Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Gandalf_The_Grey]

hi, I think google chrome will warn you about the safety of the files after you download them and I think it should be counted
chrome only shows a red/block page sometimes
on my test, chrome scored very high

similarly to Edge. It lets you download then ask you to keep or delete the files

You could be right, but my test was not fair to Chrome because Kaspersky was enabled and blocked the links first.
To test just Chrome I should have disabled or uninstalled Kaspersky.
I just wanted to know how my setup worked and especially Kaspersky.

 

[Evjl's Rain]

@Evjl's Rain , please, can you explain more details about your settings at CF web filter?
Do you just enable it and updated?
Or do you changed filters, other settings etc?
I ask because the CF web filter always was known as terrible.
Thks

I enabled the web filter and updated it. Then, it started to work properly
I never use comodo web filter because I also heard it was terrible. I don't do any change to it
I think if we disable it and update, CF won't download the new database for it
it only downloads for enabled components

 

[Decopi]

I enabled the web filter and updated it... ponents

Thks!
This a nice surprise.
I'm using CF for years, and web filter always sucked.

I have not time now and I need to leave, but I will redo my tests, using just CF web filter.
I'll be back to you with my results.

 

[Moonhorse]

I do respect your opinion.
In fact, I believe that the "best combo" is just the combo the user like.
It doesn't exist such thing like "the best universal solution".

Having said that, technically speaking, sometimes the less the better.
For example, even recognizing that Avast AV have the lowest system impact, its Web Shield slows down browser speed, and also creates conflicts with TLS. In other words, many users don't feel system impact, or don't care. But not just system impact always exists, but worse, it creates conflicts. Firefox has interesting researches showing how add-ons, antivirus etc interfere with the browser. It is a fact: The less, the better.
So, instead antivirus, even average users should be better protected with an anti-executable + a kind of K9 blocker working at system level (if they can't use Pi-Hole).

My very personal subjective opinion is that having thousand of new malwares and risk-wares appearing everyday... antivirus/anti-malwares are obsolete. And add-ons with hosts... are extincted dinosaurs.
Intelligent anti-executables should replace them. CF+CS settings is a good start. VTZilla is another piece of art.

Conclusion: If we have less system resources strategies, with high blocking rates... then we should focus on them.

either voodooshield or comodo firewall is enough, you can have the antivirus but just disable web shield if you want to

Personally im running neustar business production dns, since i feel most of stuff comes from either adult sites / torrenting, i dont use them and only visit same sites day by day but theres always possiblities im gonna get clickbaited to something like that wich could contain something sketchy

I prefer use k9 or forticlient to do web filtering outside of browser ( system level) and only have adblocker in browser ( built-in better)

Just cant use k9 at the moment because it conflicts with the game client i use, causes me to disconnect from game every 5 minutes.

I already contacted them last week , but no answer yet

 

[Windows_Security]

When I run Firefox as another (limited) user in Windows7, MBAM seems to be the cause that 2 Firefox processes are not closed (under that other limited and contained user). Luckily thanks to your tests :emoji_ok_hand: (@Evjl's Rain ) I have replaced it with Comodo add-on which run with no problem

 

[Moonhorse]

When I run Firefox as another (limited) user in Windows7, MBAM seems to be the cause that 2 Firefox processes are not closed (under that other limited and contained user). Luckily thanks to your tests :emoji_ok_hand: (@Evjl's Rain ) I have replaced it with Comodo add-on which run with no problem

Im using malwarebytes, but have to disable ad/tracker protection either it conflicts with ublock origin. Also using half less ram that way

 

[Evjl's Rain]

Im using malwarebytes, but have to disable ad/tracker protection either it conflicts with ublock origin. Also using half less ram that way

malwarebytes is still in beta
I admit it did cause a problem for me so I was forced to remove it
it caused a few websites not displaying correctly although I disabled everything and added those websites to exclusion

I used hphosts emd and pup instead. They are not as good but okay

 

[Decopi]

@Evjl's Rain ... I couldn't wait, I did a quick test now on CF web filter (enabled/disabled it + updated it many times before testing + restarted computer)... and results were bad: 14/25.
But, considering that 2 links of your sample seem to be already dead, my real result was 12/23.
I will do further tests during the week. But my first impression is not good.

PS: With regards Pi-Hole, a have tons of lists there. It is a mess. I need to organize and clean it. Because it is not affecting my system performance + it is blocking almost everything, I became negligent with the lists. In the other hand, this is another positive point for Pi-Hole, it doesn't matter if you put thousand lists there, it is almost not affecting computer or browser performance. The main advantage of Pi-Hole is not the lists, but the computer performance.

 

[goodjohnjr]

Updated 18/7/2018

sorry, no time to test more
Dropbox - test 18-7-2018.txt

chrome: 20/25
WDBP: 16/25
comodo: 15/25
ublock (default): 1/25
ublock (+custom): 20/25
avira: 20/25
Malwarebytes: 24/25
Bitdefender TL: 1/25 (expected)
avast: 0/25 (expected)
adguard (+custom): 1/25 (expected)
Edge: 24/25

DNS:
norton: 2/25
Quad9: 2/25
Neustar: 9/25

best list: hphosts > squidblacklist >>> AdZ >>> others = 1 or 0

list of applied ublock filters: default + these
hphosts+hphosts partial = all individual hosts combine (emd, hjk, exp, fsh,...)

