A Web Browser Plugin for Users' Security Awareness

We looked at existing solutions for the web browsing security and awareness and identified the below tools. Mainly we noticed that there is no solution that provides high accessibility and clear relevant information about the website security. The found solutions were focused either on the accessibility or the informative side.

The most popular solution on the Chrome extension store is the Avast Online Security Checker [16], judging from the higher number of downloads, reviews, and its very high average rating. This solution is highly accessible as it is very easy to install and run on the browser. The plugin gives a very simple website rating (either good or bad) with a single line of text and a unique thumbs-up graphic, with no further information on how the rating was done. The second most popular Chrome extension is the WOT security scanner [17]. The WOT has the same level of accessibility as AVAST, but with a rating system based on users’ reviews, where most websites do not have enough up-to-date reviews to make the rating reliable.

Another interesting solution is SSL Trust [21] which is a website-based tool. It takes time to scan a single website but it provides a good range of information for the scanned website, like network protocol checks, secure connection certificates, vulnerability detection, and malware and antivirus checks. Google Safe Browsing is a feature embedded into Chrome. It tells the user if the certificate, resources, and connections are secure. Its website version is the Google Transparency Report [7]. The website solution gives instant feedback, but like the extension solutions, it gives only a single indicator of whether a website is safe or not.

Pentest Tools [20] can be considered as an alternative to the above solutions. This set of tools is not very accessible but provides a good range of information. The website can analyze a URL to find possible vulnerabilities and provide an overall security assessment for users who may not understand the technical jargon. Browser Audit [2] is another solution that mainly focuses on the actual browsers’ security information. IPQualityScore [1] is another third-party API that provides a similar solution. This API provides information about recent malware, phishing, and spamming attacks relating to that website.

Our plugin solution is composed of the client-side Chrome extension and the back-end server. The plugin architecture is shown in Fig. 3. The developed front end of the API consisted of a JSON manifest, a background JavaScript file, and an HTML file for the display. The client-side communicates with the server via web socket, sending JSON messages to each other. The server uses a web socket connection to communicate with an SQL database that stores the security information collected.

We show in Fig. 4 the entity-relationship diagram of our database. Every time a new scan of a website is completed, we automatically add the following records to the database, in case they do not exist in the table:

• A new domain;
  
• A new link - this record also contains the test results for that specific link;
  
• A new script - this record also contains the test results for that specific script;
  
• A domain entry with all the test results and a bit of background information;
  
• A link entry with the associated domain entry ID and link ID;
  
• A script entry with the associated domain entry ID and script ID.
  

We implemented a basic Chrome Extension, that required a manifest, a user interface, and a service worker. The data were collected every time a new website was loaded, refreshed or the active tab was changed. We collected the data through the built-in HTML commands for the window and document objects to collect information such as the path, domain, and URL protocol. We used the document objects to get the raw HTML of the website to be used for the server scanning. Furthermore, we used also the Chrome Developer API to collect other data about the browser and the cookie data stored in the browser.

We collected information about the browser security every time we ran the service worker. This information does not provide the same level of results as the Browser Audit API, but it still provides a good overview of how Chrome itself tries to reduce risk. Below we provide parts of the API that are used to access this information. In Table 1, we present the performed tests, with information about what we were looking for and why.

• chrome.privacy.services.autofillAddressEnabled
  
• chrome.privacy.services.autofillCreditCardEnabled
  
• chrome.privacy.services.safeBrowsingEnabled
  
• chrome.privacy.services.safeBrowsingExtendedReportingEnabled
  
• chrome.privacy.services.doNotTrackEnabled
  
• chrome.privacy.services.hyperlinkAuditingEnabled
  

We then move on to collect cookie data from the browser, which usually has a lot of attributes that can be used to detect vulnerabilities. This data is filtered, to send to the server only information about the current domain.

We run various tests on: the scripts for the server, checking for different vulnerabilities; the cookies’ security and their timeliness; and the HTTPS protocols, to check if the website uses the HTTPS protocol. We check if the website contains comments in the source code, as comments could contain sensitive or confidential information, and check if the links of the website directs to a secure location using HTTPS protocols. We used two third-party tools: Google Safe Browsing was used to know if the provided URL was considered safe by Google or not, while IPQualityScore provided further information e.g., valid DNS, URL associated to spamming, malware, viruses, or phishing attacks. After the various tests have been performed, the results are sent to the database to record the domain, scripts, and links with entries relating to all the associated files for each scan. Finally, our plugin calculates the results and shows them when the popup is opened. The results are shown through the security rating ring, and are split into three sections: overall information, first-party results, and third-party results. The results of each test are shown as either true or false. The score is calculated by counting the number of correct scores, getting a percentage, and then relating this information to an arbitrary grade to display.

We tested our solution on various websites to evaluate the provided results and answers. In particular, we present below a list of some of the websites that we used to test our plugin, with the rates provided by our solution and some explanations as to what we expected.

