How an on-device phishing detector tells a cloned login page from the real one without calling home

Most phishing detection today is a server-side lookup: your browser sends the URL, sometimes the whole page, to a threat-intel API and gets a verdict back. Fine for catching the site, bad for whoever runs that API building a profile of everywhere you go. The alternative I've been building into StealthOS (an iOS privacy browser) runs the check on-device. Short version: the page renders, a lightweight model pulls an embedding of the page's visual and structural layout, brand marks, form fields, and that embedding gets compared against known-brand fingerprints stored locally. A domain that's zero months old, shares an IP with a hundred others, and visually mimics a login page it has no business mimicking scores high risk without a single network call about what you were looking at. Caught a fake Uphold clone mid-load in testing, screenshot attached: new domain, Cloudflare-fronted, scored 84/100 risk before I could type anything into it. It's not bulletproof, a well-made clone with a fresh design occasionally slips past, and I'd rather say that upfront than oversell it. But the detection itself doesn't require trusting anyone with your browsing history to work. Full disclosure, I'm one of the people building this. StealthOS also bundles Tor, canvas/WebGL/audio fingerprint spoofing, and an AES-256 vault, free, no account. App Store link Genuinely curious what would break this kind of detection if anyone here wanted to try. submitted by /u/ahstanin [link] [comments]

from hacking: security in practice https://ift.tt/FS6v2e9