Spoiler: ublock

View attachment 192833

my setup: Chrome + ublock (hphosts EMD+PUP) + comodo online security + WDBP + Norton Safe Web = 25/25

Thank you Evjl's Rain for the new test and for adding the Avast and Bitdefender and Adguard browser extensions; I am disappointed in how they performed, and this proves that you were correct about them and now I clearly can understand their removal from these tests (unless they magically improve one day).

Are the Avira, Malwarebytes, and Norton browser extensions the only browser extensions in your tests that also scan file downloads made in the browser?

Keep up the good work,
-John Jr

 

[Evjl's Rain]

Are the Avira, Malwarebytes, and Norton browser extensions the only ones in your tests that also scan file downloads made in the browser?

hi, avira, norton, malwarebytes are able to block the links before the browser can download the files but I don't think they are able to scan the files after being downloaded
Only google chrome safe browsing and edge browser can do that effectively
firefox is lacking behind those 2 for some reasons although firefox also uses google safe browsing
WDBP can also block links but it still allows some of blocked files to be downloaded => I think it's bug. I may report it later but won't hope for a reply from MS

I don't know why norton has been crap in recent tests!?? perhaps something is wrong in the company?
same as avira last month

 

[goodjohnjr]

hi, avira, norton, malwarebytes are able to block the links before the browser can download the files but I don't think they are able to scan the files after being downloaded
Only google chrome safe browsing and edge browser can do that effectively
firefox is lacking behind those 2 for some reasons although firefox also uses google safe browsing
WDBP can also block links but it still allows some of blocked files to be downloaded => I think it's bug. I may report it later but won't hope for a reply from MS

I don't know why norton has been crap in recent tests!?? perhaps something is wrong in the company?
same as avira last month

Hello Evjl's Rain,

Thank you for explaining that.

I have also always wondered why Firefox always lags behind the others when it uses the Google Safe Browsing api or whatever too.

A few weeks ago or less I emailed my suggestions to Microsoft about the Windows Defender Browser Protection extension, I mentioned the recovery bug and that they should follow this thread, but I have not gotten a response yet; but I think that you should report the bug to them and your suggestions as well because I would like to see this extension improve to at least equal or surpass Microsoft Edge's protection, and for them to add more features.

Out of those extensions that we named the Norton extension is the only one that has not be updated this year yet (I think that Microsoft quietly updated their extension recently), I wonder if Norton are phasing it out and / or if the lack of updates is hurting its performance, and if something else is going on; I would like to see Norton fully integrate K9 and continue improving it so that all of their products can equal or surpass it (like the browser extension).

Thank you for responding,
-John Jr

 

[Sephiroth Source]

23/25 here. Using Nano + Comodo + K9. Thanks for the tests, Evjl's Rain!

 

[Burrito]

Updated 18/7/2018


Malwarebytes: 24/25
Edge: 24/25

DNS:
norton: 2/25
Neustar: 9/25

Another good test. Thank you Evjl's Rain.

Great showings from Malwarebytes and Edge.

Norton DNS -- not so good. Don't confuse this with previous tests of Norton Safe Web.

Neustar.... good stuff. I switched to this based on Evjl's Rain's tests. It's good.

 

[stefanos]

Im using malwarebytes, but have to disable ad/tracker protection either it conflicts with ublock origin. Also using half less ram that way

the same like you

 

[HarborFront]

hi, avira, norton, malwarebytes are able to block the links before the browser can download the files but I don't think they are able to scan the files after being downloaded
Only google chrome safe browsing and edge browser can do that effectively
firefox is lacking behind those 2 for some reasons although firefox also uses google safe browsing
WDBP can also block links but it still allows some of blocked files to be downloaded => I think it's bug. I may report it later but won't hope for a reply from MS

I don't know why norton has been crap in recent tests!?? perhaps something is wrong in the company?
same as avira last month

If I'm not wrong FF uses Disconnect for tracking protection and calls upon Google Safe Browsing as and when needed

 

[Evjl's Rain]

If I'm not wrong FF uses Disconnect for tracking protection and calls upon Google Safe Browsing as and when needed

but the problem is we don't know why firefox uses google safe browsing but still doesn't perform as good as google chrome or other chromium's forks
perhaps firefox focuses on limiting telemetry to google so it also limits the full strength of safe browsing or firefox uses only a delayed version, similar to adguard desktop
they will never perform as good as google chrome

 

[HarborFront]

but the problem is we don't know why firefox uses google safe browsing but still doesn't perform as good as google chrome or other chromium's forks
perhaps firefox focuses on limiting telemetry to google so it also limits the full strength of safe browsing or firefox uses only a delayed version, similar to adguard desktop
they will never perform as good as google chrome

Read the cached copy of the article here

https://web.archive.org/web/2018062....nz/posts/how-safe-browsing-works-in-firefox/

 

[Evjl's Rain]

Read the cached copy of the article here

How Safe Browsing works in Firefox

"Firefox downloads a list of bad URLs every 30 minutes from the server"
that's the reason

google chrome updates in realtime
I saw a link was failed to be blocked but when I refreshed the page immediately after that, it was blocked

 

[stefanos]

but the problem is we don't know why firefox uses google safe browsing but still doesn't perform as good as google chrome or other chromium's forks
perhaps firefox focuses on limiting telemetry to google so it also limits the full strength of safe browsing or firefox uses only a delayed version, similar to adguard desktop
they will never perform as good as google chrome

Agree with you. The most secure browser for me is google chrome. I love opera browser but only for secure surfing, and always with https everywhere avira or malwarebytes or....or...... extension. Google chrome only with WDBP
is enough

 

[stefanos]

Just now one fast test google chrome against Firefox at malcode database without extesions. Google chrome block everything and Firefox nothing