Serious Discussion Unboxing Symantec Browser Protection Privacy policy (finally after a year of perseverance)

[LinuxFan58]

They seem to have removed most AV-vendor-based detections but retained most DNS-based detections, with a few API-based detections left.

Well Alpha Mountain AI fins stuff others have not yet in their blacklists (you can use Osprey and disable all protections but keep AlphaMountain AI)

 

[Parkinsond]

the password manager won't enter your credentials if the link changes, or you're redirected to an unknown website

I use KeepassXC; it would enter the credentials regardless of the saved URL as it do it manually.
Also there is a situation when the URL is not changed, but the website is still compromised.

 

[Wrecker4923]

KeepassXC; it would enter the credentials regardless of the saved URL

Because you are not using the browser extension!

For people who do, one reason is that the attack surface from using the browser extension is considered less of a problem than the phishing attack the extension could help prevent.

 

[Khushal]

But offeres better detection when compared to.

Here is one MB false positive

 

[LinuxFan58]

Here is one MB false positive

That looks like an MBAM application block. The extension block looks different
(see picture of heuristics block = known malware spread from a new location)

Simular to AlphaMountain AI (of Osprey) this heuristics detection of MalwareBytes browser Guard usually beats Symantec Browser Protection in "block at first sight".
With this type of malware links it (existing payload spread from new location) nr1 is usually MalwareBytes Browser Guard (heuristics), nr2 Symantec, nr3 Avira, nr4 Bitdefender (I never tested Norton because I thought Norton Safe browsing was abandoned, but it did not chew URLHause links well, when I tried yesterday).

With this type of malware, AI and heuristics really do well. Curious to see how @Trident extension does (I can' t test it on Linux)

 

[Sorrento]

Do users here find many websites that are dodgy, in my case I rarely if ever encounter them in normal life??

 

[Khushal]

That looks like an MBAM application block. The extension block looks different
(see picture of heuristics block = known malware spread from a new location)
View attachment 297339
Simular to AlphaMountain AI (of Osprey) this heuristics detection of MalwareBytes browser Guard usually beats Symantec Browser Protection in "block at first sight".
With this type of malware links it (existing payload spread from new location) nr1 is usually MalwareBytes Browser Guard (heuristics), nr2 Symantec, nr3 Avira, nr4 Bitdefender (I never tested Norton because I thought Norton Safe browsing was abandoned, but it did not chew URLHause links well, when I tried yesterday).

With this type of malware, AI and heuristics really do well. Curious to see how @Trident extension does (I can' t test it on Linux)

is the same ip not blocked by extension?

 

[Wrecker4923]

Do users here find many websites[/links] that are dodgy

I mostly found them on MT .

If I block ads and don't click email links (especially spam!), I usually don't get one either, except from spam posts on forums.

I once hit a compromised website where the first visit took me all the way to a clickfix screen with no blocks. On subsequent visits, blocking depended on where the site redirected me.

It seems URL blocking is partial at best; maybe AV like Bitdefender would block the downloaded binaries but may fail to block the URLs in the first place.

 

[nickstar1]

Too bad Symantec has no extension for Mozilla Firefox .

Symantec scores always very good in my own malicious website tests. This year it is at the top. I see a decline with M

You may try Norton safe web; I consider it in the second place after Symantec, with less FPs.

Norton Safe Web - Chrome Web Store

Norton Safe Web provides protection from online threats while you browse the web.

chromewebstore.google.com

The Norton safe web extension uses the Avast engine not the Symantec anymore. it is not the same as Symantec's browser protection Norton safe web now uses the Avast network and it's not great.

 

[Sorrento]

As above bookmarking sites so you aren't searching IMO helps, recently I had one site picked up at that time by McAfee Web advisor, whether it was a FP or not I'm not sure as it wasn't to relevant, of course protection is always good but as to which is more effective I will leave to others, I'm not going to have several extensions fighting over websites though, & for me the less extensions I use the better as extensions are becoming or seemingly becoming an issue - There is the privacy aspect too, do I really want all companies examining the sites I visit .. For example.

Norton Safe Web:
Personally identifiable information
Authentication information
Location
Web history
User activity

 

[Zero Knowledge]

Do users here find many websites that are dodgy, in my case I rarely if ever encounter them in normal life??

If you know where to look you will find trouble, some hacker forums serve up malware while others are more sneaky & get you to install a root CA to use it.

The most I encounter now is phishing emails with malicious PDFs/Word documents. AV is pretty good with those since their large scale campaigns.

 

[LinuxFan58]

The Norton safe web extension uses the Avast engine not the Symantec anymore. it is not the same as Symantec's browser protection Norton safe web now uses the Avast network and it's not great.

Although Avast claims they block millions of malware by their extension, it performs less than Avira (politely worded).

 

[LinuxFan58]

If you know where to look you will find trouble, some hacker forums serve up malware while others are more sneaky & get you to install a root CA to use it.

