New Update Osprey Browser Protection discussion and updates

[Foulest]

Any plans to make untrusted , suspicious optional
As in some pcs I will like all providers to have that detection (mainly mine ) and for my family I will like to disable it just in case there might be a false positives

I’m testing it out in this release. Let me know if there’s significant false positives! If there is, then it will be reversed.

 

[shadek]

I can do that in the next update.

Please do add "reset to default"! I can see lots of other users wanting it here.

 

[mlnevese]

Please do add "reset to default"! I can see lots of other users wanting it here.

It's already implemented. Check the right-click menu.

 

[shadek]

It's already implemented. Check the right-click menu.

View attachment 289379

Sweet! Noticed it now, per your instructions!

 

[silversurfer]

Changes in 1.3.1​

• Added copyright notice headers to the codebase
• Improved alphaMountain service configuration
• Improved local IP detection and suffix handling
• Improved error protections across the codebase
• Fixed context menu parity after restoring defaults
• Fixed continue URLs for detected frame navigations
• Fixed issues with certain policies not working
• Improved JSHint compliance
• Cleaned up codebase

This update has been submitted to all extension stores.

Release 1.3.1 · Foulest/Osprey

Changes in 1.3.1 Added copyright notice headers to the codebase Improved alphaMountain service configuration Improved local IP detection and suffix handling Improved error protections across the c...

github.com

 

[Sorrento]

Just updated on Brave

 

[rashmi]

@Foulest, I'm not using Osprey, but I try new versions to see updates or changes. I suggest a settings page rather than four pages or slides. A browser window/tab displays the settings page, neatly listing all services and options (available via the right-click menu). You can group the default services, then the others, and show enabled services on the extension. You may also show a brief description of the service on hover or with an "i" sign.

 

[CyberDevil]

I actually really miss the managed whitelist in the UI. I would like to add certain sites to the whitelist once and for all.

 

[Foulest]

I'll look into this.

 

[shadek]

Any way to permanently add a website to exclusions? Norton Safe Web can be a bit too aggressive, but the site I use is 100% legit. Should be able to locally add a site to exceptions I think, which overrides all providers detection.

Norton Safe Web generally doesn't listen to user feedback regarding false positives in my experience!

 

[Foulest]

Any way to permanently add a website to exclusions? Norton Safe Web can be a bit too aggressive, but the site I use is 100% legit. Should be able to locally add a site to exceptions I think, which overrides all providers detection.

Norton Safe Web generally doesn't listen to user feedback regarding false positives in my experience!

I'm reworking this in the next update.

 

[Andy Ful]

I am not sure if the issue has already been reported. Some malicious downloads happen even if the URL is blocked.
I think that this issue is related to HTML smuggling. The downloads happen automatically via the direct URL to the file.

Post edited.

 

[Andy Ful]

A few Guloader URLs from today on URLhaus.

 

[Foulest]

I am not sure if the issue has already been reported. Some malicious downloads happen even if the URL is blocked.
I think that this issue is related to HTML smuggling. The downloads happen automatically when the website is opened.

For things like these, this is when real-time protection kicks in. Osprey can't do much if downloads happen automatically.

 

[Andy Ful]

Anyway, the phishing protection is excellent. For fresh phishing, the G-Data, Norton, and alphaMountain do very well.

 

[simmerskool]

@Foulest I was checking DNS at dnscheck.tools and it has a "sister link" to
addr.tools
and Osprey opendns blocked it as malicious, I did not report it as I do not know for certain it's malicious.

 

[Foulest]

OpenDNS's support email in Osprey is outdated. I'm testing a new one now.

 

[Andy Ful]

@Foulest​

You probably did not plan to block direct file downloads, and the Osprey alert is an advantage even if the malicious file is downloaded.
However, I noticed that Osprey can show the alert even when the file is deleted in the URL.
For example, the URL hxxps://xxx.xxx.xx.xxx/ is blocked as well as hxxps://xxx.xxx.xx.xxx/innocent.exe

So, in theory, it would be possible to block malicious downloads of EXE, MSI, BAT, VBS (and maybe some other file types) by temporarily replacing the full URL with a shortened one, and opening the full URL only if the shortened one is not malicious. This should not be a problem for typical websites.

 

[silversurfer]

Changes in 1.3.2​

• Allow site button now permanently adds to allowed cache
• Fixed blocked cache integration with alphaMountain
• Disabled Norton Safe Web by default due to false positives
• Cleaned up code

This update has been submitted to all extension stores.

Release 1.3.2 · Foulest/Osprey

Changes in 1.3.2 Allow site button now permanently adds to allowed cache Fixed blocked cache integration with alphaMountain Disabled Norton Safe Web by default due to false positives Cleaned up co...

github.com

 

[shadek]

Great! While Norton Safe Web does hit you with false positives, it's also very sensitive and hit malicious websites to nearly 100%. Glad you added possibility to permanently whitelist!