Avast WEBforum
Other => General Topics => Topic started by: lakrsrool on April 02, 2015, 08:17:24 AM
-
Who here on this board uses the Excite.com site browser startpage portal?
-
??? :o
-> http://sitecheck.sucuri.net/results/excite.com
-> http://zulu.zscaler.com/submission/show/ab5e620cd5e6c30c8b0cec80d15e512d-1427957992
-
??? :o
-> http://sitecheck.sucuri.net/results/excite.com
-> http://zulu.zscaler.com/submission/show/ab5e620cd5e6c30c8b0cec80d15e512d-1427957992
Thanks for the reply.
I've been using the Excite.com startpage personal portal (http://en.wikipedia.org/wiki/Excite) since 1995 without incident. There is nothing that compares to the flexible options to build (design) a startpage available to users anywhere on the web. I've got literally many hundreds of links formatted by category along with many other conveniences that I find indispensable using the web. For what it's worth, in the past year or so I happen to be blocking the "risky" scripts (use the NoScript FF add-on). But that is relatively recent and had not prior to around a year ago. I had used Excite.com startpage for around 19 years without NoScript and still have never at any time had any issues and none of my security software has detected or had to block anything produced by the Excite.com portal. I've seen a lot of these kinds of security "warnings" for well over a decade but again I can say without reservation that I've had absolutely no problems using this startpage portal and have everything I could think of at my fingertips thanks to the startpage portal.
The reason I was asking is that it appears their server is down and while waiting on a support ticket I was wondering if anyone else has the same issue.
-
@lakrsrool,
You seem to forget that yesterdays safe site can be today's infected site.
Maybe it's a good thing that the site is down at the moment.
I'd be more interested to know why it's down looking at the links
posted by Asyn.
-
I would add that I've always been amazed that so many people are not aware of the excite.com portal and use it. I can only surmise it is because some security sites issue warnings presumably of which there is probably not much really to it.
The SCAMadviser.com has Excite.com (http://www.scamadviser.com/is-excite.com-safe.html) as 100% safe.
Excite.com is currently SAFE on ALL of these sites: AVG Threatlabs (http://www.avgthreatlabs.com/us-en/website-safety-reports/domain/excite.com/), Trend Micro Site safety center (http://global.sitesafety.trendmicro.com/result.php), Norton Safe Web (http://safeweb.norton.com/report/show?url=www.excite.com), ranked 8 on URL void (http://www.urlvoid.com/scan/excite.com/) which is a relatively very good rating that combines 30 safety scans, wot has a "good" rating for Excite.com and I could go on and on with many more sites that rate this site SAFE. I know many people who have used it for more that 10 years and like and swear by it. I do not allow any third-part cookies on any site and take precautions no matter what I use, but I see no real issue as far as any real security threat using the Excite portal (like all things on the web, just take precautions).
-
Your computer your choice. We all make our own choices and have our own favorites.
I happen to like this one even though it's not my home page:
https://www.hubbley.com/app/ (https://www.hubbley.com/app/)
-
As I've said I find the portal indispensable as far as using the web. It saves many hours in the day every day I use it as far as navigating where I want to go on the web on a daily basis. The options available to the user to build the startpage are incomparable to any other startpage currently available, you can format it anyway you like and add virtually any amount of personal links you like. I would totally recommend it to anyone who is interested in making their life easier when navigating the web. Once the portal is built it offers the user a myriad of information and choices like non-other.
As far as being down, the last time was back in 2000 after a merger.
As to now regarding the current issue I've received a reply back from support:
Due to a server issue, the Excite website is unavailable for a small number of our members. We are working with our technical team to get this resolved as quickly as possible. Thank you for your patience.
So just as I figured, it's a "server issue". I was just wondering if anyone else might be able to offer input as to the situation with the Excite.com portal.
This only other time the site was down back in 2000 in didn't impact me, this is the first problem I've had with the Excite.com portal in the 20 years I've been using it going back to around 1995.
Thanks for the concern however. :)
-
Your computer your choice. We all make our own choices and have our own favorites.
I happen to like this one even though it's not my home page:
https://www.hubbley.com/app/ (https://www.hubbley.com/app/)
Thanks for that info Bob, Hubbley does looks pretty good, I appreciate the "heads up". I like the email feature, but not sure if it would work for me as I have over 25 email accounts I use for various reasons so I use POP Peeper to keep track of all of them in one spot. There's no question that the Excite.com portal has been around for forever and this does look like a decent alternative if I decided to change, but for now I'm still happy with my startpage as it is.
So why don't you happen to use Hubbley for your startpage?
What do you use?