The most I encounter now is phishing emails with malicious PDFs/Word documents. AV is pretty good with those since their large scale campaigns.

I only encounter malware links when checking out AV-extensions. Only when clicking on links from e-mail spam and scam I run into malware websites. This is the reason I am using (mostly) Bitdefender TrafficLight because it handles these "mass spray" consumer oriented campaigns well.

IMO this proofs that whether a security solution does well, always has to be assessed in the context of potential prey value of the victim (person using the PC), attack surface and usage patterns/habits of the PC user (e.g. when I compare several AV-extensions BD TL usually is not the winner, but in my daily practice it seems/feels to be the most visible interceptor/protector).

 

[Parkinsond]

The Norton safe web extension uses the Avast engine not the Symantec anymore. it is not the same as Symantec's browser protection Norton safe web now uses the Avast network and it's not great.

I know, that is why I said it is in the second place to Symantec extensions; I used them both in addition to every single security extension of reputable company.

There is the privacy aspect too

All extension collect data; nothing is free.

 

[LinuxFan58]

is the same ip not blocked by extension?

I don't know, but with Avast (web protection en extension) and Bitdefender (AV component and BD TL) the installed program blocks more

As above bookmarking sites so you aren't searching IMO helps, recently I had one site picked up at that time by McAfee Web advisor, whether it was a FP or not I'm not sure as it wasn't to relevant, of course protection is always good but as to which is more effective I will leave to others, I'm not going to have several extensions fighting over websites though, & for me the less extensions I use the better as extensions are becoming or seemingly becoming an issue - There is the privacy aspect too, do I really want all companies examining the sites I visit .. For example.

Norton Safe Web:
Personally identifiable information
Authentication information
Location
Web history
User activity

It differs per AV, but as a general rue of thumb, US based AV's are worse than EU based AV's and within EU German based AV's have the "best" privacy policies.

 

[Zero Knowledge]

I only encounter malware links when checking out AV-extensions. Only when clicking on links from e-mail spam and scam I run into malware websites. This is the reason I am using (mostly) Bitdefender TrafficLight because it handles these "mass spray" consumer oriented campaigns well.

IMO this proofs that whether a security solution does well, always has to be assessed in the context of potential prey value of the victim (person using the PC), attack surface and usage patterns/habits of the PC user (e.g. when I compare several AV-extensions BD TL usually is not the winner, but in my daily practice it seems/feels to be the most visible interceptor/protector).

There is still a wild place hosted on the internet with all sorts of malware, bots, infostealers and RATS. A lot has moved to Telegram but there is still what I call the 'grey web' where all sorts of bad stuff can be found regarding malware. The good news you will probably only be scammed for buying backdoored hacking tools or get infected from using free tools posted on forums or you will get scammed for buying carded eBay gift cards...

 

[LinuxFan58]

I get heaps of SPAM after my mobile operator (ODIDO) was breached.This made me change e-mail client. Evolution is a mail/agenda replacement for Thunderbird on Linux with a look and feel more similar to Outlook with a great feature: define a unified inbox for senders already in your contact books and a unified inbox for unknown senders (usually 95% SPAM). Other plus of evolution is that it bubblewraps the HTML e-ails (the Webkit rendering).

When I want to stop those emails by asking them to remove me from their mailing list, first BD Trafficlights throws a warning and Cloudflate Zero Trust blocks them .

 

[Parkinsond]

A fake rarlab website not detected by all: Symantec browser protection, Bitdefender trafficlight, Norton safe web both extension and website, and McAfee web advisor extension.

WinRAR archiver, a powerful tool to process RAR and ZIP files

WinRAR provides the full RAR and ZIP file support, can decompress CAB, GZIP and other archive formats

www.rarlab.com

Detected only by Fortinet in VT.

VirusTotal

VirusTotal

www.virustotal.com

When trying to download the fake installer, it is blocked by ControlD

 

[harlan4096]

The download for Desktop:

Application name: firefox.exe
Application path: C:\Program Files\Mozilla Firefox
Component: Safe Browsing
Result description: Blocked
Type: Malicious link
Name: https:// pub-e694d27497344c608babd0c00c8a9655 . r2. dev/favicon.ico
Precision: Exactly
Threat level: High
Object type: Web page
Object name: favicon.ico
Object path: https:// pub-e694d27497344c608babd0c00c8a9655 . r2. dev
Reason: Cloud Protection

 

[Parkinsond]

The download for Desktop:

View attachment 297366

This is the download link blocked by ControlD, but the hosting domain is not blocked by any.

WinRAR 文件压缩与解压工具下载与格式支持

WinRAR 是一款适用于 Windows 的文件压缩与解压工具，支持 ZIP、RAR、7Z 等常见格式，适合日常办公、下载包解压、大文件打包、资料归档与批量处理场景，帮助用户更高效地完成文件压缩、提取、整理与长期保存。

www-rarlab.com