I've been thinking a lot about securing online transactions for laypeople.

A major issue seems to be that URLs are 1) often not visible 2) not designed for laypeople, so many of us have no idea who they are communicating with.

I'm looking for a reliable browser extension that can block site access based on domain allow-lists, extensible by country.

Any recommendations?

#security #phishing #scam

@buherator yeah, honestly, I noticed it became harder to see the link in browsers nowadays, I always check links on my emails and I believe it was a little easier in the past. Maybe an extension that once you hover a link it display it in big letters on the screen, shows if it is secure (https) and it diverges from the current domain or in case of emails divergences from the domain of the from header

@buherator Not extensions, but you can use WebsiteFilter in FF’s policies.json, or URLBlocklist for chromium/chrome/edge.

Edit: Even simpler: Use uBlock Origin. A filter with just a domain (e. g. ||google.com) will block the whole domain. And since uBlock can update filter lists, you can just host your filters wherever

@schrotthaufen I like the uBlock idea! I wonder how hard it's to maintain the lists though...

@root The main problem for visibility is mobile. I want a solution where the users don't have to look at domain names at all: how will Aunt Judy know if mybank.foo or my-bank.bar is the right one, esp when even legit providers rely on crappy redirectors for adtech?

@buherator There’s a bunch of dnsbls one could automatically parse into a uBlock filter list. If I wanted to go the uBo route, I’d look for the git repos of the pihole lists I use, clone them, have a cronjob (systemd timer) to git pull once a day or so, run a small script to transform them into uBo filters, and push them to where you host the list. (Or maybe someone’s already doing that, and you don’t have to do any of that. Didn’t check ¯\_(ツ)_/¯ )

@buherator I had some ridiculous experiences with getting domains removed from the dnsbls, though. Like j00ru’s blog (never mind it’s dysfunctional right now) where the blocklist maintainers took years(!) to look at my removal request, and after they did are adamant it’s actively distributing malware…

So be prepared to manually remove domains from the lists on your end. (The exception list at work is maybe 15 domains wrongfully blocked by upstream.)

@schrotthaufen Good news is that Average Joe is probably not interested in hacker blogs or similar "dual-use" content :)