Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

Now, for security, I recommend you to use the Firefox built-in protection (Safebrowsing - Google) + VirusTotal add-on/extension (VTzilla 2.0 ) + an external AV (Avast) + firewall (Comodo CS' settings). In my opinion this is the less intrusive combo, with the best protection.

I'm using similar combo with Kaspersky free + CF + Google safe browsing + Norton Safe Web + VTchromizer
norton is light that no one can notice its existence so I can't get rid of it. Similar to WDBP but I doubt about its effectiveness

 

[Decopi]

That's great @Evjl's Rain !... the right/perfect combo, is the combo each user likes. If it works for the user, then is the right/perfect combo for him.

Privacy/security combos depend only on user profile.
Most of the user won't care about system performance, and they will prefer "plug-and-play" solutions (something easier to install/use).
In the other hand, paranoids never will be satisfied, they always will want more and more, redundancies, complex and sophisticated stuff etc. They are always looking for perfection, "the 100%" in everything.
I prefer something in the middle of both (basic user vs paranoids).

Honestly, after testing CF+CS settings, I didn't feel anymore the need of an external AV. I still use/recommend an external AV, just because of the possible "human error factor" (allowing wrong stuff at CF). So, basically CF alone is enough for me, and AV is redundant.

Similar logic goes to the browser: The VTzilla 2.0 add-on is more than enough for me. It stops every download. And it checks every download. And it does that without killing system performance. I don't need Norton, Malwerbytes, nothing. Even is not necessary the built-in Safebrowsing-Google option.

For phishing, as you said, I trust my experience & habits. But if I fail, VTzilla 2.0 add-on can check URLs.

Conclusion, I personally don't need AV, antimalware/phishing add-ons or blocking hosts lists, nothing. I just need VTzilla 2.0 add-on and CF+CS settings... that's all!

For 3rd-parties I use Pi-Hole, not because security risks, but for browser performance improvements. 85% of the webpages don't need 3rd-parties, they work "ok", without breaking. So, blocking this webgarbage means "internet speed boost", webpages loading faster, less RAM, less CPU, more battery-life, less internet band consumption etc.
But for those without Pi-Hole, tiny/lightweight 3rd-party blockers are enough.

For my user profile, this is the right/perfect combo.
But I perfectly understand that other users love other combos.

 

[oldschool]

That's great @Evjl's Rain !... the right/perfect combo, is the combo each user likes. If it works for the user, then is the right/perfect combo for him.

Privacy/security combos depend only on user profile...


For 3rd-parties I use Pi-Hole, not because security risks, but for browser performance improvements. 85% of the webpages don't need 3rd-parties, they work "ok", without breaking. So, blocking this webgarbage means "internet speed boost", webpages loading faster, less RAM, less CPU, more battery-life, less internet band consumption etc.
But for those without Pi-Hole, tiny/lightweight 3rd-party blockers are enough.

For my user profile, this is the right/perfect combo.
But I perfectly understand that other users love other combos.

+ 1 on user profiles being determining factor. Nano Adblocker or uBO - Advanced User Mode Medium: Block all 3 Party Scripts and Frames. Pretty easy to use for most sites as well. Fast & light!

 

[TairikuOkami]

Just tried "Windows Defender Browser Protection", it blocks 16 malware links, like Edge before. I guess, it is updated separately.

 

[Evjl's Rain]

Just tried "Windows Defender Browser Protection", it blocks 16 malware links, like Edge before. I guess, it is updated separately.

I think they have the same database but Edge can scan and analyze the website and the downloaded file (for digital signature and reputation) + Edge is also integrated with Smartscreen for windows => better results
WDBP is just blacklisting, nothing more, I think

 

[Evjl's Rain]

Test 7/6/2018

Spoiler: link

Dropbox - link 7-6-18.txt

special thanks: @mekelek

​	Malware (34)​	Phishing (6)​	Dead links​	Total (40)​
Google​	27​	1​	0​	28/40​
Edge​	29​	0​	0​	29/40​
WDBP​	24​	0​	0​	24/40​
Malwarebytes​	29​	0​	0​	29/40​
Avira​	30​	0​	0​	30/40​
Norton​	24​	0​	0​	24/40​
Adguard​	2​	0​	0​	2/40​
Squidblacklist​	21​	0​	0​	21/40​
Kaspersky Free​	33​	5​	1​	38/39​
K9​	32​	6​	1​	38/39​

