5 ms·

As much as I love to hate Google: > not only because I assume they involve sending every URL I access to some kind of checking service This isn't even remotel

As much as I love to hate Google: > not only because I assume they involve sending every URL I access to some kind of checking service This isn't even remotely close to true. > but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy" Maybe you're a genius that can navigate the web with ease, but the reality is this feature has probably stopped millions or even billions of malware downloads and/or phishing attempts. > Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems? Safe browsing is more about stopping people from accidentally downloading malware or falling for a phish, and very little about exploits in the browser itself which are few and far between.

krono 4y ago
At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled. https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html https://security.googleblog.com/2022/08/how-hash-based-safe-... https://security.googleblog.com/2020/05/enhanced-safe-browsing-protection-now.html https://security.googleblog.com/2020/05/enhanced-safe-browsi...
- cmeacham98 4y ago
  "Some data" is WAY different than "Google receives the URL of every page you visit". I'm not saying Google's Safe Browsing feature is immune to criticism, but when someone posts such blatantly false information it discredits everything else they have to say on the topic.
  - amatecha 4y ago
    Please stop misrepresenting what I said and reacting vocally as a result of your misunderstanding. I didn't assert that every URL is sent. I _assume_ every URL is sent, because that's my "threat model" regarding this feature. I have no reason to trust them, and have every reason to _assume_ that every URL is sent if I use a feature like that.
    - cmeacham98 4y ago
      - amatecha 4y ago
        I didn't "understand" anything incorrectly -- I made zero attempt to understand the feature. How many times do I have to quote the word "assume"? I ASSUMED the worst without knowing anything about the feature, based on my prior experience with "protecting the user" features and the way megacorps treat their users. I thought "probably sends my stuff to their servers" and unchecked the box. Again, for the nth time, I have made no concrete assertion as to the actual functioning of the feature. The only misinformation here has been your repeated misrepresentation of what I communicated.
        cmeacham98 4y ago
        Sorry, let me restate my original post then: I ASSUME that you're completely wrong about Safe Browsing and have no idea what you're talking about. I ASSUME you're intentionally posting misinformation on the internet. I ASSUME you're as evil as Adolf Hitler. If you prove that what I ASSUMED is demonstrably false, I'll just fall back on saying it's an assumption so that makes being wrong completely ok (and it means that you are misrepresenting me when you call that out)!
        amatecha 4y ago
        Ah man... I mean, at no time did I indicate or suggest how Safe Browsing works. What I communicated to the world is that I am making a totally subjective judgement of a feature, perhaps totally ignorantly, without any suggestion of correlation with reality. For some reason, you missed this subtlety of me saying "I assume [thing does blah]". I'm not out here trying to convince anyone that Safe Browsing does bad things. I pretty clearly said I, myself, in my own head, made a subjective decision about the feature. That's all I said! Come back to this thread in a day or month or year and realize I was pretty forthright/honest and communicating in good faith the entire time.
  - krono 4y ago
    It is also quite a ways away from "This isn't even remotely close to true.", which is what I felt the need to correct.
amatecha 4y ago
Yeah for the first thing, I said I assume it -- I wasn't actually making an assertion that all the requests get sent to a server. I can't realistically spend the effort to double-check every single thing like this (as in how badly every corp is spying on me), and it's substantially easier to just assume the worst and act accordingly. Right, I'm sure the "Safe Browsing" stuff has prevented downloads of .exes that the user never would have run anyways (but I digress). Regardless, I still am not going to rely on shareholder-driven megacorps to decide what sites I can trust or not. They have proven they are not trustworthy themselves. To start, Google does things like hiding portions of the URL of the website you're on[0], making the web browsing experience even more opaque than it already is for the average user. In fact, Google has even engaged in phishing-like behaviour themselves, replacing an original website with their own AMP version, while showing the original URL[1]. Of course, this is all without even touching on the shocking depth of surveillance/tracking undertaken by Google. Regarding exploits in the browser iself, in fact, the extremely massive surface area of web browser software is indeed absolutely a vector for malware. In this sense, Safe Browsing is a solution to a problem browser vendors created by nearly turning the web browser into an OS. By April this year, Chrome had already hit its third zero-day exploit[2] affecting its billions of users. By last month, it had hit its seventh[3]. Basically every month or two there's a new actively-exploited vulnerability in Chrome that may very well allow malware to be installed on your system by simply visiting a web page. If only trying to read some text on a website didn't mean risking having my home network turned into a botnet, or getting ransomware-locked... [0] https://www.bleepingcomputer.com/news/google/google-chrome-hides-www-and-https-in-the-address-bar-again/ https://www.bleepingcomputer.com/news/google/google-chrome-h... [1] https://www.androidpolice.com/2019/04/16/amp-pages-will-now-show-original-url-in-chromes-address-bar/ https://www.androidpolice.com/2019/04/16/amp-pages-will-now-... [2] https://www.forbes.com/sites/gordonkelly/2022/04/16/google-chrome-hack-attacks-zero-day-exploit-new-chrome-release https://www.forbes.com/sites/gordonkelly/2022/04/16/google-c... [3] https://www.forbes.com/sites/daveywinder/2022/10/28/emergency-chrome-security-update-google-confirms-0day-attack-threat/ https://www.forbes.com/sites/daveywinder/2022/10/28/emergenc...
- olliej 4y ago
  Except [0] has been demonstrated to actually be more useful for average users, as it hides parts of the url that are not actually relevant. I don't know what google's current UI for it is, but in safari by default https:// https:// is not shown. Instead if you visit a http: site you get a completely different UI "not secure - example.com". The reason for these UI changes is very simple: signaling secure vs insecure via a single character in a string that is meaningless to most people makes it essentially useless. Similarly making "secure" websites get a padlock is not helpful - it's essentially the same as a car engine light, except the engine light is surrounded by a dozen other lights, and it turns off when there's a problem. Unending amounts of research show that that kind of design means people will not notice problems. This is not to say Google is a shining example of privacy engineering (see their core business model), but you're being incredibly dismissive of the work that their chrome and browser privacy engineering teams do.

