7 ms·

Google Safe Browsing is blocking small Mastodon servers

106 points by brenns10 4y ago

dontbenebby 4y ago
brenns10 4y ago
Hi folks, my Mastodon server is now blocked as a "deceptive site," likely because its login pages are similar to other Mastodon servers. To a machine learning or rule-based system, I could see how that seems deceptive. But I'm now stuck in a several days to several weeks long wait for manual review. And of course there's no guarantee that manual review will result in a correct decision. Meanwhile, it's truly incredible how fully my site is now blocked off from the world. Firefox Android won't even let me access it, while Chrome hides the click-through underneath the "details" button. My friends who use the site are understandably concerned, but there's not much I can do. It's crazy how a false positive in one centralized system can impact my little piece of the fediverse.
- thrtythreeforty 4y ago
  Pushbullet has also learned the hard way how to respond to Google's faceless review process: > Now that you know you’re up against an automated policy enforcement AI, your goal is to look as much as possible like the training data. Unfortunately, this can be easier said than done since we do not have access to the training data. > All is not lost, however. You have actionable info in the simple fact that what your app looks like now is not acceptable. https://blog.pushbullet.com/2022/10/27/how-we-became-the-worlds-foremost-expert-on-google-play-store-policy-violations/ https://blog.pushbullet.com/2022/10/27/how-we-became-the-wor...
- brenns10 4y ago
  As an update, Google's "warning level" seems to have dropped to Yellow from Red: https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fsnake.club https://transparencyreport.google.com/safe-browsing/search?u... I still see an exclamation mark in mobile Chrome, but it looks like the big scary red interstitial is gone from most browsers I've seen. Perhaps it was enough different people reporting false positive? Or maybe a re-scan or manual action. Unclear but it's appreciated. Wish there was more transparency (ironic given the "transparencyreport" subdomain that URL is hosted at).
josephcsible 4y ago
Firefox on Android says this: > has been reported as a deceptive site and has been blocked based on your security preferences. I checked its settings page and saw no such preference, and about:config is a blank page there. So where is this alleged preference?
- brenns10 4y ago
  I don't know, I got that exact error and searched the settings. I couldn't find that preference either.
  - Ptchd 4y ago
    maybe the "safe browsing" setting that uses a list from google to block sites (which I always disable)... Mozilla is in bed with Google on so many levels...
    - metadat 4y ago
      On Firefox Android there is no such option displayed in the settings.
      - Ptchd 4y ago
        It is hidden in about:config, I believe....
        metadat 4y ago
        What good is that? 99.9% or more of users will never visit this page or know what to do with it, much less be able to figure out which knob to toggle. It's a product design failure to say "blocked because your configuration says so!" and then hide it from settings.
        Ptchd 4y ago
        Firefox for Android sucks... but it sucks less then the alternatives, as far as I know
nic-waller 4y ago
I saw a similar aggressively red warning on Mobile Safari. Apparently it uses the same database of "deceptive" pages. I turned off "Fraudulent Website Warning" in Settings and then I was able to access your site.
- account42 4y ago
  Yes, sadly all browser's just trust Google even when Google has shown that they don't care about false positives.
amatecha 4y ago
Stuff like this is why I never use those "block malicious sites" sort of features -- not only because I assume they involve sending every URL I access to some kind of checking service, but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy". Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? To me there's also some irony to the name "Google Safe Browsing", because IMHO that is an oxymoron -- browsing with Chrome is never "safe" for you because of the inherent/persistent violations of your privacy.
- cmeacham98 4y ago
  As much as I love to hate Google: > not only because I assume they involve sending every URL I access to some kind of checking service This isn't even remotely close to true. > but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy" Maybe you're a genius that can navigate the web with ease, but the reality is this feature has probably stopped millions or even billions of malware downloads and/or phishing attempts. > Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? Safe browsing is more about stopping people from accidentally downloading malware or falling for a phish, and very little about exploits in the browser itself which are few and far between.
  - krono 4y ago
    At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled. https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html https://security.googleblog.com/2022/08/how-hash-based-safe-... https://security.googleblog.com/2020/05/enhanced-safe-browsing-protection-now.html https://security.googleblog.com/2020/05/enhanced-safe-browsi...
    - 4y ago
throwawayyuno 4y ago
Google has also been blocking access to a lot (read: more than 1) of Yunohost selfhosted servers lately: https://forum.yunohost.org/t/google-flags-my-sites-as-dangerous-deceptive-site-ahead/20361/104 https://forum.yunohost.org/t/google-flags-my-sites-as-danger... My server hosted at home got flagged. After 2 weeks of submitting appeals every 3-4 days it was finally reviewed and the flag was removed. How did we let megacorps have so much control over who can access our websites?!
account42 4y ago
Good to see more people realizing the kind of control browser makers give Google via this misfeature. It should not be acceptable for an unaccountable for-profit corporation to decide what the average person can or cannot see without any due process for site operators. Yet here we are. Get you software flagged by machine-learning algorithms? Too bad, pretty much every browser will prevent users from downloading it. And yes, prevent - even those browsers that still provide an override hide it well enough that many users will not find it. Appeal? If you are lucky and Google doesn't just deny it without reason then look forward to getting re-listed in a couple of weeks.
Am4TIfIsER0ppos 4y ago
This thread has been a good reminder to go check your settings in about:config. I was unaware that firefox had turned one single option into several which seem to be on by default ignoring my previous change.