-
Howdy, laksrool,
It is not a server issue, there is external links to a sneaky browser hijacker
(a pop-up ads virus downloader), see the Zulu Zscaler scan report:
-ak.imgfarm.com pop-up ads
Read also: https://productforums.google.com/forum/#!topic/chrome/6_GYsCwgeUg
This malicious link is there: htxp://ak.imgfarm.com/images/anx/anemone-1.2.7.js
with the follwing malware downloader: Worm:Win32/Vobfus.AJ
http://www.threatexpert.com/report.aspx?md5=27acb6d6188860e595103d288ddf319e
Your startpage portal has some cleansing to do. :D
polonus (volunteer website security analyst and website error-hunter)
-
Howdy, laksrool,
It is not a server issue, there is external links to a sneaky browser hijacker
(a pop-up ads virus downloader), see the Zulu Zscaler scan report:
-ak.imgfarm.com pop-up ads
Read also: https://productforums.google.com/forum/#!topic/chrome/6_GYsCwgeUg
This malicious link is there: htxp://ak.imgfarm.com/images/anx/anemone-1.2.7.js
with the follwing malware downloader: Worm:Win32/Vobfus.AJ
http://www.threatexpert.com/report.aspx?md5=27acb6d6188860e595103d288ddf319e
Your startpage portal has some cleansing to do. :D
polonus (volunteer website security analyst and website error-hunter)
Thanks for the input. The removal tool download says it's for Chrome, I don't normally use Chrome. So would this impact all browsers including FF?
Also I block "ak.imgfarm.com" but then that's with FF however using the NoScript FF add-on. On occasion I do have to use Chrome when financial sites do not work with FF or IE and so I guess the question is would this issue impact ALL of my browsers if because I used Chrome this has become an issue (because I do not have NoScript on Chrome of course)?
I have no other problems with any of my browsers (FF, IE, Chrome) as I can navigate fine other than the startpage fails to load. Excite.com support states that there is a "server issue" that is impacting a small number of users.
What I read regarding the Chrome removal tool is that besides the fact it is a "beta" application quote: "Google provides few details of what the Chrome Software Removal Tool actually does".
Have you used this tool?
Oh btw, I ran a FULL Avast scan a few hours ago and found nothing.
Addendum: Also this is impacting (startpage failure) all of our four household computers and 2 of those does not even have Chrome on them. The fact that ALL FOUR of our computers has the same issue and 3 of those we use very little would suggest that it is a "server issue" it would seem to me.
What do you think?
-
Why would you remove chrome when a website you use has a security risk ???
-
Blocking these issues in Google Chrome can best be achieved through toggling the marvellous HTTP Switchboard extension, one of the best extensions that recently came to the Google Chrome browser next to ScriptSafe, that blocks this.
Actually Google should have blocked this Adsense abuse from cyber criminals by following their Adsense policy, read: http://stayaway2.blogspot.nl/2014/04/malicious-google-ads-wwwmapsgalaxycom.html
But Google's preaching and Google's everyday's lenient practices are two different sides of the coin, often marketeers and the old god mammon win and flip the coin(s) up their side.... ;D
polonus
-
Howdy, laksrool,
It is not a server issue, there is external links to a sneaky browser hijacker
(a pop-up ads virus downloader), see the Zulu Zscaler scan report:
-ak.imgfarm.com pop-up ads
Read also: https://productforums.google.com/forum/#!topic/chrome/6_GYsCwgeUg
This malicious link is there: htxp://ak.imgfarm.com/images/anx/anemone-1.2.7.js
with the follwing malware downloader: Worm:Win32/Vobfus.AJ
http://www.threatexpert.com/report.aspx?md5=27acb6d6188860e595103d288ddf319e
Your startpage portal has some cleansing to do. :D
polonus (volunteer website security analyst and website error-hunter)
OK, I ran the removal tool and the results are that I'm "clean". If I had any "suspicious program" according to the "removal tool" they would have been listed and I would have been given the option to "remove them". So nothing at all was found.
Still looks like a "server issue" to me.
You would agree that if we have 4 computers with the same problem (3 of which do not even have Chrome) it would be more likely a "server issue". That said, I'm still waiting on Excite Support to get back to me on any resolution.
So I sure do appreciate any help just in case the issue is due to something else than what it would appear to be.
-
Blocking these issues in Google Chrome can best be achieved through toggling the marvellous HTTP Switchboard extension, one of the best extensions that recently came to the Google Chrome browser next to ScriptSafe, that blocks this.
