ThouShaltNotClick — Phishing Protection & Training

v1.9.166 • Teachers waiting for their free account to be approved now see that their application is being reviewed (or wasn’t approved) and what happens next, instead of being told to ask their administrator. v1.9.165 • A cleaner look: new navy-and-gold buttons with simple icons in Gmail and Outlook on the web, with clear “reporting”, “reported”, “marked safe” and “saved — will send” states and a more visible keyboard focus outline. • Gmail’s own “Report phishing” and “Report spam” buttons now count as your report on our practice emails. • AI Analysis shows how its view compares with our score, explains why, and lets you report straight from the result. • Better protection against scams that imitate our practice emails: reports are checked more carefully before they count as practice. • Fewer false alarms on genuine account notices. • Fixes: undoing a Community Alert on a forwarded email now always cancels it; Outlook on the web keeps checking new messages while the banner is showing; and “Thank you for reporting” only appears when the report really went through. v1.9.151 • Better protection against account-takeover email. Messages from inside your school that contain scam wording or a disguised e-signature request ("Pending eSign") now show a caution instead of a trusted green. • Fewer false alarms. Everyday wording like "signature required", links that stay on your school's own sites, and scam wording that only appears in a forwarded "is this real?" message no longer trigger the takeover warning. • Made-up addresses at your school's own domain are no longer trusted (schools with Google Workspace connected). • Behind-the-scenes cleanup and reliability improvements. v1.9.149 • Trust-score engine v2 now stays in sync with ThouShaltNotClick's servers automatically - scoring updates roll out centrally, without needing an extension update. • Reliability and performance improvements. v1.9.148 • Fixed: the extension could appear signed in while every check silently failed, if your school requires two-factor authentication and you hadn't finished setting it up • Fixed: routine subscription and invoice emails were sometimes flagged as possible phishing • Fixed: a reply in a conversation you're part of is no longer treated as a cold approach from a stranger • Fixed: badges now appear as soon as you sign in, without needing to reload the tab • Improved: warnings now explain which specific signal triggered them, and how confident we are • Improved: links rewritten by a corporate email gateway are unwrapped before analysis v1.9.139 • Fewer false alarms, one real hole closed. • Banks, parishes and dioceses are no longer scored as impersonators. • Better detection of payment-fraud (BEC) style messages, and more accurate sender identification. • Closed a genuine sender-spoofing gap found in a security audit. v1.9.135 • Fewer false alarms on shared documents. A genuine "shared a document with you" email from Google Docs/Drive (and Dropbox, DocuSign, etc.) is no longer mistaken for impersonation. Google's own "(via Google Docs)" sharing notation was being read as a spoofed sender — that's fixed, while a real impersonation ("Google Security" from a fake address) is still caught. • Clearer guidance on caution emails. When an email says "tread carefully," the recommended action now stresses the real tell: verify anything you didn't expect through a separate channel — and if you call, use a phone number you've already confirmed, never one from the email itself. • Cleaner banner on our own emails. On official ThouShaltNotClick emails the banner no longer repeats our name (it used to read "ThouShaltNotClick: ThouShaltNotClick 99/100"); it now shows the normal rating, e.g. "Most Likely Safe." v1.9.132 • Stronger link privacy. When you click a link and ThouShaltNotClick checks it, the extension now strips the link's query string and one-time token on your device before anything is sent for the safety check. Password-reset and "magic" sign-in links carry a live credential in that part of the address — it now never leaves your browser; only the site, domain, and path are checked. Under the hood: your email's contents are analyzed entirely on your device and never sent anywhere. When a sender isn't already in your local threat cache, only the sender's address and subject line are checked against known scam campaigns — metadata, never the message body. v.1.9.127 - Better support for the new Outlook • The trust badge now reliably appears in the new Outlook (outlook.cloud.microsoft) — it previously could fail to show. • The extension now correctly reads the message sender in the new Outlook, so the green "Verified Safe" and familiar-sender cues work again — and it won't mistake a recipient for the sender. • Recognizes simulation-training emails no matter which domain they're sent from. • Reliability and stability improvements under the hood. v.1.9.118 • One-click AI image scanning Open the extension and hit "Scan this page for AI images" — no more right-clicking. TSNC checks the images on the page, outlines the likely AI-generated ones in orange, and shows you a confidence score for each one right in the popup. v1.9.117 • New — "Is this image AI-generated?" Right-click any web page → "Check this page for AI-generated images" (or right-click a single image) and TSNC flags likely AI-generated images with an orange border and a confidence %. Handy for spotting fake profile photos, fabricated screenshots, and AI-generated scam imagery. Nothing on the page changes — it's just an overlay you can clear anytime. • Sharper detection Trust scores no longer show "null" on group/BCC emails. Better detection of gift-card and payment-scam wording. • Polish Smoother trust banners and quicker, more reliable page scanning. v1.9.113 • Calmer, clearer warnings. Trust levels now guide rather than judge — "Tread Carefully" replaces "Suspicious," and the safe end is clearer with "Most Likely Safe" and "Should be Safe." Less al…