7 ms·

Stuff like this is why I never use those "block malicious sites" sort of features -- not only because I assume they involve sending every URL I access to some k

Stuff like this is why I never use those "block malicious sites" sort of features -- not only because I assume they involve sending every URL I access to some kind of checking service, but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy". Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? To me there's also some irony to the name "Google Safe Browsing", because IMHO that is an oxymoron -- browsing with Chrome is never "safe" for you because of the inherent/persistent violations of your privacy.

cmeacham98 4y ago
As much as I love to hate Google: > not only because I assume they involve sending every URL I access to some kind of checking service This isn't even remotely close to true. > but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy" Maybe you're a genius that can navigate the web with ease, but the reality is this feature has probably stopped millions or even billions of malware downloads and/or phishing attempts. > Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? Safe browsing is more about stopping people from accidentally downloading malware or falling for a phish, and very little about exploits in the browser itself which are few and far between.
- krono 4y ago
  At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled. https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html https://security.googleblog.com/2022/08/how-hash-based-safe-... https://security.googleblog.com/2020/05/enhanced-safe-browsing-protection-now.html https://security.googleblog.com/2020/05/enhanced-safe-browsi...
  - cmeacham98 4y ago
    "Some data" is WAY different than "Google receives the URL of every page you visit". I'm not saying Google's Safe Browsing feature is immune to criticism, but when someone posts such blatantly false information it discredits everything else they have to say on the topic.
    - amatecha 4y ago
      Please stop misrepresenting what I said and reacting vocally as a result of your misunderstanding. I didn't assert that every URL is sent. I _assume_ every URL is sent, because that's my "threat model" regarding this feature. I have no reason to trust them, and have every reason to _assume_ that every URL is sent if I use a feature like that.
      - cmeacham98 4y ago
        amatecha 4y ago
        I didn't "understand" anything incorrectly -- I made zero attempt to understand the feature. How many times do I have to quote the word "assume"? I ASSUMED the worst without knowing anything about the feature, based on my prior experience with "protecting the user" features and the way megacorps treat their users. I thought "probably sends my stuff to their servers" and unchecked the box. Again, for the nth time, I have made no concrete assertion as to the actual functioning of the feature. The only misinformation here has been your repeated misrepresentation of what I communicated.
        cmeacham98 4y ago
        Sorry, let me restate my original post then: I ASSUME that you're completely wrong about Safe Browsing and have no idea what you're talking about. I ASSUME you're intentionally posting misinformation on the internet. I ASSUME you're as evil as Adolf Hitler. If you prove that what I ASSUMED is demonstrably false, I'll just fall back on saying it's an assumption so that makes being wrong completely ok (and it means that you are misrepresenting me when you call that out)!
- amatecha 4y ago
  Yeah for the first thing, I said I assume it -- I wasn't actually making an assertion that all the requests get sent to a server. I can't realistically spend the effort to double-check every single thing like this (as in how badly every corp is spying on me), and it's substantially easier to just assume the worst and act accordingly. Right, I'm sure the "Safe Browsing" stuff has prevented downloads of .exes that the user never would have run anyways (but I digress). Regardless, I still am not going to rely on shareholder-driven megacorps to decide what sites I can trust or not. They have proven they are not trustworthy themselves. To start, Google does things like hiding portions of the URL of the website you're on[0], making the web browsing experience even more opaque than it already is for the average user. In fact, Google has even engaged in phishing-like behaviour themselves, replacing an original website with their own AMP version, while showing the original URL[1]. Of course, this is all without even touching on the shocking depth of surveillance/tracking undertaken by Google. Regarding exploits in the browser iself, in fact, the extremely massive surface area of web browser software is indeed absolutely