Actually Google should have blocked this Adsense abuse from cyber criminals by following their Adsense policy, read: http://stayaway2.blogspot.nl/2014/04/malicious-google-ads-wwwmapsgalaxycom.html
But Google's preaching and Google's everyday's lenient practices are two different sides of the coin, often marketeers and the old god mammon win and flip the coin(s) up their side.... ;D
polonus
So then the "HTTP Switchboard" and "ScriptSafe" are Chrome extensions? I could use something like the FF "NoScript" for Chrome (when I end up having to use Chrome that is, since it seems like a lot of websites cater to Chrome at the expense of FF or IE).
How do they work?
ADDENDUM: Oh, btw - shouldn't Avast have found the issue (if there was one) using a FULL scan that I had run last night after this problem was present?
-
OK polonus, I've found "safescript" and "http switchboard" in the Chrome web store. I also found "umatrix" and "script blocker" in these categories as well.
I'll continue to look into them.
Any you recommend over the others?
Checking out the details and reviews.
-
Hi bob3160,
Here actually Google via Google's Adsense could/should have stopped this by blocking this criminal fraudulous BHO abuse. And we can only speculate why they didn't do so already after they cleansed 192 ad-injecting extensions recently.
But to go and uninstall a browser because you insist on visiting a website with infectious external links is weird behavior and over the top, "I want this now and instantly and when I cannot get what I want I use another browser!". Even will consider it as a server issue because I won't assume my favorite start page has a malicious browser hijacker link that was not seen for what it was. Why users have MBAM and SAS and adblockers, because often these craploaders are being tolerated because the money they generate is money and the browser user is the product. I repeat this is no browser issue and that website is malicious as Zulu Zscaler scan insists - the infection is not browser dependant. The website is fine minus these two external links. Believe me I have seen thousands of such links in the last years I do cold reconnaissance website analyzing.
Avast does not alert these issues as this is Adware just like some bundled download crap is not being alerted outside PUP mode.
But Google should alert because it is a breach of their Adsense policy terms, but they condone these practices when it is put out before the end-user first in whatever obscure way. I do not like my browser settings being altered >:( without permission.
Excite com should not want to be associated with BHO links either!
polonus
-
Just noticed this with the HTTP Switchboard quote: "From now on, it is suggested to install µMatrix instead: https://chrome.google.com/webstore/detail/%C2%B5matrix/ogfcmafjalglgifnmanfmnieipoejdcf"
So what's up with that?
I don't get it, recommending in the HTTP Switchboard to use another extension instead? ???
-
Hi laksrool,
Same issue as with Disconnect. Sometimes new extensions function better or have a wider action range.
Whenever the extension developer suggests this, it is best to use the latest version of that new extension.
Just like uBlock is better than Adblock Plus as it does not show ads that Google paid them to circumvent,
or Bing or Yahoo for that matter. Wladimir Palant's extension has an independant bureau in Germany,
that makes an awful lot of money by not blocking certain ads from Big Commerce like Google, Bing and Yahoo
to mention just the top three.
polonus
-
Blocking these issues in Google Chrome can best be achieved through toggling the marvellous HTTP Switchboard extension, one of the best extensions that recently came to the Google Chrome browser next to ScriptSafe, that blocks this.
Actually Google should have blocked this Adsense abuse from cyber criminals by following their Adsense policy, read: http://stayaway2.blogspot.nl/2014/04/malicious-google-ads-wwwmapsgalaxycom.html
But Google's preaching and Google's everyday's lenient practices are two different sides of the coin, often marketeers and the old god mammon win and flip the coin(s) up their side.... ;D
polonus
So then the "HTTP Switchboard" and "ScriptSafe" are Chrome extensions? I could use something like the FF "NoScript" for Chrome (when I end up having to use Chrome that is, since it seems like a lot of websites cater to Chrome at the expense of FF or IE).
<snip>
For Chrome browser I believe it is called NotScript add-on and works in the same way as NoScript.
-
OK, I see the "HTTP Switchboard" extension is the predecessor to the "uMatrix" extension that are offered by the same developer. So far uMatrix looks good.
-
Hi laksrool,
You do not have to use Google Chrome. Same extensions also work on the Sleipnir6 browser.
When you use Sleipnir (the top Japanese browser) in your part of the world,
you have less exposure as malcreants are more familiar with Google Chrome.
Just a suggestion.
On the other hand I always use Google Chrome inside sandboxie and
after 5 days I cleanse to start a fresh sandbox install from exported bookmarks and settings.
Works fine for me and is quite quite secure.
The remainder of the laptop is cleansed with CCleaner once in a while.
Cannot remember an issue here.
pol
-
Why would you remove chrome when a website you use has a security risk ???
The removal tool (https://www.google.com/chrome/srt/) is to scan for problems with the browser and remove them if there are any, not remove the Chrome browser itself.
