3 ms·
> Doesn't Chrome upload everything downloaded to VirusTotal (a Google product)? It doesn't, unless you opt for SafeSearch "Enhanced Protection" or enable "Help
by vaduz 6y ago
> Doesn't Chrome upload everything downloaded to VirusTotal (a Google product)?
It doesn't, unless you opt for SafeSearch "Enhanced Protection" or enable "Help improve security on the web for everyone" in "Standard Protection". Both are off by default, IIRC. Without it, it periodically downloads what amounts to bloom filter of "potentially unsafe" URLs/domains.
On the other hand, GMail and GDrive do run the checks via VirusTotal, as far as we know - which means that OP case may have been caused by having some of the recipients having their incoming mail automatically scanned. It's similar for Microsoft version (FOPE users provide input for Defender Smart Screen), at least last time I checked.
- ehsankia 6y agoWhat happens if it is a hit against the bloom filter / checksum? Would it transmit the URL so that it can be blocklisted?
- kevincox 6y agohttps://developers.google.com/safe-browsing/v4/update-api#checking-urls https://developers.google.com/safe-browsing/v4/update-api#ch... TL;DR is you download a chunk of SHA-256 hashes and check if the hash for your URL is there. There is of course the chance of collision but that is minuscule.
- ehsankia 6y agoOh I know that's how that works, I meant, does Google transmit back the URLs once it does get a hit, to protect others from downloading that file?
- vinay_ys 6y agoWhy would it need to do that? To protect others from the same url, the same hash checking method should work.
- monsieurbanana 6y agoThe blacklisted URL in this case is found in a downloaded file from a S3 bucket. Other people downloading the same file would get the same "protection", but in this case this goes a step further: The S3 bucket itself gets then blacklisted. As it was a private bucket, one of the ways this could happen is that once chrome found the blacklisted URL, it sent back to Google the url (s3 bucket) where the file with the blacklisted URL was found.