4 ms·

Are you implying that the list no longer has a good intention? I wouldn't be surprised if there are multiple orders of magnitude more phishing and hacked websit

Are you implying that the list no longer has a good intention? I wouldn't be surprised if there are multiple orders of magnitude more phishing and hacked websites in 2021 than there was in 2004. Even with human checking, I doubt you'll even have 0% failure rate. Is the solution to just give up on blocking phishing sites?

cft 6y ago
The solution is for the legitimate sites that are driven out of business by Google AI to sue Google for tortuous interference and libel.
- nearbuy 6y ago
  This helps one group and hurts another. If Google is liable for blocking potential malware and phishing pages, they'll either stop blocking it, or adjust their algorithm to strongly err on the side of allowing phishing sites. Businesses become safer, but more regular people will get phished.
  - coldtea 6y ago
    >or adjust their algorithm to strongly err on the side of allowing phishing sites. It'a not the role of Google to disallow phishing sites (as a browser) just like it's not the role of the ISP. Make it hookable so people can chose their own phising protection service.
    - msh 6y ago
      And then they will choose the same block list and sites will have the same problem.
      - coldtea 6y ago
        All? I doubt it. Not to mention they could offer control to override whatever you like.
        msh 6y ago
        Well enough that it will still be a blocker.
        coldtea 6y ago
        Well, that goes without saying. If you want a blocker, you want a blocker. So all the nigerian princes and the like should still be blocked. You just don't want to give control over the blocking blacklist/whitelist to a single entity, even less so to a huge powerful one, possibly in a country other than your own (which e.g. forces their foreign policy dictums to your blacklist), and even less so the one that already makes your browser, that should be a totally neutral conduit.
        nearbuy 6y ago
        I don't think this solves the problem from the article, since small businesses will still have to deal with getting mistakenly blocked by whatever the popular blockers are. With 40,000 new phishing sites per week, it's not an easy task. If the blockers are free (I imagine they'd have to be to get widespread adoption), who's going to review the false positives? Volunteers? But also, it would leave the people most vulnerable to phishing unprotected, namely those not tech-savvy enough to install a phishing protection service. Most internet users don't even have ad-blockers.
        nearbuy 6y ago
        > they could offer control to override Chrome lets you override and proceed to the site. The problem for the small business is that a large fraction of their customers see the scary red warning page.
    - bonoboTP 6y ago
      People wouldn't know or care which to pick. They would see the pop-up asking to select a phishing protection provider, would get confused and angry and think "where do I click to get past this pop-up, I want to go on Facebook and this stupid computer is nagging me with stuff again!" Phishing protection is mostly needed for people who have no clear concept of phishing or technicalities. They just want to do things on the internet, like social media, they don't care about things behind the scenes, that's boring uncool nerd stuff.
  - fredophile 6y ago
    The problem isn't the company that blocked it. The problem is the company that reported that there was a problem when there wasn't. In this case it sounds like Google is both companies.
encom 6y ago
>Is the solution to just give up on blocking phishing sites? IMHO yes. It's too much power for one company to wield. And especially a company with such questionable morals as Google. This cure is worse than the disease.
- fbi-director 6y ago
  I thought you said, the curse is worse than the disease... which also would've made sense.
kovac 6y ago
The failure rate doesn't need to be 0%. If the solution is good, at least it'll be close to 0% which means that it'd be possible for the vendor to provide better support for the small number of mistakes so that they can be clearly explained to the affected party and rectified more quickly. If the failure rate is too high to make better support infeasible, then the current solution is not really a good one and we need to consider a revision.
hutzlibu 6y ago
" Is the solution to just give up on blocking phishing sites?" But maybe not do it by default on browser-level. But if you do, then there really needs to be ways to combat wrong decisions in a timely manner.
donmcronald 6y ago
> Are you implying that the list no longer has a good intention? Most of the time I run into blocked sites they seem to be blocked because of copyright infringement, not phishing. The only phishing sites I've seen in the last year or so are custom tailored. For example, I had to deal with a compromised MS365 account last year where the bad actor spun up a custom phishing site using the logo, signature, etc. of the victim. So IMHO the intentions are no longer pure plus the effect is diminished and being worked around.

