3 ms·

Even DNS is pretty WTF worthy if you think about it. Contacting a third party about the website you're about to visit. On an unencrypted channel no less. Anoth

Even DNS is pretty WTF worthy if you think about it. Contacting a third party about the website you're about to visit. On an unencrypted channel no less. Another third party request is Firefox's phishing/malware protection. It periodically downloads their own bad site collection and if you visit a site, it check if it's on the list. And if it isn't, it checks with Google if the site is okay. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-does-phishing-and-malware-protection-work-in-firefox https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... P.s. Tor Browser turns this Safe Browsing feature off. Looks like I'm on the same page as them on the implications of it.

account42 5y ago
Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. But even without the privacy issue, you should turn off save browsing because google should not be in control of what users can and cannot donwload. They clearly do not care about keeping that list free of false positives, for example: http://dege.freeweb.hu/dgVoodoo2/ http://dege.freeweb.hu/dgVoodoo2/ > It does NOT contain any malware. Use a browser that is free of Google Shit Browsing security service crap (which is based on tons of noname antivirus "engines", look at VirusTotal if interested). I have also experienced Googles disregard for false positives on that list myself. While they may "remove" false listings after you bug them, those entries will just be re-added the next week and of course because this is Google there is no way to get an actual human to look into it. It is insane that all browsers allow a private company to maintain such a list without complete transparency and publicly visible reasoning for why each entry is in it as well as well defined procedures to contest false postives with agagain, publicly visible reasons for denial.
- dblohm7 5y ago
  > Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. That's not how Firefox does safe browsing. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... "One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe."
  - account42 5y ago
    Apparently it is how it used to work though for some settings, which is bad enough, and still sends partial hashes in some cases which can leak some information. Even just making any connections to Google (or another provider) without the user explicitly visiting a Google website is a privacy issue that Firefox should resolve. It also does not adress the problem with making Google the gatekeeper deciding what you can and cannot download - and don't tell me its just a warning, its set up in such a way that regular users will often not even know that they can bypass it.
dblohm7 5y ago
That's not how Firefox does safe browsing. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... "One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe."
- npteljes 5y ago
  Thanks, I think I get it now. What ends up happening with Safe Browsing enabled 1. Firefox checks it own list locally, which it updates every 30 mins 2. If not found, it chops off query params from the url, hashes it, chops the hash to a smaller size 3. Creates several bogus hashes, then checks them all with Google's Safe Browsing service.

account42 5y ago

Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. But even without the privacy issue, you should turn off save browsing because google should not be in control of what users can and cannot donwload. They clearly do not care about keeping that list free of false positives, for example: http://dege.freeweb.hu/dgVoodoo2/ http://dege.freeweb.hu/dgVoodoo2/ > It does NOT contain any malware. Use a browser that is free of Google Shit Browsing security service crap (which is based on tons of noname antivirus "engines", look at VirusTotal if interested). I have also experienced Googles disregard for false positives on that list myself. While they may "remove" false listings after you bug them, those entries will just be re-added the next week and of course because this is Google there is no way to get an actual human to look into it. It is insane that all browsers allow a private company to maintain such a list without complete transparency and publicly visible reasoning for why each entry is in it as well as well defined procedures to contest false postives with agagain, publicly visible reasons for denial.

dblohm7 5y ago
> Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. That's not how Firefox does safe browsing. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... "One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe."
- account42 5y ago
  Apparently it is how it used to work though for some settings, which is bad enough, and still sends partial hashes in some cases which can leak some information. Even just making any connections to Google (or another provider) without the user explicitly visiting a Google website is a privacy issue that Firefox should resolve. It also does not adress the problem with making Google the gatekeeper deciding what you can and cannot download - and don't tell me its just a warning, its set up in such a way that regular users will often not even know that they can bypass it.

dblohm7 5y ago

That's not how Firefox does safe browsing. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... "One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe."

npteljes 5y ago
Thanks, I think I get it now. What ends up happening with Safe Browsing enabled 1. Firefox checks it own list locally, which it updates every 30 mins 2. If not found, it chops off query params from the url, hashes it, chops the hash to a smaller size 3. Creates several bogus hashes, then checks them all with Google's Safe Browsing service.