v3.0.0

Visilant 3.0.0

The biggest release so far. Knowing a site is no longer a single number, email addresses are checked like any other address, an address that looks like a site you use is called out, and the whole thing now runs on Firefox for Android.

Before you update

• The extension now asks to read your browsing history, so your browser will hold the update until you accept the new permission. It is read once, on your device, and never leaves it. Only a visit count, a first and a last date and a number of active days are kept per site, with no page addresses, no titles and no search terms.
• Nothing you already know turns unfamiliar. Your existing threshold is carried over as it was, and the two new checks stay switched off for a profile that is only arriving here now, because your old records have no dates for them to read.
• Your counts are left alone. On an update the automatic import runs only if the extension has no visits recorded at all, so an existing profile is never rewritten from the browser behind your back.
• English only. Translations were dropped rather than kept half checked, and a profile that used one now falls back to English.

What is new

• Familiarity is three checks, not one. Visits, the number of separate days you have been there, and how long the site has been known, each with its own number and its own on/off switch. Choose whether a site has to pass all of them, any one of them, or a set number, such as two of three. Everything else the extension does follows from this one answer.
• Every warning shows its reasoning. The link tooltip, both confirmation dialogs, the comparison table, the in-page panel and the dashboard all list the facts the verdict was drawn from, and only the checks you have switched on. A switch decides whether they come as plain numbers or as a small table with the mark each one has to clear.
• Email addresses are checked like any other address, plus what is particular to mail: services anyone can sign up to are marked as such, throwaway mailboxes are named as themselves, and Gmail is finally counted at mail.google.com instead of showing a zero that could never have moved.
• Addresses built to deceive are called out on their structure: a familiar name parked in front of an @ (paypal.com@evil.net), a familiar name buried in the middle so the real one comes last (paypal.com.evil.net), an address that is only a number, unusually deep nesting, and a single word written in two alphabets at once.
• Look-alike detection now uses your own history. An address one character away from a site you actually visit is called out, whether it is a foreign letter that looks Latin, a 1 standing in for an l, a plain typo, or the familiar name padded out (paypal-secure.com). Because the comparison is against your history and not a shipped list of brands, nobody can test a fake against it in advance.
• Check anything by hand. A field in the dashboard takes a link, a bare domain, an email address or a QR code image, pasted, dropped in or picked from disk. Selected text and images on a page can be checked from the right-click menu without leaving the page.
• Second-opinion links. Under any checked address there is a collapsed list of links to VirusTotal, urlscan.io and Google Safe Browsing. They are links, not integrations, so nothing is sent until you click one, and the list is yours to edit.
• Hold pastes on sites you do not know, off by default. The first paste is stopped and nothing is inserted until you have looked at the address. Allowing it pastes nothing by itself, you press paste again and the page stops asking.
• Browser history import. It reads real first-visit dates and active days, not just counts, runs on install, can be cancelled and resumed, and lives in Your data in the settings, where you can also erase every visit the extension has recorded.
• Firefox for Android. The extension now actually works there, the popup is usable with a fingertip, dialogs stay on the screen they are shown on, and the settings page no longer offers a history import the phone cannot run.
• The settings page was rebuilt around its sections, with a table of contents, a reset in the corner of every card that puts that section back to how it ships, and a switch that hides the explanatory lines once you know them.
• The toolbar counter is configurable: it can show any check you have switched on, or how many of them the site passes.
• Domain highlighting was reworked to mark only the characters worth a second look, meaning digits, separators and anything outside the Latin alphabet. Latin letters are deliberately left alone, since colouring them reads as a verdict on the ordinary part of an address.
• On a new profile the link check now waits to be asked for: right-click is the default trigger instead of hover. An existing setting is kept as it is.

Fixes

• Erasing your visits no longer takes your own lists with it.
• The language shown on screen is the one reported in the settings.
• A one-off migration is marked done only once it has actually run.
• The popup stays on the screen, the wordmark stays readable, and the in-page panel no longer falls back to a serif font.

Verifiable builds

Every release can now be rebuilt from this repository byte for byte, so you do not have to take the store's word for what it installed:

nix build github:ikskoder/visilant/v3.0.0#firefox
sha256sum result/*.xpi

Compare the result with SHA256SUMS on the release. scripts/verify.sh <downloaded.xpi> goes further and compares the copy your browser installed with a fresh build, file by file. The archives also carry a Sigstore-signed provenance attestation tying them to the commit and workflow that built them, and anyone can rerun the build in a fork through the reproduce workflow. Full instructions are in REPRODUCE.md.

If you want the new checks

Active days and first-visit dates only exist for sites recorded since those fields were added. Run the import once from Your data in the settings, which fills them in for every site your browser still remembers and never lowers a count you already have, and then switch the two new checks on in the Familiarity section.

Full Changelog: v2.0.1...v3.0.0