cft 6y ago

The solution is for the legitimate sites that are driven out of business by Google AI to sue Google for tortuous interference and libel.

nearbuy 6y ago
This helps one group and hurts another. If Google is liable for blocking potential malware and phishing pages, they'll either stop blocking it, or adjust their algorithm to strongly err on the side of allowing phishing sites. Businesses become safer, but more regular people will get phished.
- coldtea 6y ago
  >or adjust their algorithm to strongly err on the side of allowing phishing sites. It'a not the role of Google to disallow phishing sites (as a browser) just like it's not the role of the ISP. Make it hookable so people can chose their own phising protection service.
  - msh 6y ago
    And then they will choose the same block list and sites will have the same problem.
    - coldtea 6y ago
      All? I doubt it. Not to mention they could offer control to override whatever you like.
      - msh 6y ago
        Well enough that it will still be a blocker.
        coldtea 6y ago
        Well, that goes without saying. If you want a blocker, you want a blocker. So all the nigerian princes and the like should still be blocked. You just don't want to give control over the blocking blacklist/whitelist to a single entity, even less so to a huge powerful one, possibly in a country other than your own (which e.g. forces their foreign policy dictums to your blacklist), and even less so the one that already makes your browser, that should be a totally neutral conduit.
        nearbuy 6y ago
        I don't think this solves the problem from the article, since small businesses will still have to deal with getting mistakenly blocked by whatever the popular blockers are. With 40,000 new phishing sites per week, it's not an easy task. If the blockers are free (I imagine they'd have to be to get widespread adoption), who's going to review the false positives? Volunteers? But also, it would leave the people most vulnerable to phishing unprotected, namely those not tech-savvy enough to install a phishing protection service. Most internet users don't even have ad-blockers.
      - nearbuy 6y ago
        > they could offer control to override Chrome lets you override and proceed to the site. The problem for the small business is that a large fraction of their customers see the scary red warning page.
  - bonoboTP 6y ago
    People wouldn't know or care which to pick. They would see the pop-up asking to select a phishing protection provider, would get confused and angry and think "where do I click to get past this pop-up, I want to go on Facebook and this stupid computer is nagging me with stuff again!" Phishing protection is mostly needed for people who have no clear concept of phishing or technicalities. They just want to do things on the internet, like social media, they don't care about things behind the scenes, that's boring uncool nerd stuff.
- fredophile 6y ago
  The problem isn't the company that blocked it. The problem is the company that reported that there was a problem when there wasn't. In this case it sounds like Google is both companies.

encom 6y ago

>Is the solution to just give up on blocking phishing sites? IMHO yes. It's too much power for one company to wield. And especially a company with such questionable morals as Google. This cure is worse than the disease.

fbi-director 6y ago
I thought you said, the curse is worse than the disease... which also would've made sense.

kovac 6y ago

The failure rate doesn't need to be 0%. If the solution is good, at least it'll be close to 0% which means that it'd be possible for the vendor to provide better support for the small number of mistakes so that they can be clearly explained to the affected party and rectified more quickly. If the failure rate is too high to make better support infeasible, then the current solution is not really a good one and we need to consider a revision.

hutzlibu 6y ago

" Is the solution to just give up on blocking phishing sites?" But maybe not do it by default on browser-level. But if you do, then there really needs to be ways to combat wrong decisions in a timely manner.

donmcronald 6y ago

> Are you implying that the list no longer has a good intention? Most of the time I run into blocked sites they seem to be blocked because of copyright infringement, not phishing. The only phishing sites I've seen in the last year or so are custom tailored. For example, I had to deal with a compromised MS365 account last year where the bad actor spun up a custom phishing site using the logo, signature, etc. of the victim. So IMHO the intentions are no longer pure plus the effect is diminished and being worked around.