Media
6 items
Description
Protection against lookalike and impersonation sites (homograph attacks & clone phishing) based on your personal visit history Visilant is a lightweight, open-source extension (github.com/ikskoder/visilant) that runs entirely on your own device and makes hidden threats visible. Its job is to stop you handing your password to a fake site that looks exactly like the real one. It shows you where a link really goes, points out addresses built to be misread, unfolds short links, and reminds you when you are about to type something into a site you barely know. How it works: Almost every phishing site is a site you have never been to, or have been to once. Visilant counts your visits on your device and protects you on two fronts: * Before you click – it reads the links on the page and tells you the real destination, how well you know it, whether the link text says one thing while the link goes somewhere else, and whether the address itself is built to deceive. * While you are on a site – if you start typing, pasting or copying on a site you hardly know, it says so. This holds inside frames as well, which is where a great many sign-in forms actually live. Because Visilant goes by your own history rather than a list of known-bad sites, it can warn you about a fake the day it appears, without waiting for anyone's blacklist to catch up. KEY FEATURES How well you know a site: three things count, and you decide which of them do. How many times you have been there (10 visits by default), how many separate days you were there (5), and how long you have known the site (10 days). A site has to pass all of them, any one of them, or a number you choose, such as two of three. An afternoon of clicking cannot turn a brand new site into an old friend. Every warning shows its reasoning. Instead of a bare "unfamiliar", you see the facts behind it – visits, active days, days known – and, if you want, how far each one is from the mark you set. Every figure also says which name it is about: the address you checked answers for itself, and the figures for the whole domain sit under the domain's own name, each one saying whether it is a total or the strongest single host. Sign-in forms inside frames are covered. Many sites put their login form in a frame from another address, and events inside a frame never reach the page around it. Visilant watches inside those frames too, and inside pages built out of custom elements, so typing, pasting and copying raise the same warnings wherever the form was put. An ordinary frame from another address raises no warning of its own: the verdict is about the page you are on, which is the only thing a warning there could ask you to act on. Link safety, before you click: ask about any link (by default with a right-click, or set it to hover or left-click) and a small panel shows where it really goes and how well you know that site. It catches links whose visible text names one site while pointing at another, addresses that put a familiar name in front of an @ so the real site hides behind it (paypal.com@evil.net), addresses that bury a familiar name in the middle so the real one comes last (paypal.com.evil.net), addresses that are only a number, and names that pad out a brand you know (paypal-secure.com). It can also stop the click entirely and ask you to confirm before opening a site you do not know. Look-alike detection: an address that is one character away from a site in your own history is called out – a foreign letter that looks exactly like a Latin one, a 1 standing in for an l, a plain typo, or a familiar name buried in a longer address. Because the comparison is against your own history rather than a fixed list of famous brands, what Visilant catches is different for every user and cannot be tested in advance by whoever built the fake. Strong matches are shown loudly, weak ones stay quiet so you are never trained to ignore them. Each site counted separately: two customers of the same hosting platform are two different sites, so time spent on one of them never makes the other look familiar. Subdomains of a site you know still count towards it. Shortened links: bit.ly, t.co and about two and a half thousand others hide where they lead. Visilant can unfold them and show the real destination, on demand or automatically, including the whole chain of redirects. Email addresses: the part after the @ is checked like any other address. Visilant marks addresses at services anyone can sign up to (so you judge the name, not the domain), marks throwaway mailboxes, and knows that Gmail is read at mail.google.com – so an address domain no longer shows a visit count of zero that could never have been anything else. Every recipient of a mailto link is checked, not only the first one. Check anything by hand: a field in the dashboard takes a link, a bare domain, an email address or a QR code image – pasted, dropped in or picked from disk. The field grows to fit what you put in it, so a long address stays readable in full rather than scrolling out of sight. Any selected text on a page can be checked from the right-click menu without leaving the page, and a QR code in a picture can be scanned the same way. Second opinions: under any address you have checked there is a short list of links to services like VirusTotal, urlscan.io and Google Safe Browsing, offered for the base domain as well as for the exact host. They are ordinary links – nothing is sent anywhere until you click one – and you can change the list to whatever you use. Nothing to set up: your browser history is read once when you install, so the counters start out knowing the sites you already use instead of warning you about every one of them. It is read on your device and never leaves it. Dashboard: click the icon for your history with the current site and the other hosts under the same domain, choose which number the list shows – visits, active days, days known or checks passed – and sort it by name or by that number. It is also the only place a site's warnings can be turned off, and turned back on. A page cannot reach into this window, which is the point: the switch used to sit inside the warning on the page, where a page could tell you to press it. Tamper protection: if a page tries to remove or hide Visilant, you get a system notification. Sites that redraw themselves as you move around them no longer set it off by mistake, and the alarm can still be switched off for an individual site that does. Looks and fits: light, dark or follow-the-system theme. Works in the popup, in a full tab and in a narrow window. Every dialog can be answered from the keyboard alone, and the controls are named for screen readers. Checkable: every release can be rebuilt from the published source and compared byte for byte with what the store gave you, so you do not have to take anyone's word for it. GETTING STARTED 1. Install the extension. 