OnlineStore CH risk-check. by Bernhard Weibel

Shop safely on the Internet – Your protection against fake shops and fraud

"CH Warnlisten & Shop Risk-Check" is a browser extension that automatically or manually analyzes websites and online shops for security risks.

It compares the current URL with the Swiss warning list from K-Tipp/Saldo (ktipp.ch/service/warnlisten/detail/warnliste/internetshops), reklamation.ch and uid.admin.ch. Optional Google-Safe-Browsing or heuristic checks.

Only internet addresses (https:// or http://) are analyzed, neither localhost nor IP (http://127.0.0.1 etc.).

The check can be set to automatic or manual.

Automatic or manuel verification via:
- www.ktipp.ch/service/warnlisten/detail/warnliste/internetshops
- www.reklamation.ch
- www.uid.admin.ch
- www.trustedshops.ch
- ch.trustpilot.com
- Google Safe Browsing (safebrowsing.googleapis.com)

Reduced activity:
- Each domain is checked only once, regardless of whether you click further on the page in the same tab or have the same domain open in other tab.
- If Google Safe Browsing is enabled, however, every new URL is checked again for security risks.
- - E.g. https://testsafebrowsing.appspot.com/ ok. https://testsafebrowsing.appspot.com/s/phishing.html - Warning.
- In manual mode, once the check is triggered, for every further page of the same domain, the warnings for the domain are displayed without further checking and the URL is tested via Google Safe Browsing (if enabled).

Since I am not an official developer of any of the web services, the functionality may be restricted if the services change.

After installation: 'Pin to toolbar' - otherwise it makes little sense. This cannot be automated, however.

Main features:
- 🛒 K-Tipp/Saldo Warning List: Automatically checks whether a domain is on the official K-Tipp/Saldo warning list.
- - If an entry is found, it will be displayed. The link opens the warning list page, but the domain must then be entered manually.
- 🛡️ reklamation.ch Comparison: Searches for existing consumer complaints before you shop.
- ✅ Trusted Shops Certification: Automatically checks whether the shop has a valid Trusted Shops seal of approval.
- 🌟 Trustpilot Reviews: Automatically checks ratings and the TrustScore on Trustpilot.
- 🏛️ Admin.ch UID Check: Compares the domain with the official federal business register. Shops without a valid Swiss UID (Business Identification Number) are displayed as a warning.
- - (Not supported for Firefox-Android)
- 🔒 Google Safe Browsing (Optional): Integration of the Safe Browsing API to detect phishing and malware.
- - For this functionality, you need to provide an API key in the settings. A link to instructions on how to create one is displayed there.
- ⚙️ Heuristic Checks: Local detection of suspicious TLDs, unencrypted HTTP connections, and URL obfuscation - entirely without an API key.
- 🚦 Visible Warnings: A color system in the icon (badge) and direct warnings on dangerous sites inform you immediately.
- - Icon badges in the browser toolbar show the current status at a glance:
- - – Security threat detected (red, „❗“).
- - – Warning / complaints found (orange, „❗“).
- - – No issues found (green, „✅“).
- - – Domain on whitelist (white, „✔“).
- - – No check performed yet (white, „?“).
- - – Check skipped, e.g. localhost/IP/non-Http(s) (grey, „-“).
- 🛡️ Privacy First:
- - No user tracking, no storing of browsing history on our servers.
- - 'OnlineStoreCHRiskCheck' is sent as 'Referer' (HTTP header indicating the website a request comes from / the previous page that referred the user to the current page) to the check pages.

How it works:
- Choose between automatic scanning while surfing or manual scanning at the push of a button. Add trusted sites to a whitelist if necessary.
- A domain is checked only once per session in the current and all tabs (for K-Tipp/Saldo warning list, Reklamation.ch, Trusted Shops, uid.admin.ch).
- Safe Browsing is executed once per URL.
- Unless the check is explicitly run again.

Open Source & Transparency:
This project is open source under the GPL 3.0 license. You can find the complete source code on GitHub: https://github.com/baweibel-ch/OnlineStoreCHRiskCheck

Service-Url (Report error): https://github.com/baweibel-ch/OnlineStoreCHRiskCheck/issues

Privacy Policy: https://github.com/baweibel-ch/OnlineStoreCHRiskCheck/blob/main/chrome_webstore_listing/Datenschutz.pdf