-
But just at this point the Google removal tool won't help you. That is modern marketing policy for you.
That is the respect they pay to the end user and his privacy. It is non-existent and that is why what you do using their browser is still free!
You live in the days of everybody wanting to earn on those ad-bundling dollars, and jumping that band-waggon.
Not fifteen years ago.
This is the new legit and illegit industry and Google has turned a blind eye there.
Money is money whatever the clicks that generate it.
Be it benign adclicks or adclicks that will ruin the computer settings of the end-user.
That is the acctual factual situation we live in and you yourself have to bring the tools into position to block the developers and marketeers that want to score cheap money on unaware user clicks from doing what you do not want.
Come on, we aren't Ripp van Winkles that been sleeping under a stone.
polonus
-
polonus, so if my results using the "software removal tool" you suggested for me to use is "no programs found" then I should NOT have any concerns about what you referred to previously regarding a "sneaky browser hijacker" (a pop-up ads virus downloader)" as reported by the Zulu Zscaler scan report: -ak.imgfarm.com pop-up ads, RIGHT?
So then I'm "clean" in that regard?
Your more knowledgeable in the area of computer security than I'd ever even dream of knowing even if I had another entire lifetime a lot of which I have no idea what your talking about unfortunately, but I certainly do appreciate the help concerning what doesn't go right over my head. ;)
There is so much on computer security it is overwhelming for me as to what is the best way to go. Maybe I'll try the "uMatrix" extension as it's got good reviews.
-
WOWEE, AM I A HAPPY CAMPER!!!
The Excite.com portal is BACK UP!!
Presumably their "server issues" they said the were having in a limited area has finally been solved. YAY!!
I am so glad it's not an infection issue, but then I couldn't see how it could have been impacting the Excite startpage for all of our 4 household computers all at once most of which we don't hardly use at all.
I'm good again. ;D
-
Sorry, but some folks just seem perfectly happy wearing their blinders even if
the dangers have been pointed out to them.
Good luck and enjoy your homepage. :(
-
bob3160, in case you're interested because you were kind enough to refer me to another startpage option.
Attached is just a very small fraction of my ExciteStartpage which amounts to far less than just 10% of the entire page. The page includes daily reminders, as I said literally 100's of bookmarks, news literally from any source you can imagine, quotes of the day, on this day, emails, dictionaries, words of the day and on and on like this, along with weather from as many locations as you want from anywhere around the world as well as searches, cartoons, games, news paper links from any where around the world, top box office, favorite columnists, movie listings from anywhere you set it up for, TV program reminders, entire TV schedule for any area you want that can extend for the next three weeks or more and on and on.... The startpage seems virtually limitless in size and what can be included.
Like I said this attachment represents less than 10% of the entire page, but gives you a taste as to what you can do.
Addendum: I decided to add a second attachment just showing part of the TV listing that can be searched for the 3+ weeks.
-
Sorry, but some folks just seem perfectly happy wearing their blinders even if
the dangers have been pointed out to them.
Good luck and enjoy your homepage. :(
I've been using this startpage since 1995 like I said (20 years now) and I've never had an infection due to it, not even now as it turns out it WAS a "server issue" obviously.
I'll go with 20 years of no problems considering the efficacy of the start page. I suppose there are so many ways to get infected, I'm just going to be as careful as possible and use as safety measures such as Disconnect, NoScript, APB along with Avast, windows defender and Spywareblaster and hope for the best.
I've learned a lot as to what I can add to the Chrome browser (even though I rarely us it) because with all of the discussion here it became a concern for me.
But as it turns out, no infection, just a "server down" is all I've had problems with for now 20 years using the startpage, not a bad record if you ask me. ;)
Considering I don't likely have another 20 years, I'm good. :)
-
I can get all of that with the website I posted but it doesn't have any security warnings.
I don't use it as my home page because I don't have the time to wait for all that stuff to load. :)
-
I can get all of that with the website I posted but it doesn't have any security warnings.
I don't use it as my home page because I don't have the time to wait for all that stuff to load. :)
Mine loads completely in 10 seconds, tried it twice just now in FF both times the same. I can live with waiting 10 seconds for the advantages of having everything I need at my fingertips.
Like as said, however, I do appreciate your recommendation. You ought to try the one you recommended Hubbley or something like that.
As to the risk with my page, I block everything with NoScript except the domain name itself, so for what it's worth I presume I'm safe. Besides that I posted a number of security check web sites on the first page that all say my start page is SAFE. While maybe they are all wrong, I think just using the startpage every time I go on line for 20 years and without any issues is a record that sort of speaks for itself.