2. Your browser history is imported on the spot, so the counters start with the sites you already know. It takes a moment, and it can be cancelled or re-run later. 3. (Highly recommended) Pin the Visilant icon to your toolbar, so you can always see it is there. 4. Click the icon to open the dashboard. 5. Click the gear icon for the settings page. Every section has its own reset button, and every setting explains itself in a line underneath, which you can switch off once you know them. CONFIGURATION INCLUDES 1. What makes a site familiar: three checks, each with its own number and its own on/off switch – visits (10 by default), separate active days (5), and days since your first visit (10). Decide whether a site has to pass all of them, any one of them, or a set number, such as two of three. You can also choose whether each warning shows how far the site is from the mark, or just the plain numbers. 2. Toolbar icon: whether it carries a counter and which number that counter shows, and whether it turns red on a site you do not know. On a site whose warnings you have switched off, the same verdict comes in grey instead of red, because a red icon over a page that will warn about nothing promises a guard that was stood down. Tamper alerts still come through in red. 3. Link safety: * How the check appears: right-click (the default, so nothing pops up unasked), left-click (the safest – the page does not open until you have looked), or hover after a delay you choose. * Whether the numbers behind the verdict are shown always, never, or only for sites you do or do not know. * An optional confirmation screen before opening a site you do not know. * Short links: off, a button, or automatic. Full address or domain only, the chain of redirects, any address rather than only known shorteners, your own list of shortener domains, and a source to keep the built-in list current. * Where it works: everywhere, only on sites you list, or everywhere except those. 4. How addresses are drawn: mark the characters worth a second look, show foreign-alphabet addresses in their plain ASCII form, and pick upper or lower case. These three sit in the header of the dashboard, so they are within reach on the check page as well. The account name of an email address has a button of its own beside it, with three positions: left exactly as typed, which is how it starts, lower case, or upper case. Font size and the sorting of the site list are up there too. 5. Notifications: * When: typing, copying, or both. * How: a browser notification, a warning inside the page, or both. * Hold pastes on sites you do not know (off by default): the first paste is stopped and nothing is inserted until you have looked at the address. This works even when the page hides the field inside a component of its own. 6. Email addresses: add to the built-in lists of public and throwaway mail services, keep them topped up from a source of your choice, and say where a given provider's mail is actually read. 7. Second-opinion links: edit or clear the list of services offered under a checked address. 8. Sites whose warnings you have silenced: the settings page lists them, so an exception you made months ago can be found and lifted rather than quietly staying put. 9. Tamper protection: list the sites it should stay out of the way on. 10. Appearance: light, dark or system theme. 11. Your data: re-run the history import, or erase every visit Visilant has recorded. PRIVACY AND PERMISSIONS Visilant is open source and works locally: 1. Your visit counts, your history and every check stay on your device. There is no server behind the extension, no account and no telemetry. 2. Nothing goes out on your behalf unless you ask for it. Three things cause a request, and each of them waits for you: unfolding a short link (a button by default, automatic only if you choose that), scanning a QR code out of a picture that is on a page, which has to be downloaded because that is where the code is, and pressing Update on one of the optional domain lists. A picture you drop into the check field or paste into it is never downloaded, since it is already on your device. The second-opinion services are plain links, so nothing reaches them until you click one. 3. Permissions: * Tabs, Storage, Host access: the core of it – counting visits, reading the links on a page, noticing that you are typing. * Notifications: to tell you if a site tries to disable the extension. * Context menus: for the right-click checks. * Browser history: read once, on your device, to turn the sites you already use into visit counts. Without it a fresh install treats every site on earth as unfamiliar and warns about everything. Only a count, a first and last date and a number of active days are kept per site, with no page addresses, no titles and no searches. LIMITATIONS 1. Not an antivirus. Visilant deals with deception, meaning fake sites and misleading links. It does not block malware, downloads or trackers. 2. It warns, it does not enforce. Acting on the warning is up to you. 3. It can be wrong both ways. A real site you rarely use may be flagged, and a fake site you have somehow visited many times, or a real site that has been broken into, may not be. 4. It works by adding a small script to the pages you open. It watches for a site trying to remove that script and tells you if one does, but keeping the icon in sight remains the most reliable sign that it is still there.