4 ms·

Is it? iwea.com is perfectly legitimate albeit niche with a valid https cert. Doesn't this feature just push brave further down a route of acting as curators o

Is it? iwea.com is perfectly legitimate albeit niche with a valid https cert. Doesn't this feature just push brave further down a route of acting as curators of a private version of the web, favouring larger (or partnered) websites?

davnicwil 7y ago
I see your point. It's obviously legitimate and a false positive in this case, but you do have a very clear option to ignore and proceed if you went there with intent, so it doesn't actually really get in your way if you did mean to go to the article. It's not hidden away like with the ssl cert warning. Saying this is curating or favouring certain websites I think is a very big leap. The intent is obviously to prevent typo injection/phishing attacks which are very much used in the wild, and I think it's likely to do overwhelmingly more good than harm because there are, I'd assume, far more instances of that than edge cases of domains which are very similar to known brand names.
- slartibardfast0 7y ago
  sure, and if if the algorithm was publicly documented and focused on plishing (site structure, visual similarities), I'd be far less concerned about future manipulation. Gatekeeping like this is a very powerful tool. FWIW in the general keyboard use case the letter K isn't even typo-able to W with the same typing hand!!
  - davnicwil 7y ago
    It's not that I disagree with either you or the sibling comment, it has some potential for abuse, I just don't see it as likely - I mean what manipulation could happen here? If they starting suggesting I meant 'facebook.com' when I go to 'twitter.com' then I'm going to immediately stop using the product and I think most people would too. I just don't see how many near-miss cases there could be where this could be genuinely abused. It's just an attempt to help people who will and do get fooled by similar-looking domain names in phishing attacks. This is an example of that. Obviously in this case it's not a typo attack - as you rightly point out the keys are typically too far apart - it's a potential phishing attack of the variety 'here click this link to re-enter your credit card details for your recent Ikea order, as our system lost them' hoping the user doesn't really look properly at the url bar and gets fooled.
- tialaramex 7y ago
  At least one well known Ad Blocker went down this exact same dark path before Hey, for $$$ we'll make sure your customer don't get "lost" and go visit similar sites that are illegitimate (ie. don't pay us). What's that? Our algorithm says your site wasn't legitimate but your rival's site is? Well we can look into that for you but meanwhile try paying us $$$ and you'll be amazed at the results... Unsurprisingly their "customers" didn't like this very much, but the AAA video games industry has learned if you do something awful, get smacked, apologise, then immediately do it again, you wear people down. The tenth time they just can't muster as much anger. "Yeah, yeah, it's just normal for companies to treat me like shit, I guess I put up with it".

davnicwil 7y ago

I see your point. It's obviously legitimate and a false positive in this case, but you do have a very clear option to ignore and proceed if you went there with intent, so it doesn't actually really get in your way if you did mean to go to the article. It's not hidden away like with the ssl cert warning. Saying this is curating or favouring certain websites I think is a very big leap. The intent is obviously to prevent typo injection/phishing attacks which are very much used in the wild, and I think it's likely to do overwhelmingly more good than harm because there are, I'd assume, far more instances of that than edge cases of domains which are very similar to known brand names.

slartibardfast0 7y ago
sure, and if if the algorithm was publicly documented and focused on plishing (site structure, visual similarities), I'd be far less concerned about future manipulation. Gatekeeping like this is a very powerful tool. FWIW in the general keyboard use case the letter K isn't even typo-able to W with the same typing hand!!
- davnicwil 7y ago
  It's not that I disagree with either you or the sibling comment, it has some potential for abuse, I just don't see it as likely - I mean what manipulation could happen here? If they starting suggesting I meant 'facebook.com' when I go to 'twitter.com' then I'm going to immediately stop using the product and I think most people would too. I just don't see how many near-miss cases there could be where this could be genuinely abused. It's just an attempt to help people who will and do get fooled by similar-looking domain names in phishing attacks. This is an example of that. Obviously in this case it's not a typo attack - as you rightly point out the keys are typically too far apart - it's a potential phishing attack of the variety 'here click this link to re-enter your credit card details for your recent Ikea order, as our system lost them' hoping the user doesn't really look properly at the url bar and gets fooled.
tialaramex 7y ago
At least one well known Ad Blocker went down this exact same dark path before Hey, for $$$ we'll make sure your customer don't get "lost" and go visit similar sites that are illegitimate (ie. don't pay us). What's that? Our algorithm says your site wasn't legitimate but your rival's site is? Well we can look into that for you but meanwhile try paying us $$$ and you'll be amazed at the results... Unsurprisingly their "customers" didn't like this very much, but the AAA video games industry has learned if you do something awful, get smacked, apologise, then immediately do it again, you wear people down. The tenth time they just can't muster as much anger. "Yeah, yeah, it's just normal for companies to treat me like shit, I guess I put up with it".