New Update Osprey Browser Protection discussion and updates

[Foulest]

I got a false+ yesterday after I activated CIRA Canadian Shield DNS -- I left it blocked for now but I'm 99.99% sure it was a false+ -- a link from a good email, I should get that email again today and I'll see what it does.

Use the report feature when you get a false positive.

 

[Foulest]

View attachment 288281

I found it yesterday after you told me but now after the patch 1.1.6 it seems to be gone on latest Firefox version

This will be fixed in 1.1.7!

 

[simmerskool]

Use the report feature when you get a false positive.

ok

 

[Gandalf_The_Grey]

Osprey 1.1.7

Changes in 1.1.7​

• Fixed context menus in Firefox

This update has been submitted to all extension stores.

Full Changelog: 1.1.6...1.1.7

Release 1.1.7 · Foulest/Osprey

Changes in 1.1.7 Fixed context menus in Firefox This update has been submitted to all extension stores. Full Changelog: 1.1.6...1.1.7

github.com

 

[robboman]

This add-on is really interesting, great job by the developer. I will definitely install this on my grandparents laptop to better protect them against phishing.

Does this add-on slow down webpage loading since it uses so many different providers APIs to check the links?

 

[piquiteco]

Does this add-on slow down webpage loading since it uses so many different providers APIs to check the links?

No impact on page loads, oddly enough.

 

[Gandalf_The_Grey]

This add-on is really interesting, great job by the developer. I will definitely install this on my grandparents laptop to better protect them against phishing.

Does this add-on slow down webpage loading since it uses so many different providers APIs to check the links?

No slowdowns noticed.
My settings for Osprey are:

Osprey with the defaults minus Symantec because of a false positive with the AMTSO website.
Blocking the whole website will give good results in testing, but not for usability.
So, I have these enabled in Osprey: Emsisoft, Bitdefender, Norton. G DATA, DNS0.eu, CleanBrowsing and Switch.ch.

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Due to their high scores, the following providers are enabled by default:

• Symantec Browser Protection
• Emsisoft Web Protection
• Bitdefender TrafficLight
• Norton SafeWeb
• G DATA WebProtection
• DNS0.eu Security DNS
• CleanBrowsing Security DNS
• Switch.ch Security DNS

Due to their low scores, the following providers are disabled by default:

• Microsoft SmartScreen
• Cloudflare Security DNS
• Quad9 Security DNS
• CIRA Canadian Shield DNS
• AdGuard Security DNS
• CERT-EE Security DNS

GitHub - Foulest/Osprey: Browser extension that protects you from malicious websites.

Browser extension that protects you from malicious websites. - Foulest/Osprey

github.com

 

[robboman]

No slowdowns noticed.
My settings for Osprey are:

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

GitHub - Foulest/Osprey: Browser extension that protects you from malicious websites.

Browser extension that protects you from malicious websites. - Foulest/Osprey

github.com

That's great to hear, I will be installing this add-on

 

[piquiteco]

Osprey 1.1.7

Release 1.1.7 · Foulest/Osprey

Changes in 1.1.7 Fixed context menus in Firefox This update has been submitted to all extension stores. Full Changelog: 1.1.6...1.1.7

github.com

It updated quickly, as soon as I saw your post when I went to check the Osprey extension it had already updated and was already at version 1.1.7. I'm currently using EDGE.

Spoiler: Osprey Browser Protection 1.1.7

 

[Marko :)]

Can someone with a virtual machine test something for me?

1. Open a console in web browser with networking tab
2. Visit a malicious site
3. Check the requests being made by the browser

Why?

I'm interested if website is being loaded normally until the extension gets an answer or does it wait for the answer from security provider and then decides if the website will open.

This matters because if website loads in the background, there's a chance malicious script will be loaded before Osprey gets an answer from security provider. On the other hand, if it waits for the answer to decide if website will load or not, you should see some delay as it needs to check for the answer from external services. And seeing pretty much none of you experiences delays or slowdowns that seems like it's not the case either.

 

[piquiteco]

Can someone with a virtual machine test something for me?

1. Open a console in web browser with networking tab
2. Visit a malicious site
3. Check the requests being made by the browser

Is that what you wanted? I've updated the post, I forgot to show the phishing page the milliseconds.

Spoiler: Osprey: Browser Protection Test

 

[Marko :)]

This only shows

Is that what you wanted? I've updated the post, I forgot to show the phishing page the milliseconds.

Spoiler: Osprey: Browser Protection Test

View attachment 288301
View attachment 288302

This shows the requests of the extension itself. Try opening an anonymous tab, then open a console (network tab) and then visit the malicious website. And see the first requests that are made.

