3 ms·

> malware blacklisting "services" If you're thinking of Google Safe Browsing (used by both Chrome and Firefox), you're wrong. It works the other way around: G

by r3bl 8y ago

> malware blacklisting "services" If you're thinking of Google Safe Browsing (used by both Chrome and Firefox), you're wrong. It works the other way around: Google sends you the list of undesired domains, and your client prevents you from visiting domains found on that list. Nothing needs to be shared with a third party for that functionality.

mehrdadn 8y ago
I seem to recall reading it can be a mix of both, though generally the way you mentioned. A Bloom filter that filters locally, and if it's a hit then it sends over the URL to double-check. Would be nice if someone could confirm though.
- duskwuff 8y ago
  Older versions were Bloom filters, but newer versions have moved away from that (and to a list of hash prefixes) because Bloom filters are hard to update.
pkasting 8y ago
The full details are in https://www.google.com/chrome/privacy/whitepaper.html#malware https://www.google.com/chrome/privacy/whitepaper.html#malwar... , but the short summary is: A hash prefix list gets downloaded locally; Chrome checks locally against the prefix list. If a URL hits, Chrome will send the hash prefix (not the full hash and not the URL) to the server, the server will send back all full hashes that match that prefix, and then the client will complete the check locally. In theory, if the server had a small number of matching full hashes, it could guess about what URL a client might be hitting, but in practice the system is designed as much as possible to avoid ever leaking data about what you're visiting to Google servers.
duskwuff 8y ago
It's a little bit in the middle. Clients download a database of partial hashes of malware URLs. If they get a hit on one of those partial hashes, they make a request for the full list of hashes with that prefix. Google knows when a client makes one of those requests, but the exact URLs (or hashes) they're looking up are never revealed. The partial hash is 32 bits long, so there's enough collisions that making a request isn't especially revealing. https://developers.google.com/safe-browsing/v4/update-api https://developers.google.com/safe-browsing/v4/update-api
deleted 8y ago
[deleted]

by r3bl 8y ago

mehrdadn 8y ago

I seem to recall reading it can be a mix of both, though generally the way you mentioned. A Bloom filter that filters locally, and if it's a hit then it sends over the URL to double-check. Would be nice if someone could confirm though.

duskwuff 8y ago
Older versions were Bloom filters, but newer versions have moved away from that (and to a list of hash prefixes) because Bloom filters are hard to update.

pkasting 8y ago

The full details are in https://www.google.com/chrome/privacy/whitepaper.html#malware https://www.google.com/chrome/privacy/whitepaper.html#malwar... , but the short summary is: A hash prefix list gets downloaded locally; Chrome checks locally against the prefix list. If a URL hits, Chrome will send the hash prefix (not the full hash and not the URL) to the server, the server will send back all full hashes that match that prefix, and then the client will complete the check locally. In theory, if the server had a small number of matching full hashes, it could guess about what URL a client might be hitting, but in practice the system is designed as much as possible to avoid ever leaking data about what you're visiting to Google servers.

duskwuff 8y ago

It's a little bit in the middle. Clients download a database of partial hashes of malware URLs. If they get a hit on one of those partial hashes, they make a request for the full list of hashes with that prefix. Google knows when a client makes one of those requests, but the exact URLs (or hashes) they're looking up are never revealed. The partial hash is 32 bits long, so there's enough collisions that making a request isn't especially revealing. https://developers.google.com/safe-browsing/v4/update-api https://developers.google.com/safe-browsing/v4/update-api

deleted 8y ago

[deleted]