4 ms·

A solid reminder why my main browser is Firefox. I only use Chrome for development. Best of both worlds.

by ArtDev 10y ago

chipperyman573 10y ago
Firefox uses google's safe browsing web service[0], so Google gets your data anyway (unless you've disabled it). [0]: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
- lorenzhs 10y ago
  Disabling safe browsing is bad advice. It uses a local bloom filter and transmits only gashed of prefixes of the URL if the filter says "maybe". It's pretty well thought out and you should not just recommend to people to turn it off, it's a valuable security tool, and certainly preferable to a ransomware infection, wouldn't you say?
  - chipperyman573 10y ago
    I never said to turn it off... I said that google will get your browsing data. That said, I firmly believe that the best antivirus is common sense. Everyday users should keep it turned on but people who read HN (should) know enough to be safe without it.
    - Sylos 10y ago
      That's the exact point, though, Google does not get your browsing data. What Firefox does, is that it downloads a complete list of hashes from Google's Safebrowsing server. Every instance of Firefox does this every 30 minutes. Nothing identifying about this. Firefox then stores only the first 32 bits of those hashes to save on space (as the list is unsurprisingly gigantic). Then Firefox does a lookup against this locally stored list whenever it loads a webpage. If a webpage's first 32 bits should be on that list, then it obviously has to check if it's actually the complete hash that matches. But for that, it requests all hashes with same first 32 bits from Mozilla's server. They proxy the list for that purpose. So, it's at best Mozilla which can guess that you browsed to one of the many pages that share the first 32 bits of the hash. Google will have no clue about it. And in fact, they even throw in a few noise entries when requesting the full hashes from their server, so even Mozilla actually doesn't know for sure which first 32 bits you browsed to. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...
sergiotapia 10y ago
Don't use Firefox. They are not trustworthy. Use Opera.
- thecatspaw 10y ago
  and you make that claim based on what exactly?

A solid reminder why my main browser is Firefox. I only use Chrome for development. Best of both worlds.

by ArtDev 10y ago

A solid reminder why my main browser is Firefox. I only use Chrome for development. Best of both worlds.

Firefox uses google's safe browsing web service[0], so Google gets your data anyway (unless you've disabled it). [0]: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...

lorenzhs 10y ago
Disabling safe browsing is bad advice. It uses a local bloom filter and transmits only gashed of prefixes of the URL if the filter says "maybe". It's pretty well thought out and you should not just recommend to people to turn it off, it's a valuable security tool, and certainly preferable to a ransomware infection, wouldn't you say?
- chipperyman573 10y ago
  I never said to turn it off... I said that google will get your browsing data. That said, I firmly believe that the best antivirus is common sense. Everyday users should keep it turned on but people who read HN (should) know enough to be safe without it.
  - Sylos 10y ago
    That's the exact point, though, Google does not get your browsing data. What Firefox does, is that it downloads a complete list of hashes from Google's Safebrowsing server. Every instance of Firefox does this every 30 minutes. Nothing identifying about this. Firefox then stores only the first 32 bits of those hashes to save on space (as the list is unsurprisingly gigantic). Then Firefox does a lookup against this locally stored list whenever it loads a webpage. If a webpage's first 32 bits should be on that list, then it obviously has to check if it's actually the complete hash that matches. But for that, it requests all hashes with same first 32 bits from Mozilla's server. They proxy the list for that purpose. So, it's at best Mozilla which can guess that you browsed to one of the many pages that share the first 32 bits of the hash. Google will have no clue about it. And in fact, they even throw in a few noise entries when requesting the full hashes from their server, so even Mozilla actually doesn't know for sure which first 32 bits you browsed to. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...

sergiotapia 10y ago

Don't use Firefox. They are not trustworthy. Use Opera.

thecatspaw 10y ago
and you make that claim based on what exactly?