It's necessary for test to be made in this order so we could see all requests.

 

[SeriousHoax]

Can someone with a virtual machine test something for me?

1. Open a console in web browser with networking tab
2. Visit a malicious site
3. Check the requests being made by the browser

Why?

I'm interested if website is being loaded normally until the extension gets an answer or does it wait for the answer from security provider and then decides if the website will open.

This matters because if website loads in the background, there's a chance malicious script will be loaded before Osprey gets an answer from security provider. On the other hand, if it waits for the answer to decide if website will load or not, you should see some delay as it needs to check for the answer from external services. And seeing pretty much none of you experiences delays or slowdowns that seems like it's not the case either.

The last time I checked, Osprey doesn't hold the connection till a response is received. The browser does its normal job trying to load the website and Osprey at the same time does what it is supposed to do and after it finds it in a blacklist the webpage gets blocked. This is what it looked like to me.
@Foulest can provide more details and correct me if I'm wrong.
SmartScreen in Microsoft Edge works similarly. It never holds the connection. Google Safe Browsing in normal mode does the checking locally as you know before letting the site load, but local processing is extremely fast while its Enhanced Safe Browsing mode from what I saw actually wait till it receives a response from the server before letting a site load. So Enhanced Safe Browsing had a slight performance impact when I tested.

 

[piquiteco]

So Enhanced Safe Browsing had a slight performance impact when I tested.

More imperceptible than TrafficLight and the Malwarebytes Browser Guard extension?

 

[Marko :)]

The last time I checked, Osprey doesn't hold the connection till a response is received. The browser does its normal job trying to load the website and Osprey at the same time does what it is supposed to do and after it finds it in a blacklist the webpage gets blocked. This is what it looked like to me.
@Foulest can provide more details and correct me if I'm wrong.
SmartScreen in Microsoft Edge works similarly. It never holds the connection. Google Safe Browsing in normal mode does the checking locally as you know before letting the site load, but local processing is extremely fast while its Enhanced Safe Browsing mode from what I saw actually wait till it receives a response from the server before letting a site load. So Enhanced Safe Browsing had a slight performance impact when I tested.

That might not be ideal. Sure, it could work for phishing websites, but those malicious ones... I wouldn't rely on Osprey to block those. Hackers can easily make malicious scripts to load first and massively increase chances of executing script before Osprey reacts.

There is a solution for this, but this would require @Foulest to have a server which would cache all the URL requests. Instead of sending multiple requests to security providers, it would only make one requests to Foulest's server which would then forward URLs to security providers and then return the result. Otherwise, it's either no delay and less protection, or more delay and better protection.

 

[piquiteco]

Hackers can easily make malicious scripts to load first and massively increase chances of executing script before Osprey reacts.

Drive-by download if that's what I understood, I hadn't thought about it, the malicious page would be a problem to open if Osprey Browser Protection didn't block it first.

 

[Marko :)]

Drive-by download if that's what I understood, I hadn't thought about it, the malicious page would be a problem to open if Osprey Browser Protection didn't block it first.

That and much more. Malicious scripts have way more potential than just launching drive-by download attack. It's also worth to have in mind that while website might deem safe, scripts can come and execute from third party domain(s) which makes this approach even more dangerous.

 

[piquiteco]

That and much more. Malicious scripts have way more potential than just launching drive-by download attack. It's also worth to have in mind that website might deem safe, scripts can come and execute from third party domain which makes this approach even more dangerous.

Exactly, a malicious script running even after being blocked by the extension would be a big problem. Phishing pages don't last long online, and most AVs detect them and take them down after a while. Who could test this for us? Did you watch @Shadowra video? Doesn't it clarify this?

 

[Marko :)]

I agree. According to Perplexity, 84% of phishing sites are taken offline in less than 24 hours. Most of them cease to exist after around 15 hours. I didn't watch Shadowra's video so I can't comment. Malicious sites last longer, I think.

 

[silversurfer]

That might not be ideal. Sure, it could work for phishing websites, but those malicious ones... I wouldn't rely on Osprey to block those. Hackers can easily make malicious scripts to load first and massively increase chances of executing script before Osprey reacts.

Well, I guess nobody here rely on Osprey alone, it's rather one part of protection layers, the main part of protection is usually an AV and a good one should be able to prevent attacks through malicious scripts.

There is a solution for this, but this would require @Foulest to have a server which would cache all the URL requests. Instead of sending multiple requests to security providers, it would only make one requests to Foulest's server which would then forward URLs to security providers and then return the result. Otherwise, it's either no delay and less protection, or more delay and better protection.

We should consider that @Foulest does his work for free and a server would require payment, we shouldn't expect too much "for free"