You'd probably be the first to say you can never be sure, you might try Hubbley and get infected in some way the first day, who can be sure?
All I can say is that while I'm sure there are risks with almost any thing you do on the web including my startpage, the 20 year record of not having any problems as a result of the startpage at least helps relieve me a little of all the anxiety you have raised in me with your well intended warnings (of which I do appreciate). :)
-
The actual warnings didn't come from by but through others pointing you to links that showed the dangers of using
what you seem to want to promote.
I think you've gotten all the answers and warnings. Heading them is up to you. It is your computer.
I'm finished with this topic which has gone way beyond it's needed length. :)
-
Hi bob3160 and laksrool,
Going into denial mode won't work here as there is now another malicious external link detected via the latest realtime Zulu Zscaler scan: htxp://imgfarm.com/ex/excite.ico link Malicious
Two detections here: https://www.virustotal.com/nl/url/fac24ba63f394f55a623b8bc4e1a3c138501b35dde24aa3b399a231b3d23a12e/analysis/
Weight Watchers tracking going on.
WOT flags this with two reds: https://www.mywot.com/en/scorecard/imgfarm.com?utm_source=addon&utm_content=popup
Listed at Malware patrol.
Phishing and Scams galore!
This one has not been cleansed yet: htxp://ak.imgfarm.com/images/anx/anemone-1.2.7.js script Malicious
Verdict the website staff at Excite dot com should clean up their act and protect their visitors from clicking such external links period.
@bob3160 - what more arguments do we need to find to warn to shun that site until the scan reports come up crystal clear?
@laksrool - do not defend these actors on your favorite start page but abuse mail them that there are malicious external links detected on their website. One of the website they link to carries the risk of infection with viruses/‘driveby’ downloads/Trojans/backdoor bots, rogue programs (PUP’s) :o If their website was attacked and hacked, it is their responsbility to mitigate that threat.
polonus
-
polonus - I've added Umatrix to Chrome, which I frankly don't understand at all how to use it and what it's doing is disabling all useful icons and illustrative images on my page.
I'm no different than the next guy and of course by all means want to stay safe, but if it means disabling a website to the point meaningful icons and other images that are frankly inherently necessary to the web page, then there must be a better way.
I always had "NoScript" block "imgfarm.com" in FF (since adding Noscript about 8-10 months ago) and I have a useful load of the page with all necessary icons and images loading just fine.
The way the page looks in Chrome using Umatrix, while undoubtedly safe it frankly looks like crap and much of the page cannot even be used appropriately by the user.
I tried the "Scriptblock" Chrome extension and it's even worse seems like it's either all or nothing, block the entire website or don't block anything at all. As to "Scriptsafe", the reviews weren't that good many of which complained that it's not nearly as effective or workable as the FF "NoScript" that apparently is an extension that Chrome offered at one time but now no longer offers.
If I could figure out how to have all of my icons and images load using Umatrix, then I'd go with that extension, but I can't see a way to accomplish this using this extension.
I've enabled it because you've got me so paranoid (even though, I've never had any infections using the page for 20 years now).
At least, the fact that I usually only use FF helps since it works well with "NoScript".
-
OK, looking into it further, it is the "ak.imgfarm.com" site that Umatrix has to allow for the web page to be reasonably useful. So I see the problem. What is interesting is that "NoScript" is blocking "imgfarm.com" but apparently must be allowing "ak.imgfarm.com" because all the necessary icons and images do display in FF using "NoScript" and we find that "NoScript" doesn't even provide a way to block "ak.imgfarm.com" apparently as this is not listed.
What I also find very curious is that when checking Excite.com using ScamAdviser (http://www.scamadviser.com/check-website/excite.com) Excite.com comes up 100% SAFE yet when you check individual elements of Excite.com i.e. "ak.imgfarm.com" using ScamAdvisor (http://www.scamadviser.com/check-website/ak.imgfarm.com) it comes up the exact opposite 0% SAFE
So I have a question, what is the method that this "malware" infects ones computer?
Thanks to polonus providing valuable information we find out that "http://imgfarm.com/ex/excite.ico" is rated as "malware" on the Virus Total (https://www.virustotal.com/nl/url/fac24ba63f394f55a623b8bc4e1a3c138501b35dde24aa3b399a231b3d23a12e/analysis/) when checking this site.
So what would mean is that I've been using a startpage that is essentially a product of "malware" because these images have been a part of that webpage since it's inception. So based on this every time I've been on the Internet I've at all times always had a "malware" site on my computer the entire time I've used the web (and on the web probably 8-10+ hours a day).
So then since I've never been infected, or at least I see no ill-effects and the "software Removal Tool" for Chrome found nothing, how is this possible?
