL filtering for workflow endpoints
The goal is to prevent a webpage from sending information to services that can collect data and forward it via email or automated workflows.

The key difference compared to #11 is that these services can also be used legitimately by regular websites, for example to handle contact forms.

For this reason, the developer has chosen to apply this protection only outside Safe Regions.

Limitations and false-positive risk: the rule does not inspect the contents of the request or determine whether the data is actually being stolen. It simply blocks the destination. As a result, a perfectly legitimate contact form based on Formspree or EmailJS may stop working.

This protection is useful, but less selective than #11.
 
LinuxFan58 said:
Must be the double suffix (.eff.org) and the bunch of fingerprint signals they insert at once. I will have a look at it why fingerprinting test is halted (possibly the new agnostic high risk websites analysis, which is partially live). :)

This is such a nonsense test,
View attachment 301202
Click to expand...

I found the protection in question.
It's protection 9,if disabled, it makes the test work.
I hope this helps you.;)
 
Pushed V 5 to Chrome Web Store

Because of the added the protections, the in-panel drop dow got to long, so I only show protections button
1793988219707.png


Clicking the button leads to a new options page with 3 tabs

A tab for browsing protections
1793988311777.png


A tab for download protection options
1793988407200.png


A tab for the whitelist
1793988493697.png

Which also has an import and export function
 
Last edited:
Sampei.Nihira said:
When I wrote that, it was just my impression, so I can't provide you with a link.
But I had ChatGPT analyze the zip file of your extension for Protections 11/24, and I can paste the response for you:


#24 – Data Exfiltration to Web Services​

This protection is similar to #11, but targets a different group of destinations:

ServiceBlocked destination
FormSubmitformsubmit.co
Formspreeformspree.io
Getformgetform.io
EmailJSapi.emailjs.com
Web3Formsapi.web3forms.com
Power Automate / Logic Appslogic.azure.com and powerplatform.com, with URL filtering for workflow endpoints
The goal is to prevent a webpage from sending information to services that can collect data and forward it via email or automated workflows.

The key difference compared to #11 is that these services can also be used legitimately by regular websites, for example to handle contact forms.

For this reason, the developer has chosen to apply this protection only outside Safe Regions.

Limitations and false-positive risk: the rule does not inspect the contents of the request or determine whether the data is actually being stolen. It simply blocks the destination. As a result, a perfectly legitimate contact form based on Formspree or EmailJS may stop working.

This protection is useful, but less selective than #11.
Click to expand...
You proof again how faulted the safer-regions concept is ;), the false positive risk is exactly the reason why it is applied OUTSIDE safer-regions :)

In (my guess) 999 out of 1000 situations you don´t want to send a password (that is also a pre-condition, which Chat obviously did not find) when you are on a website which is OUTSIDE your safer-regions (normal) browsing cocoon, but for that one situation a warning page will appear (allowing you to continue).

This is the reason V5.0 provides info when you move your mouse over a protection
1793989610202.png
 
Last edited:

Join the discussion

Write your reply below. You'll create a free account or log in before it's posted.

Create account Log in

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top