• University of XX website: We are fairly confident with the security of the website and is not a website you can log in to so there is a little avenue for an attack. Thus, in this case, we were expecting an A score, but the website did not passed some of the security tests. The provided grade was B+ while the score 82.14%.
  
• Twitter: A website with very high traffic and likely a very varied demographic. We were expecting it to be incredibly secure due to its popularity and reputation, but it did not passed all the security tests. The provided grade was B while the score 78.57%.
  
• cryptwalletimport.com: A website found using a fraudulent websites blacklist. Our solution rated it at a low C+ grade, as we were able to detect recent phishing activities. The provided grade was C+ while the score 67.86%.
  

For our study, we recruited 21 users with different backgrounds, who took part in our study, tested our solution, and answered our survey. The users had different levels of education, different ages, as well as different level of security and technology experience. For the usability study, we also applied for ethical approval following the Institute guidelines (the approval is kept on file).

We divided the survey into four main parts: the consent and participation form, the internet browsing habits, usage of existing solutions, and rating of the existing solutions compared to our solution. In our survey (see Appendix A for details), we asked about the users’ internet usage habits and their perception of safety whilst using their browser of choice. We wanted to capture people's opinions beforehand and then introduce the security extensions including our solution in order to understand how these solutions affected them and to capture the users’ opinions. Along with our plugin, we showed other five existing solutions (Avast, WOT Scanner, SSL Trust, Google Sage Browsing, and Browser Audit). These solutions were picked as they are some of the most known and used ones.

We had one-to-one interviews with the users. We explained the study to our users, who would first fill out part of the survey related to internet browsing and usage of existing solutions. We then showed the users the different solutions, including our plugin, and asked them to try the various solutions by visiting websites of their choice as well as a list of other websites provided by us. All the solutions were already installed or opened (see Browser Audit) and ready to be used. At the end, we asked the users to finish the last part of the survey which asked them to rate all the solutions (including ours). In the survey, we also provided some screenshots for each of the tools, for the users to remember easily each of the solutions.

The results of our survey are provided below, where we present in Table 2 the calculated individual average rating made by the users for each of the seen solutions and the overall ranking of the tools with respect to their clarity, ease of use and information provided.

Our solution ranked best with respect to other Chrome extensions and had an average ranking with respect to clarity, ease of use, and provided information. Following the survey result, our solution does not compete on levels of information with SSL Trust and Browser Audit but it can provide a strong middle ground.

By analysing the results of our survey we can conclude that informative solutions are overall preferred over accessible solutions. Whilst accessible solutions ranked highly in the ease of use and clarity when it comes to the individual rating they fall significantly. Informative solutions often have to make significant trade-offs to achieve the required information. This can best be seen with SSL Trust which placed top in the information rankings yet 5th/6th in the clarity and ease of use rankings. From our results, we noticed that Browser Audit, which is a very unique solution, was ranked 1st on individual preference, and high for clarity and information provided.

In order to improve our solution, during the survey we asked the users to provide further feedback in terms of what they liked or disliked about our plugin and suggestions on how we could improve their experience in the usage of the plugin. The feedback was generally positive, e.g., a good number of users liked the security rating ring. Some of the comments we received were about the appearance of the tool, having more information about the tests, and the clarity of the scoring system. The majority of these comments were implemented in the final version of the tool, where we included more colour to make the test results clearer, added descriptions to the test so they are easier to understand, and improved the scoring system to reflect a more accurate grade.

During our evaluation, we wanted to understand how our solution performed with respect to other similar tools. In particular, we compared it with similar solutions that focus more on the accessibility, by providing fewer results that are easier to understand by the users, like Avast and WOT. Both of them are Chrome browser extensions and as such have the same access to security information as our plugin. When analysing the results of the survey, we noticed that our solution had a higher rating when it comes to users’ preference and information provided, and only second to Avast for ease of use, while the clarity was much lower than Avast but better than WOT.

The three factors we compared these plugins are the security rating, the breakdown of the score, and additional tools. For the first two, our solution provides a rating that you can differentiate between websites and is understandable for anyone at any level of technological proficiency. Avast gives you a thumbs up and WOT gives an equivalent rating with user reviews (that might be outdated and/or biased). Neither of these tools has a breakdown of how these results have been calculated, while we provide a host of tests that backup the provided score. We show a summary of this comparative analysis in Table 3.

From the survey, we were able to collect some further information relating the users’ browsing habits. In particular, we can see that most people spend many hours per day using the internet, an average of 6 hours for all devices and 4 hours for browsers (see Fig. 5). Google Chrome was one of the most popular browsers (see Fig. 6). In regards to security extensions, a very low number of the users that took the survey were using website security scanners (3 out of 21 users) and almost half of them (10 out of 21 users) were using ad blockers. We asked the users if they have used or heard of analysed security extensions and except for Google Safe Browsing, not many users had heard of any other existing security solutions (see Fig. 7).