Or are we talking about a "potential" risk via an attacker that can exploit this "malware" website so it's just a matter of luck.
I ask because I've always thought in terms that a "malware" site is something designed to inherently attach the computer as this the the purpose of the "malware site".
But if it's instead a risk of a hacker exploiting the site because it is easily hacked then can't security applications prevent this from occurring i.e. AV applications and/or Firewalls etc?
Bottom line, I've never considered myself very lucky in the least, and if I've been using a website that amounts to essentially "malware" for 20 years now it frankly seems odd that I've never had a problem all of this time.
-
@all reading this thread,
About the use of Umatrix. The issues that should be blocked are blocked as by default in the extension. Sometimes you should unblock certain red marked default items to get full functionality of a particular page (consider the risk involved and jump when you think you can leap) - the great thing about the extension is you can additionally block items on the website after you have made a decision what should be additionally blocked. Just like with NoScript you should know where and how to grant access (allow). For advanced users you get almost complete security control that way - as all scripts are also being blocked by ScriptSafe by default (allow what you need for functionality on a known potentially secure page). When in doubt report here in the forums and we will find ways to give you some full report on what security/insecurity status a page has (at that moment) to the best of our knowledge from third party cold reconnaissance scanning results. For this Avast forum page where I add this posting in this very thread unblocked is forum.avast.com with 1 cookie, 1 css, 43 images, 2 scripts (green).
Blocked by Default is the tracking from google on google-analytics dot com and 1 script from www.google-analytics.com (a script you may allow as avast uses the info for user protection info purposes, while on the other hand google sits on that very data heap). :D
You want facts about in-browser security and how to bring that forward, we try to give you these facts from our years of experience as a volunteer website security analyst (with profound thanks to all here that help me achieving this, and those that do know who I mean here).
polonus
-
Absolutely correct that just about any website on the net will need a good portion of adjustments made using various script blockers just to get the site to even work at all.
A good example involves just the simple website "mapquest" which if using "Umatrix" will need 9 scripts enabled just so the website works that are blocked by default using "Umatrix" and of course unless you want to always have to enable these 9 scripts every time you use "mapquest" when you find it's not working at all you'll want to "lock" this "temporary" setting in for that site (scope) so next time the site works up front. Obviously it can be very time consuming surfing the web just to try and be safe and to be honest far to daunting for the "casual" user, but that's the way of it unfortunately. There is frankly a lot of trial and error just to find out what needs to be enabled and what doesn't need to be enabled as far as all the blocked items.
After awhile you get to the point you want to just enable them all for the time being to just get done what you want done at the time. This is to some degree the advantage using the FF "NoScript" which allows the user to either "temporarily" enable specific items but more importantly as risky as it might be when sites have literally dozens upon dozens of blocked sites the user can "temporarily" enable "all this page" with just one click which of course is not necessarily very SAFE and as such probably not advisable but at times I find myself doing this now and then just to accomplish something I need quickly in the knowledge that the setting is just "temporary" and will revert back later. Of course on can enable all the sites in "Umatrix" but it's more time consuming because each needs to be enable individually in groups, which in some ways maybe arguably better because it conceivably forces the user to be more safe with less global automation at their fingertips. The Chrome "Umatrix" does have a nice feel about it as well however. I also find that "Umatrix" will default a lot as enabled so in some cases websites will be more functional than other script blockers that block everything from the start by default, but then safety is the trade off I suppose. All this security frankly takes a lot of fun out of surfing the web for the "casual" user which clearly makes these script blockers seem annoying to these these type of users not to mention totally confusing in many respects as well.
I would add one last thing that's nice about the FF "NoScript" and that is the user can "middle click" any blocked site and get 6 different security reports on that site which can then be "enabled" or not on that page which is a helpful feature provided by the FF "NoScript". Also even if you want to Allow "all scripts globally" (not at all advised), or your just Allowing "all this page" for the time being "NoScript" still retains several areas of security anyway like in the case of Anti-XSS protection, HTTPS enforcement, Clickjacking protection and ABE which are all still in effect regardless which is another helpful feature of the FF "NoScript".
-
First and foremost, script blockers are good instruments in the hands of those that know what sites to block or rather keep blocked and NOT use the full functionality there. The rule should be leave all blocked until proven to be secure to unblock or known to be safe.
And how would one know where one could toggle and where not. There are many indicators as where to not venture out. I see a site alerted by Google Safebrowsing and/or Yandex blacklisted, I am interested to know why (that is why I do what I do), but I decide to not go there directly or circumvent the Google blocking, also when Google says my connection is not private and attackers try to intervene, I won't go out there and nicely keep such sites blocked. ScriptSafe red, Umatrix enabled. Lift third party links only if you know these sites to be clean, curiosity killed many a cat.
