RequestPolicyContinued / requestpolicy

a web browser extension that gives you control over cross-site requests. Available for XUL/XPCOM-based browsers.
https://github.com/RequestPolicyContinued/requestpolicy/wiki
Other
252 stars 35 forks source link

Feature Request: Quick Link to WOT or other Safety Search #456

Closed RobotManager closed 8 years ago

RobotManager commented 10 years ago

I'd love if there was a way to check domains with a single button click.

With NoScript you can click on the middle mouse button or the mouse wheel on an entry and it will automatically send you to a NoScript page full of information. This page not only links directly to the domain in question, it also provides links to security and privacy sites (Web of Trust, McAfee SiteAdvisor, Webmaster Tips, Safe Browsing Diagnostic & hpHost Report) and it also lets you allow that domain directly from the page should it appear safe.

With NoScript I can easily make several tabs for any domains I need to investigate, investigate them and then allow them from those tabs should I wish. It's a much easier and simpler process.

nodiscc commented 10 years ago

Noscript calls http://noscript.net/about/llnwd.net;llnwd.net for info about llnwd.net. I think the resulting page can be built locally fairly easily instead of calling a remote server. All in all it looks like a good idea but the particular info providers listed by noscript are not very useful to me (WOT, McAfee SiteAdvisor®, Webmaster Tips, Google Safe Browsing, hpHost).

What should be considered a good source for privacy/security info on a site? (I was thinking about https://tosdr.org/ but not many sites there)

UI 2 cents

RobotManager commented 10 years ago

I primarily use WOT (Web of Trust). It's been really useful in my experience to quickly determine which domains are primarily used for tracking, advertising, malware etc. It occasionally has issues with things like mass ratings that might give raise false flags, but those are pretty rare and are pretty easy to determine by reviewing the comments.

As long as WOT is included in any such list, I'm happy. I rarely if ever click on the remaining sources in NoScript. On the rather infrequent time WOT doesn't have the info I'm looking for, I use the NoScript page to launch the site directly and failing that I'll resort to simply Googling the site. Often that will bring up similar queries and allows me to determine if I trust the site or not. So maybe adding an option to Google a domain would be beneficial as well.

Since I've got a feeling each user might have a somewhat different lists of what privacy/security sites they prefer, perhaps some sort of customization would be a good idea. Something where you could perhaps select the sources you find useful from a list or possibly enter your own. I'm not sure how hard something like that would be to implement. Pretty much anything that keeps me from having to hover over Request Policy to try and remember or write down domains to then search on WOT or Google would be a win in my book.

nodiscc commented 9 years ago

After checking some sites that provide security/privacy ratings for domains, I think myWOT provides the best service. It aggregates user ratings and data from antivirus vendor malware scanners (norton, google safebrowsing, mcaffee...). Linking to the myWOT page should be straightforward, see for example https://www.mywot.com/en/scorecard/mxpnl.com

Clicking on the Get more info link should open another tab with a chrome: page that clearly warns that you're about to send your info request to a third party site.

You're about to request reputation information on example.domain.com from the MyWOT online service. MyWOT will be informed of your interest in this domain. [I agree] [Take me back!]

nodiscc commented 9 years ago

You're about to request reputation information on example.domain.com from the MyWOT online service.

As requested in https://github.com/RequestPolicyContinued/requestpolicy/issues/336, the example.domain.com in this sentence should actually be a link to example.domain.com.

akwala commented 9 years ago

Please note the following from #336 as well:

I would like to see this item regardless of the current Forbid/Allow setting for a destination, since I do find myself reconsidering my prior choices every now and then.

nodiscc commented 9 years ago

I think this would be the most important change to help users contributing to the subscription lists.

I'd like to add more rules to the current subscriptions (particularly deny_trackers) and sometimes visit pages that do a lot of cross-site requests. Check http://www.speedtest.net/ for an example. Without a link to the WOT rankings, or a direct link to the blocked domains, I have to enter these URLs manually and decide for myself if these domains deserve inclusion in the deny_trackers subscription. This takes a lot of time.

@myrdd what's required to add this to the menu? Is it a complex change? I've tried a few hacks to add a direct link to https://www.mywot.com/en/scorecard/$domain to the menu but this is way over my head... I'd highly appreciate it if it could be part of the next release (the UI draft for this is in https://github.com/RequestPolicyContinued/requestpolicy/issues/601). If you can patch this I'll have a look at your commits to get a better understanding of how the menu works.

Finishing the website next week

myrdd commented 9 years ago

Yeah, the code for the menu is hard to understand. I'll take a look at this. I'll probably implement it on a separate branch, and WOT will open with middle click.

The "Get more info" button you describe would be slightly more work:

Clicking on the Get more info link should open another tab with a chrome: page that clearly warns that you're about to send your info request to a third party site.

:-)

myrdd commented 9 years ago

@nodiscc please take a look at commit 4c7420d (the issue-456-test branch). Middle-clicking on origins and destinations should open a new tab.

nodiscc commented 9 years ago

Very nice, thanks! It will speed things up. Do you think it needs a warning page as described in https://github.com/RequestPolicyContinued/requestpolicy/issues/456#issuecomment-62589476 ?

myrdd commented 9 years ago

@nodiscc I think that the user should be informed about the request to the external site, but still, it should be possible to disable that message. When the message is disabled, the myWOT page is opened immediately, which speeds up the workflow.

The message could be like for NoScript, see here:

You're about to ask for information about the "%1$S" site\nby submitting a query to %2$S.\nDo you want to continue?

About how to access the page information: I think it should be possible via middle-click. I'm not sure if a link like "Get more info" is appropriate; it would make the menu bigger. On the other side, more users would discover that feature.

myrdd commented 8 years ago

The dialog I've been talking about will look like this:

site-info confirmation dialog

nodiscc commented 8 years ago

:clap: I think this is a great improvement. Should I add it to the doc?

myrdd commented 8 years ago

Yeah, finally it's merged :) I guess I'll create another pre-release this week.

Should I add it to the doc?

That would be great! :) You've got the best overview over the docs I think.