3 ms·

Slightly tangential, but: > ... Google Safe Browsing service. Chrome checks every website you visit against a list of malicious websites that it periodically d

Slightly tangential, but: > ... Google Safe Browsing service. Chrome checks every website you visit against a list of malicious websites that it periodically downloads from Safe Browsing. So I have always disabled Safe Browsing because I assumed it was sending all my browsing activity to Google in real time to be checked. But this sounds like it's checking locally from a downloaded list. Anyone know if that's correct?

pfg 9y ago
Safe Browsing is implemented in a fairly privacy-preserving way. The block list is downloaded periodically and sites are checked against this list locally. The only time most browsers implementing Safe Browsing will share potentially privacy-sensitive data is when you download executable files and when you actually encounter a site included in the block list (in order to double-check whether the site has since been removed). Documentation for the Safe Browsing implementation in Firefox can be found here[1]. [1]: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
kodablah 9y ago
It's half and half from what I'm reading. It checks a local list for the sha-256 hash or partial hash. Then, if found, it phones home with the partial hash it found. If you don't want to read [0], I think the Golang parser/lookup at [1] is a reasonable interpretation of what they're doing, but not sure. You can see there that the hashes generated are of different-host-combinations + different-URL-path-combinations. They do the partial hash check in a DB (local, downloaded periodically). If there's a partial hash in the DB, they phone home w/ that partial hash for the full hashes and check if it matches. So Google gets the partial hash of a URL it had told you could be bad. They return the full hashes for that partial hash. We can hope (and see) that the partial hashes do not match a broad set (and they are host possibility + URL path combo possibility). Surely Google has something that maps the hashes to actual URL patterns, but like the other commenter said, the partial hash you send is only sent when it matches a local DB already. 0 - https://cs.chromium.org/chromium/src/components/safe_browsing/ https://cs.chromium.org/chromium/src/components/safe_browsin... 1 - https://github.com/google/safebrowsing/ https://github.com/google/safebrowsing/
- magicalist 9y ago
  > Surely Google has something that maps the hashes to actual URL patterns, but like the other commenter said, the partial hash you send is only sent when it matches a local DB already. It sends the first 4 bytes of a 32 byte SHA-256 hash of the URL. There isn't a reasonable map back for that.

pfg 9y ago

Safe Browsing is implemented in a fairly privacy-preserving way. The block list is downloaded periodically and sites are checked against this list locally. The only time most browsers implementing Safe Browsing will share potentially privacy-sensitive data is when you download executable files and when you actually encounter a site included in the block list (in order to double-check whether the site has since been removed). Documentation for the Safe Browsing implementation in Firefox can be found here[1]. [1]: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...

kodablah 9y ago

It's half and half from what I'm reading. It checks a local list for the sha-256 hash or partial hash. Then, if found, it phones home with the partial hash it found. If you don't want to read [0], I think the Golang parser/lookup at [1] is a reasonable interpretation of what they're doing, but not sure. You can see there that the hashes generated are of different-host-combinations + different-URL-path-combinations. They do the partial hash check in a DB (local, downloaded periodically). If there's a partial hash in the DB, they phone home w/ that partial hash for the full hashes and check if it matches. So Google gets the partial hash of a URL it had told you could be bad. They return the full hashes for that partial hash. We can hope (and see) that the partial hashes do not match a broad set (and they are host possibility + URL path combo possibility). Surely Google has something that maps the hashes to actual URL patterns, but like the other commenter said, the partial hash you send is only sent when it matches a local DB already. 0 - https://cs.chromium.org/chromium/src/components/safe_browsing/ https://cs.chromium.org/chromium/src/components/safe_browsin... 1 - https://github.com/google/safebrowsing/ https://github.com/google/safebrowsing/

magicalist 9y ago
> Surely Google has something that maps the hashes to actual URL patterns, but like the other commenter said, the partial hash you send is only sent when it matches a local DB already. It sends the first 4 bytes of a 32 byte SHA-256 hash of the URL. There isn't a reasonable map back for that.