Late test (3-5 hours)​	​	​	​	​
​	Malware​	Phishing​	Dead links​	Total​
Forticlient​	33​	4​	1​	37/39​
Norton DNS​	20​	0​	1​	20/39​
Neustar DNS​	22​	1​	1​	23/39​
Quad9 DNS​	4​	0​	2​	4/38​
Adguard DNS​	2​	0​	2​	2/38​

Best AV's web filter: Kaspersky Free, Forticlient, K9 Web Protection
Best extension (malware): Avira Browser Safety, Malwarebytes
Best DNS: Neustar Recursive DNS

Losers: Adguard Adblocker, Quad9 DNS, Adguard DNS

 

[Evjl's Rain]

@Nestor I tested K9 as you wish
It was surprising good but the default preset was too aggressive, it even blocked youtube. It needs to be properly configured

 

[Nestor]

@Nestor I tested K9 as you wish
It was surprising good but the default preset was too aggressive, it even blocked youtube. It needs to be properly configured

,
Thank you very much! Indeed it is very aggresive,i use it with configured settings (only malware,spyware,fishing) and it is very good!I think Blue Coat,owned the last years by Norton.

 

[Moonhorse]

@Nestor I tested K9 as you wish
It was surprising good but the default preset was too aggressive, it even blocked youtube. It needs to be properly configured

Hows the Performance with k9 compared to forticlient? For me forticlient is affecting ping a bit

 

[Evjl's Rain]

Hows the Performance with k9 compared to forticlient? For me forticlient is affecting ping a bit

I haven't had enough time to test the performance impact yet but K9 seems very light to me, but I had to test it under a VM because I don't want it to conflict with comodo firewall and kaspersky

I tried forticlient with all modules installed, it didn't feel light to me
I haven't tried forticlient with web filter only

 

[oldschool]

Since you tested two AVs I'm wondering why you wouldn't test Sophos Free as well. Its web protection was great when I used it.

 

[TairikuOkami]

WDBP blocks 20 at the moment, I guess it will eventually catch up with Edge, maybe due to caching? Still, it is not a good result when talking about zero day malware, where minutes count. Obviously it is not as reliable as smartscreen itself. Then again, I do not have a choice.

 

[Evjl's Rain]

Since you tested two AVs I'm wondering why you wouldn't test Sophos Free as well. Its web protection was great when I used it.

because sophos free is not good overall. Some users reported it slowed down their internet
there are many restrictions too

 

[TairikuOkami]

because sophos free is not good overall.

You can say that again, Sophos web filtering blocked 2 out of those 34 malware links.

 

[Evjl's Rain]

@TairikuOkami I noticed a problem with WDBP
When I executed all links at the same time, WDBP only blocked 4, maximum 6/34 malware links
but when I executed 1 by 1 it blocked 24/34
although 24 links were blocked, many malwares were still be able to download

WDBP needs recovery time
just realize it now

 

[TairikuOkami]

although 24 links were blocked, many malwares were still be able to download

You are right, I guess it is more like a notifier (or to tease chrome users), maybe designed to work with smartscreen itself. Removed it, thanks.

 

[Moonhorse]

I haven't had enough time to test the performance impact yet but K9 seems very light to me, but I had to test it under a VM because I don't want it to conflict with comodo firewall and kaspersky

I tried forticlient with all modules installed, it didn't feel light to me
I haven't tried forticlient with web filter only

Thanks, appreciate your work

 

[TairikuOkami]

I tried forticlient with all modules installed, it didn't feel light to me
I haven't tried forticlient with web filter only

Indeed, about 500MB RAM usage. I could not get web filter only to work, but I would love to see, if it is even possible.

 

[Evjl's Rain]

Indeed, about 500MB RAM usage. I could not get web filter only to work, but I would love to see, if it is even possible.

many people have got only web filter to work

EDIT: what about K9? it was impressive

 

[TairikuOkami]

EDIT: what about K9? it was impressive

It is, blocks malware, adult content (which most filters omit) and can be customized, like allow proxy images on duckduckgo. I love it thus far.
I do not like running a realtime software, but I think, that I will make an exception. 0,04% CPU and 544B/s nonstop, I can live with that.

K9 + UltraDNS should do the trick. UltraDNS is able to catch URLs, which bypass browser's dnscrypt somehow (direct downloads?).

EDIT: It seems, that I do not even need Netcraft anymore, that should make things a little lighter, less of multiple filtering.

Spoiler: K9 Web Protection summed up in 3 words.