Now sometimes with a clean site we have to allow some additional functionality to make that site function. At urlquery net for instance you have to allow google-analytics.com else you will not get the scan results. This Norse scan site may have issues as I find: HTTP Server: Apache HTTP Server 2.2.22 (Outdated)
Operating System: Ubuntu 12.10 (Quantal Quetzal) (Unsupported)
PHP Version: 5.4.6-1ubuntu1.8 (Outdated)
This indication does not need to be the final word as some website admins put out an outdated server version to mislead eventual attackers. But on all instances it is a better server policy just to make the server header version and other extensive info is not spread globally and to hackers, and whenever a website or server admin knows what he is doing he knows how to adjust his server configuration. Alas many do not, are incompetent securitywise and this means a threat to the website visitors and themselves. There is more to this than one would think. Whenever I see a warning for a website because of malware, scam, fraud, phishing from WOT and very much when there is a user report from someone who knows what he/she is reporting or from third party listing (malware resources) I won't even consider visiting such a site. Red ball from Bitdefender, don't even try to go there, DrWeb URL link checker detections, a big no-no. Sites on their malicious website list, do not venture out there.
And the Avast block when malscripts are detected has not been equalled by none, it is very accurate. Blocked do not go there.
When you want to know why - ask in the virus and worms section and some of us may know.
There is a remote chance of FPs but as a rule I only visit and allow non-flagged websites. And always remember the clean site of one minute ago can be the malicious site of the next minute. There are much more aspects to this, but the above is a good thumbrule for many that are advanced users and want to use script blocking and request blocking.
polonus
-
Just a difference I have found with uMatrix and HTTP Switchboard is that uMatrix won't any longer block Google Analytics on certain sites. The same issues why I would prefer uBlock over ABP adblocker. Some developers agree to Google tracking circumvention in order not to be confronted with Google disabling their extension, banning them from their store because they interfere with their main income frame. My tip use both extensions HTTP switchboard next to uMatrix.
On androids Google even went so far as to disble ABP apps completely, as they felt they had enough monopoly to enforce such a protective measure.
Again the install of uMatrix is only a suggestion. Not a lot savvy users would consider to re-think where this suggestion stems from. This is also the reason that NoScript could never come to Google Chrome as google would not allow the developer enough access to make it function on Google Chrome (api-layer access that is). Protecting your privacy and take anti-tracking measures gets harder and harder to perform and the average user has long lost that battle. Who, like I do, is blocking canvas fingerprinting on youtube sites? Yes, Google performs sneaky canvas fingerprinting there, which is not very accurate but combined with other tracking, ad-tracking and widget tracking is quite effective. There is an extension to block this, but I guess not a lot of users have it installed. So the going gets narrow, folks.
polonus
-
Why are we getting totally off topic ???
-
Hi bob3160,
We are not totally off topic as we explain what are the security risks involved with visiting the Excite dot com portal and what extensions we can use to be fully aware of those risks and block the links we want to exclude. First we established that the excite com start page has issues and third party links that we should block, then we explain to the readers of this thread how to protect themselves from inside their browsers and that needs some explanation to do. Those that aren't advanced enough to use script blocking and request policy toggling should leave this thread for what it is.
polonus
-
As long as there are security risks in using the Excite.com startpage,
The average user should simply avoid it.
Please realize that most visitors here are Average Computer Users..... Not Geeks. :)
-
@all,
Ok, do not go to that start page portal until the issues mentioned there have been settled.
polonus
-
Why are we getting totally off topic ???
Well first of all because it might be helpful to some. Why not expand the topic if it's helpful? After all this is a "general topics" board, right?
But if you want to make a point of what's "off topic" you might note that I was simply asking if anyone uses the portal discussed and this was in relation to the fact the servers were down at that time.
So based on that the third post which was yours and every one of your specific posts after that were technically "off topic" if you think about it.
But then I didn't mind at all, I personally considered all posts helpful and informative regardless and I would venture to guess it would be helpful and informative to anyone else that interested enough to want to read it as well.
And of course the key phrase here is "want to read it", anyone that doesn't want to read it doesn't have to and won't.
On the other hand, others may find it helpful and be interested in reading it. I see no problem either way (I would hope you wouldn't either).
As long as there are security risks in using the Excite.com startpage,
The average user should simply avoid it.
Please realize that most visitors here are Average Computer Users..... Not Geeks. :)
For those who do not want to read it, then don't, "Geeks" aside.
But for those that might have an interest in reading it then what's the problem?
Is this an information/help board or not?