a vector for malware. In this sense, Safe Browsing is a solution to a problem browser vendors created by nearly turning the web browser into an OS. By April this year, Chrome had already hit its third zero-day exploit[2] affecting its billions of users. By last month, it had hit its seventh[3]. Basically every month or two there's a new actively-exploited vulnerability in Chrome that may very well allow malware to be installed on your system by simply visiting a web page. If only trying to read some text on a website didn't mean risking having my home network turned into a botnet, or getting ransomware-locked... [0] https://www.bleepingcomputer.com/news/google/google-chrome-hides-www-and-https-in-the-address-bar-again/ https://www.bleepingcomputer.com/news/google/google-chrome-h... [1] https://www.androidpolice.com/2019/04/16/amp-pages-will-now-show-original-url-in-chromes-address-bar/ https://www.androidpolice.com/2019/04/16/amp-pages-will-now-... [2] https://www.forbes.com/sites/gordonkelly/2022/04/16/google-chrome-hack-attacks-zero-day-exploit-new-chrome-release https://www.forbes.com/sites/gordonkelly/2022/04/16/google-c... [3] https://www.forbes.com/sites/daveywinder/2022/10/28/emergency-chrome-security-update-google-confirms-0day-attack-threat/ https://www.forbes.com/sites/daveywinder/2022/10/28/emergenc...
  - olliej 4y ago
    Except [0] has been demonstrated to actually be more useful for average users, as it hides parts of the url that are not actually relevant. I don't know what google's current UI for it is, but in safari by default https:// https:// is not shown. Instead if you visit a http: site you get a completely different UI "not secure - example.com". The reason for these UI changes is very simple: signaling secure vs insecure via a single character in a string that is meaningless to most people makes it essentially useless. Similarly making "secure" websites get a padlock is not helpful - it's essentially the same as a car engine light, except the engine light is surrounded by a dozen other lights, and it turns off when there's a problem. Unending amounts of research show that that kind of design means people will not notice problems. This is not to say Google is a shining example of privacy engineering (see their core business model), but you're being incredibly dismissive of the work that their chrome and browser privacy engineering teams do.
olliej 4y ago
Ok, so it sounds like you misunderstand how the Safe Browsing system works. If you want to be a provider of url blocking you do the following: 1. Compile a list of "unsafe" urls (malware, phishing, cookie clicker, etc) 2. Generate a SHA256 hash of every url in (1) 3. Truncate those hashes to 32 bits (Because there are a lot of them :( ) 4. Publish that list If you're writing a client that wants to use these providers you do this: 1. Download the list published above 2. Before you load a url calculate a SHA256 hash of that url 3. Truncate that hash to 32 bits 4. Check your giant list of hashes to see if there's a collision. 5. If there is no collision you're done, and carry on the load as usual; otherwise 6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3) 7. See if the hash from (2) is in the full hashes you get in (6). 8. If there is no collision then load the url, otherwise display scary warnings. You can see that at no point does the url being checked go in either direction.
- amatecha 4y ago
  Oh, no, I didn't even look into it. I only just tonight read the docs about these features in Chrome & Firefox for the first time. I see "modern-day NetNanny" and turn it off. I quite literally assume the worst and disable it.
- piaste 4y ago
  > 3. Truncate those hashes to 32 bits (Because there are a lot of them :( ) Is it worth all this trouble just to get a Nx space saving? Because if you just published the 256-bit hashes directly, you could skip the following steps entirely: > 6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3) > 7. See if the hash from (2) is in the full hashes you get in (6). which are the parts that require an actual network call, infrastructure costs, and privacy issues. Speaking of which: > You can see that at no point does the url being checked go in either direction. You're not sending the whole URL, but in step (6) you're still telling the source that you're visiting a website belonging to a particular subset of hashes, hashes which the source knows the plaintext of. I guess the question is exactly how large the set of 'unsafe' urls is. If it's merely in the billions, then (a) truncating the hashes will only get you a roughly ~4x space saving and (b) the 32-bit hashes you send will almost uniquely identify the website you tried to visit. If it's in the trillions, then it makes more sense.

