5 ms·

I feel like the entire tech world is overthinking this. First, the Great Firewall already blocks the known "dangerous" sites. If you manage to access them via V

I feel like the entire tech world is overthinking this. First, the Great Firewall already blocks the known "dangerous" sites. If you manage to access them via VPN, then chances are Tencent is getting your VPN's IP, and it's not your problem. If it's a hot new URL that hasn't been firewalled yet, then it's also not going to be in the safe browsing database, which means that your browser won't make that second request (with the full hash) to verify it. You can think of various other what-if scenarios. But the other thing is that all internet providers within China are in bed with the government and can cough up your network history on demand. Why bother going through Tencent? People are pillorying Apple over a vague theoretical risk that is only really practical in the free world.

PavlovsCat 7y ago
> Why bother going through Tencent? Indeed, especially considering this: https://news.ycombinator.com/item?id=21241712 https://news.ycombinator.com/item?id=21241712 I think the only difference is that it also applies to the region set, so don't do that if you're not in China.
criddell 7y ago
> Why bother going through Tencent? It's a way of reporting the use of a VPN.
- lordlimecat 7y ago
  VPN use is pretty obvious to the ISP.
dwild 7y ago
EDIT: I found out that there isn't 2 requests, only one and only with the prefix. The prefix is first lookup in the client database, and if it's there, a request is made to get the URL related to that prefix. My idea still works but then they would need to give theses specific prefix in the database already, which will be pretty obvious. > If it's a hot new URL that hasn't been firewalled yet, then it's also not going to be in the safe browsing database, which means that your browser won't make that second request (with the full hash) to verify it. Who say you need the full hash? Keep all prefix with the timestamp and their IP address and believe me, you can get a pretty good picture. All you need is to keep a bunch of URL you don't block but consider harmful, and a bunch of of others URL from theses same domains. Here's a partial hash that I'm pretty sure would be quite useful: > 18ec It map to this URL: > https://www.reddit.com/api/submit https://www.reddit.com/api/submit From your database, find everyone that called for 18ec. It may matches many other URL, but use your backup for Reddit and the timestamps. You now got the username linked to their IP. Someone doesn't post? Use 1483, B5E7, 13F9, 5B58, 0859, etc... The funniest is that you could probably find the URL yourself using theses prefixes... but yeah the goal is to find out who went to theses URL, not really which URL they went to. You don't need that many matches to confirm they truly went there.
- matthewdgreen 7y ago
  Why would it be obvious? What heuristic would you apply to identify the presence of such a hash as malicious behavior, and who is checking?

PavlovsCat 7y ago

> Why bother going through Tencent? Indeed, especially considering this: https://news.ycombinator.com/item?id=21241712 https://news.ycombinator.com/item?id=21241712 I think the only difference is that it also applies to the region set, so don't do that if you're not in China.

criddell 7y ago

> Why bother going through Tencent? It's a way of reporting the use of a VPN.

lordlimecat 7y ago
VPN use is pretty obvious to the ISP.

dwild 7y ago

EDIT: I found out that there isn't 2 requests, only one and only with the prefix. The prefix is first lookup in the client database, and if it's there, a request is made to get the URL related to that prefix. My idea still works but then they would need to give theses specific prefix in the database already, which will be pretty obvious. > If it's a hot new URL that hasn't been firewalled yet, then it's also not going to be in the safe browsing database, which means that your browser won't make that second request (with the full hash) to verify it. Who say you need the full hash? Keep all prefix with the timestamp and their IP address and believe me, you can get a pretty good picture. All you need is to keep a bunch of URL you don't block but consider harmful, and a bunch of of others URL from theses same domains. Here's a partial hash that I'm pretty sure would be quite useful: > 18ec It map to this URL: > https://www.reddit.com/api/submit https://www.reddit.com/api/submit From your database, find everyone that called for 18ec. It may matches many other URL, but use your backup for Reddit and the timestamps. You now got the username linked to their IP. Someone doesn't post? Use 1483, B5E7, 13F9, 5B58, 0859, etc... The funniest is that you could probably find the URL yourself using theses prefixes... but yeah the goal is to find out who went to theses URL, not really which URL they went to. You don't need that many matches to confirm they truly went there.

matthewdgreen 7y ago
Why would it be obvious? What heuristic would you apply to identify the presence of such a hash as malicious behavior, and who is checking?