4 ms·
A couple possibilities I can think of: * the list may be prohibitively large * it exposes to the bad actors exactly which of their scams is detected, so they
by mokus 7y ago
A couple possibilities I can think of:
* the list may be prohibitively large
* it exposes to the bad actors exactly which of their scams is detected, so they can simply refine their methods until their sites don’t make “the list”
- Gaelan 7y agoWouldn’t it be pretty easy for the bad actors to check the database anyway? I can’t imagine they would need to query often enough to hit any rate limits.
- cryptonector 7y agoBloom filters take care of the first. There will always be an arms race between attack and defense, so I'm not concerned about the second issue.
- yorwba 7y agoBloom filters can give false positives, and to eliminate them, you'd need to send "data (hashed, anonymized, truncated, or otherwise)" to some entity that has the full list. That's exactly how Google's Safe Browsing API works.
- deogeo 7y agoCan't the bad actors already check each of their sites individually by pretending to be a normal user?
- souterrain 7y agoBad actors can also occasionally poll the safebrowsing API.
- pmoriarty 7y agoExactly how large is it? OS vendors already make a habit of regularly sending gigantic OS updates. I'd have a hard time believing that a compressed list of malware URLs would be noticeably bigger, by comparison. Also, once the list is sent the first time (or just included with the OS so it'd be already present on your device when you bought it), they could just send the deltas as the list changed, and those deltas (especially once compressed) should be relatively small even compared to the original (probably not that large) list.
- NetMageSCW 7y agoGoogle Safe Browsing transparency report lists 40k new bad URLs per week - how large do you think the list is now? It is far, far too large for local processing but k-anonymity is perfectly trustworthy when used with cryptographic hashing.