106 points by brenns10 4y ago

Hi folks, my Mastodon server is now blocked as a "deceptive site," likely because its login pages are similar to other Mastodon servers. To a machine learning or rule-based system, I could see how that seems deceptive. But I'm now stuck in a several days to several weeks long wait for manual review. And of course there's no guarantee that manual review will result in a correct decision. Meanwhile, it's truly incredible how fully my site is now blocked off from the world. Firefox Android won't even let me access it, while Chrome hides the click-through underneath the "details" button. My friends who use the site are understandably concerned, but there's not much I can do. It's crazy how a false positive in one centralized system can impact my little piece of the fediverse.

thrtythreeforty 4y ago
Pushbullet has also learned the hard way how to respond to Google's faceless review process: > Now that you know you’re up against an automated policy enforcement AI, your goal is to look as much as possible like the training data. Unfortunately, this can be easier said than done since we do not have access to the training data. > All is not lost, however. You have actionable info in the simple fact that what your app looks like now is not acceptable. https://blog.pushbullet.com/2022/10/27/how-we-became-the-worlds-foremost-expert-on-google-play-store-policy-violations/ https://blog.pushbullet.com/2022/10/27/how-we-became-the-wor...
brenns10 4y ago
As an update, Google's "warning level" seems to have dropped to Yellow from Red: https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fsnake.club https://transparencyreport.google.com/safe-browsing/search?u... I still see an exclamation mark in mobile Chrome, but it looks like the big scary red interstitial is gone from most browsers I've seen. Perhaps it was enough different people reporting false positive? Or maybe a re-scan or manual action. Unclear but it's appreciated. Wish there was more transparency (ironic given the "transparencyreport" subdomain that URL is hosted at).

josephcsible 4y ago

Firefox on Android says this: > has been reported as a deceptive site and has been blocked based on your security preferences. I checked its settings page and saw no such preference, and about:config is a blank page there. So where is this alleged preference?

brenns10 4y ago
I don't know, I got that exact error and searched the settings. I couldn't find that preference either.
- Ptchd 4y ago
  maybe the "safe browsing" setting that uses a list from google to block sites (which I always disable)... Mozilla is in bed with Google on so many levels...
  - metadat 4y ago
    On Firefox Android there is no such option displayed in the settings.
    - Ptchd 4y ago
      It is hidden in about:config, I believe....
      - metadat 4y ago
        What good is that? 99.9% or more of users will never visit this page or know what to do with it, much less be able to figure out which knob to toggle. It's a product design failure to say "blocked because your configuration says so!" and then hide it from settings.
        Ptchd 4y ago
        Firefox for Android sucks... but it sucks less then the alternatives, as far as I know

nic-waller 4y ago

I saw a similar aggressively red warning on Mobile Safari. Apparently it uses the same database of "deceptive" pages. I turned off "Fraudulent Website Warning" in Settings and then I was able to access your site.

account42 4y ago
Yes, sadly all browser's just trust Google even when Google has shown that they don't care about false positives.

amatecha 4y ago

Stuff like this is why I never use those "block malicious sites" sort of features -- not only because I assume they involve sending every URL I access to some kind of checking service, but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy". Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? To me there's also some irony to the name "Google Safe Browsing", because IMHO that is an oxymoron -- browsing with Chrome is never "safe" for you because of the inherent/persistent violations of your privacy.

cmeacham98 4y ago
As much as I love to hate Google: > not only because I assume they involve sending every URL I access to some kind of checking service This isn't even remotely close to true. > but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy" Maybe you're a genius that can navigate the web with ease, but the reality is this feature has probably stopped millions or even billions of malware downloads and/or phishing attempts. > Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? Safe browsing is more about stopping people from accidentally downloading malware or falling for a phish, and very little about exploits in the browser itself which are few and far between.
- krono 4y ago
  At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled. https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html https://security.googleblog.com/2022/08/how-hash-based-safe-... https://security.googleblog.com/2020/05/enhanced-safe-browsing-protection-now.html https://security.googleblog.com/2020/05/enhanced-safe-browsi...
  - 4y ago

throwawayyuno 4y ago

Google has also been blocking access to a lot (read: more than 1) of Yunohost selfhosted servers lately: https://forum.yunohost.org/t/google-flags-my-sites-as-dangerous-deceptive-site-ahead/20361/104 https://forum.yunohost.org/t/google-flags-my-sites-as-danger... My server hosted at home got flagged. After 2 weeks of submitting appeals every 3-4 days it was finally reviewed and the flag was removed. How did we let megacorps have so much control over who can access our websites?!

account42 4y ago

Good to see more people realizing the kind of control browser makers give Google via this misfeature. It should not be acceptable for an unaccountable for-profit corporation to decide what the average person can or cannot see without any due process for site operators. Yet here we are. Get you software flagged by machine-learning algorithms? Too bad, pretty much every browser will prevent users from downloading it. And yes, prevent - even those browsers that still provide an override hide it well enough that many users will not find it. Appeal? If you are lucky and Google doesn't just deny it without reason then look forward to getting re-listed in a couple of weeks.

Am4TIfIsER0ppos 4y ago

This thread has been a good reminder to go check your settings in about:config. I was unaware that firefox had turned one single option into several which seem to be on by default ignoring my previous change.