I have to wonder why the concern about who should or shouldn't be reading anything on this board.
And I would add, what's the point of placing any limits on a "general topics" board anyway?
I can't see any harm in putting out information regardless of who may or may not be interested in reading what's been posted.
I personally welcome a free and open conversation without imposing limits based on the perception that some may not be interested.
And I must say that I find it ironic to even raise this type of concern (especially in a "general topics" board) when as we know we will find more specific Avast issue topics that are sometimes not answered directly but instead the posters motives might be questioned to the extent that the issue raised is alleged to not even be legitimate.
In this case, I personally find all the information provided in this topic related to some extent and very helpful for the most part and I appreciate and thank ALL who have contributed including you Bob. :)
-
polonus - I want to thank you for all that you have contributed to the topic and I would add that you certainly do not need to apologize for posting tangential "security issues" that are not only related to the topic on that basis but clearly very helpful. And I would add that if we bother to notice the very first response to the topic was based on "security issues" clearly tangential to the topic, but again undoubtedly well intended and helpful. I would suggest to NOT offer the additional information related to "security issues" would be improper. So THANKS VERY MUCH for all that you have contributed as I personally found it all very interesting as I'm sure others did as well (and I'm not what I'd consider a "Geek"). :) Offering up information such as this is the way we all learn more and on that basis there is clearly nothing at all wrong with that.
-
polonus - I did have a question if you happen to venture back here. You said quote:
Now sometimes with a clean site we have to allow some additional functionality to make that site function. At urlquery net for instance you have to allow google-analytics.com else you will not get the scan results.
As I see it this could be problematic because from what I understand about the FF "NoScript" if you "allow" something like "google-analytics" then it is "allowed" for all sites that might have "google-analytics". So while I understand the need to get a site to work but then in doing so is it opening the door for problems with other sites?
I've not allowed "google-analytics" so I've obviously not had the need by using "urlquery net", thus "google-analytics" remains not allowed when browsing.
On that point, I'm not certain how the "lock" used in Umatrix works. Umatrix says it's saving all temporary changes for this "scope", so perhaps that means ("scope") that specific website. If that's the case then that's a good thing, but as I understand it with "NoScript" allowing applies to all sites or am I wrong there?
Also you've mentioned quote: Red ball from Bitdefender, don't even try to go there
... what exactly is that about?
One last point, in ABP wouldn't unchecking "All some non-intrusive advertising" then eliminate "google-analytics".
It's really a shame how Google is infiltrating themselves into everything leaving users with increasingly less alternatives all the time. A big reason I prefer to not use Chrome personally and stick with FF as my primary browser. Unfortunately I've been noticing the FF user base is continuing to dwindle at the expense of the every growing Chrome. Unfortunately people either don't care or just don't pay attention. That's the problem we have in politics as well in regards to the "low information" type people. Speaking of "off topic", now I'm REALLY "off topic", so I'll end it here. ;)
-
I'm no different than the next guy and of course by all means want to stay safe
Yes you are different and you do not want to safe. Let me state some facts:
- You are still using avast 2014 and refuse to update to 2015.
- You have posted many times here giving people who are seeking help false and outdated information.
- You are using a account with administrator rights for daily use on your system.
- You are refusing to listen to people when they are giving you real good advice when it comes to security.
- You keep posting long post without saying anything useful in them.
-
Hi laksrool,
Just a reply to your question (and for those interested in the workings of the uMatrix extension for Google Chrome).
The answer is "no"", and this is the unique quality of this amazing extension - that this is on a per page basis. Click all and you click all allowed for the time you are on that page within one session with the browser.
Next time you can make another decision and the toggling goes on as on a per page basis. So if google analytics is allowed on avast forum site, it still is being blocked on https://www.security.nl/ for instance, where you again have to allow it when you go there (open that page) when you want to unblock - a red small corner is all that is left of the initial original settings. So really a unique concept and also blocking frames on a page until you allow them with one click. So you just have to consider the settings of uMatrix in combination with ScriptSafe to get the functionality you need within that session (lest the sites you visit were established as secure). Just ponder on this txt and let it sink in, this is quite some added security, because where scripts cannot run and clicks can not have effect infection cannot take place period. It is just like driving a car, when you know what to handle you are "on your way" in a safe and secure manner, and it is not that hard to learn when you use some common sense and know what sites to avoid in allowing functionality (sites that WOT flags, that Bitdefender TrafficLight flags, DrWeb's URL checker flags, Google Safebrowsing or Yandex alerts and blocks and those alerted by Avast Shields and Web Rep naturally.
Another bonus - while doing all this you learn an awful lot of what is on a website (under the hood) and where to watch out.
polonus