3 ms·

Thanks!

btown 8y ago
Even before it has an impact on CV, this is really important. If widely adopted, it mitigates against the "script kiddie-ization" of phishing sites, where it becomes easier and easier to closely mimic a legitimate site by reusing (perhaps in real time via proxy) its original assets. Such attackers won't have the ability to create novel adversarial elements, though, and you could train yourselves on any that made it into common exploit scripts. That said, your browser plugin is extremely aggressive at uploading screenshots of potentially sensitive information to your servers (for instance, someone's stealth mode startup's unindexed Heroku staging URL), doing so by default if it hasn't been whitelisted [0]. And your privacy policy [1] permits you to resell "non-personally identifiable visitor information... to other parties for marketing, advertising, or other uses." I don't blame you for needing to make money or for launching an MVP, but there must be better zero-knowledge ways of accomplishing this. It's an important goal and I wish you all the best... but don't be the source of the data leaks you intend to prevent. [0] https://github.com/phishai/phish-protect/blob/master/js/background.js#L74 https://github.com/phishai/phish-protect/blob/master/js/back... [1] https://www.phish.ai/phish-ai-privacy-policy/ https://www.phish.ai/phish-ai-privacy-policy/
- yevpats 8y ago
  Hey, Thanks for the extensive reply. Per the browser extension, we don't upload every screenshot in the free extension only if you like to scan a particular webpage as we can't afford to scan every webpage for free. We don't sell any information as this is not our business model - I got your point with the privacy policy and we will make it more accurate. The business model is mainly with API product where you will see more integration coming up in the next couple of months and as I said the use case for the API is more for incident response teams and hosting providers that need to go manually through a lot of URLs and tag them.

Thanks!

Even before it has an impact on CV, this is really important. If widely adopted, it mitigates against the "script kiddie-ization" of phishing sites, where it becomes easier and easier to closely mimic a legitimate site by reusing (perhaps in real time via proxy) its original assets. Such attackers won't have the ability to create novel adversarial elements, though, and you could train yourselves on any that made it into common exploit scripts. That said, your browser plugin is extremely aggressive at uploading screenshots of potentially sensitive information to your servers (for instance, someone's stealth mode startup's unindexed Heroku staging URL), doing so by default if it hasn't been whitelisted [0]. And your privacy policy [1] permits you to resell "non-personally identifiable visitor information... to other parties for marketing, advertising, or other uses." I don't blame you for needing to make money or for launching an MVP, but there must be better zero-knowledge ways of accomplishing this. It's an important goal and I wish you all the best... but don't be the source of the data leaks you intend to prevent. [0] https://github.com/phishai/phish-protect/blob/master/js/background.js#L74 https://github.com/phishai/phish-protect/blob/master/js/back... [1] https://www.phish.ai/phish-ai-privacy-policy/ https://www.phish.ai/phish-ai-privacy-policy/

yevpats 8y ago
Hey, Thanks for the extensive reply. Per the browser extension, we don't upload every screenshot in the free extension only if you like to scan a particular webpage as we can't afford to scan every webpage for free. We don't sell any information as this is not our business model - I got your point with the privacy policy and we will make it more accurate. The business model is mainly with API product where you will see more integration coming up in the next couple of months and as I said the use case for the API is more for incident response teams and hosting providers that need to go manually through a lot of URLs and tag them.