cmeacham98 4y ago

As much as I love to hate Google: > not only because I assume they involve sending every URL I access to some kind of checking service This isn't even remotely close to true. > but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy" Maybe you're a genius that can navigate the web with ease, but the reality is this feature has probably stopped millions or even billions of malware downloads and/or phishing attempts. > Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? Safe browsing is more about stopping people from accidentally downloading malware or falling for a phish, and very little about exploits in the browser itself which are few and far between.

krono 4y ago
At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled. https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html https://security.googleblog.com/2022/08/how-hash-based-safe-... https://security.googleblog.com/2020/05/enhanced-safe-browsing-protection-now.html https://security.googleblog.com/2020/05/enhanced-safe-browsi...
- cmeacham98 4y ago
  "Some data" is WAY different than "Google receives the URL of every page you visit". I'm not saying Google's Safe Browsing feature is immune to criticism, but when someone posts such blatantly false information it discredits everything else they have to say on the topic.
  - amatecha 4y ago
    Please stop misrepresenting what I said and reacting vocally as a result of your misunderstanding. I didn't assert that every URL is sent. I _assume_ every URL is sent, because that's my "threat model" regarding this feature. I have no reason to trust them, and have every reason to _assume_ that every URL is sent if I use a feature like that.
    - cmeacham98 4y ago
      - amatecha 4y ago
        I didn't "understand" anything incorrectly -- I made zero attempt to understand the feature. How many times do I have to quote the word "assume"? I ASSUMED the worst without knowing anything about the feature, based on my prior experience with "protecting the user" features and the way megacorps treat their users. I thought "probably sends my stuff to their servers" and unchecked the box. Again, for the nth time, I have made no concrete assertion as to the actual functioning of the feature. The only misinformation here has been your repeated misrepresentation of what I communicated.
        cmeacham98 4y ago
        Sorry, let me restate my original post then: I ASSUME that you're completely wrong about Safe Browsing and have no idea what you're talking about. I ASSUME you're intentionally posting misinformation on the internet. I ASSUME you're as evil as Adolf Hitler. If you prove that what I ASSUMED is demonstrably false, I'll just fall back on saying it's an assumption so that makes being wrong completely ok (and it means that you are misrepresenting me when you call that out)!
amatecha 4y ago
Yeah for the first thing, I said I assume it -- I wasn't actually making an assertion that all the requests get sent to a server. I can't realistically spend the effort to double-check every single thing like this (as in how badly every corp is spying on me), and it's substantially easier to just assume the worst and act accordingly. Right, I'm sure the "Safe Browsing" stuff has prevented downloads of .exes that the user never would have run anyways (but I digress). Regardless, I still am not going to rely on shareholder-driven megacorps to decide what sites I can trust or not. They have proven they are not trustworthy themselves. To start, Google does things like hiding portions of the URL of the website you're on[0], making the web browsing experience even more opaque than it already is for the average user. In fact, Google has even engaged in phishing-like behaviour themselves, replacing an original website with their own AMP version, while showing the original URL[1]. Of course, this is all without even touching on the shocking depth of surveillance/tracking undertaken by Google. Regarding exploits in the browser iself, in fact, the extremely massive surface area of web browser software is indeed absolutely a vector for malware. In this sense, Safe Browsing is a solution to a problem browser vendors created by nearly turning the web browser into an OS. By April this year, Chrome had already hit its third zero-day exploit[2] affecting its billions of users. By last month, it had hit its seventh[3]. Basically every month or two there's a new actively-exploited vulnerability in Chrome that may very well allow malware to be installed on your system by simply visiting a web page. If only trying to read some text on a website didn't mean risking having my home network turned into a botnet, or getting ransomware-locked... [0] https://www.bleepingcomputer.com/news/google/google-chrome-hides-www-and-https-in-the-address-bar-again/ https://www.bleepingcomputer.com/news/google/google-chrome-h... [1] https://www.androidpolice.com/2019/04/16/amp-pages-will-now-show-original-url-in-chromes-address-bar/ https://www.androidpolice.com/2019/04/16/amp-pages-will-now-... [2] https://www.forbes.com/sites/gordonkelly/2022/04/16/google-chrome-hack-attacks-zero-day-exploit-new-chrome-release https://www.forbes.com/sites/gordonkelly/2022/04/16/google-c... [3] https://www.forbes.com/sites/daveywinder/2022/10/28/emergency-chrome-security-update-google-confirms-0day-attack-threat/ https://www.forbes.com/sites/daveywinder/2022/10/28/emergenc...
- olliej 4y ago
  Except [0] has been demonstrated to actually be more useful for average users, as it hides parts of the url that are not actually relevant. I don't know what google's current UI for it is, but in safari by default https:// https:// is not shown. Instead if you visit a http: site you get a completely different UI "not secure - example.com". The reason for these UI changes is very simple: signaling secure vs insecure via a single character in a string that is meaningless to most people makes it essentially useless. Similarly making "secure" websites get a padlock is not helpful - it's essentially the same as a car engine light, except the engine light is surrounded by a dozen other lights, and it turns off when there's a problem. Unending amounts of research show that that kind of design means people will not notice problems. This is not to say Google is a shining example of privacy engineering (see their core business model), but you're being incredibly dismissive of the work that their chrome and browser privacy engineering teams do.

olliej 4y ago

Ok, so it sounds like you misunderstand how the Safe Browsing system works. If you want to be a provider of url blocking you do the following: 1. Compile a list of "unsafe" urls (malware, phishing, cookie clicker, etc) 2. Generate a SHA256 hash of every url in (1) 3. Truncate those hashes to 32 bits (Because there are a lot of them :( ) 4. Publish that list If you're writing a client that wants to use these providers you do this: 1. Download the list published above 2. Before you load a url calculate a SHA256 hash of that url 3. Truncate that hash to 32 bits 4. Check your giant list of hashes to see if there's a collision. 5. If there is no collision you're done, and carry on the load as usual; otherwise 6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3) 7. See if the hash from (2) is in the full hashes you get in (6). 8. If there is no collision then load the url, otherwise display scary warnings. You can see that at no point does the url being checked go in either direction.

amatecha 4y ago
Oh, no, I didn't even look into it. I only just tonight read the docs about these features in Chrome & Firefox for the first time. I see "modern-day NetNanny" and turn it off. I quite literally assume the worst and disable it.
piaste 4y ago
> 3. Truncate those hashes to 32 bits (Because there are a lot of them :( ) Is it worth all this trouble just to get a Nx space saving? Because if you just published the 256-bit hashes directly, you could skip the following steps entirely: > 6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3) > 7. See if the hash from (2) is in the full hashes you get in (6). which are the parts that require an actual network call, infrastructure costs, and privacy issues. Speaking of which: > You can see that at no point does the url being checked go in either direction. You're not sending the whole URL, but in step (6) you're still telling the source that you're visiting a website belonging to a particular subset of hashes, hashes which the source knows the plaintext of. I guess the question is exactly how large the set of 'unsafe' urls is. If it's merely in the billions, then (a) truncating the hashes will only get you a roughly ~4x space saving and (b) the 32-bit hashes you send will almost uniquely identify the website you tried to visit. If it's in the trillions, then it makes more sense.