krono 4y ago

At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled. https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html https://security.googleblog.com/2022/08/how-hash-based-safe-... https://security.googleblog.com/2020/05/enhanced-safe-browsing-protection-now.html https://security.googleblog.com/2020/05/enhanced-safe-browsi...

cmeacham98 4y ago
"Some data" is WAY different than "Google receives the URL of every page you visit". I'm not saying Google's Safe Browsing feature is immune to criticism, but when someone posts such blatantly false information it discredits everything else they have to say on the topic.
- amatecha 4y ago
  Please stop misrepresenting what I said and reacting vocally as a result of your misunderstanding. I didn't assert that every URL is sent. I _assume_ every URL is sent, because that's my "threat model" regarding this feature. I have no reason to trust them, and have every reason to _assume_ that every URL is sent if I use a feature like that.
  - cmeacham98 4y ago
    - amatecha 4y ago
      I didn't "understand" anything incorrectly -- I made zero attempt to understand the feature. How many times do I have to quote the word "assume"? I ASSUMED the worst without knowing anything about the feature, based on my prior experience with "protecting the user" features and the way megacorps treat their users. I thought "probably sends my stuff to their servers" and unchecked the box. Again, for the nth time, I have made no concrete assertion as to the actual functioning of the feature. The only misinformation here has been your repeated misrepresentation of what I communicated.
      - cmeacham98 4y ago
        Sorry, let me restate my original post then: I ASSUME that you're completely wrong about Safe Browsing and have no idea what you're talking about. I ASSUME you're intentionally posting misinformation on the internet. I ASSUME you're as evil as Adolf Hitler. If you prove that what I ASSUMED is demonstrably false, I'll just fall back on saying it's an assumption so that makes being wrong completely ok (and it means that you are misrepresenting me when you call that out)!
        amatecha 4y ago
        Ah man... I mean, at no time did I indicate or suggest how Safe Browsing works. What I communicated to the world is that I am making a totally subjective judgement of a feature, perhaps totally ignorantly, without any suggestion of correlation with reality. For some reason, you missed this subtlety of me saying "I assume [thing does blah]". I'm not out here trying to convince anyone that Safe Browsing does bad things. I pretty clearly said I, myself, in my own head, made a subjective decision about the feature. That's all I said! Come back to this thread in a day or month or year and realize I was pretty forthright/honest and communicating in good faith the entire time.
- krono 4y ago
  It is also quite a ways away from "This isn't even remotely close to true.", which is what I felt the need to correct.

amatecha 4y ago

Yeah for the first thing, I said I assume it -- I wasn't actually making an assertion that all the requests get sent to a server. I can't realistically spend the effort to double-check every single thing like this (as in how badly every corp is spying on me), and it's substantially easier to just assume the worst and act accordingly. Right, I'm sure the "Safe Browsing" stuff has prevented downloads of .exes that the user never would have run anyways (but I digress). Regardless, I still am not going to rely on shareholder-driven megacorps to decide what sites I can trust or not. They have proven they are not trustworthy themselves. To start, Google does things like hiding portions of the URL of the website you're on[0], making the web browsing experience even more opaque than it already is for the average user. In fact, Google has even engaged in phishing-like behaviour themselves, replacing an original website with their own AMP version, while showing the original URL[1]. Of course, this is all without even touching on the shocking depth of surveillance/tracking undertaken by Google. Regarding exploits in the browser iself, in fact, the extremely massive surface area of web browser software is indeed absolutely a vector for malware. In this sense, Safe Browsing is a solution to a problem browser vendors created by nearly turning the web browser into an OS. By April this year, Chrome had already hit its third zero-day exploit[2] affecting its billions of users. By last month, it had hit its seventh[3]. Basically every month or two there's a new actively-exploited vulnerability in Chrome that may very well allow malware to be installed on your system by simply visiting a web page. If only trying to read some text on a website didn't mean risking having my home network turned into a botnet, or getting ransomware-locked... [0] https://www.bleepingcomputer.com/news/google/google-chrome-hides-www-and-https-in-the-address-bar-again/ https://www.bleepingcomputer.com/news/google/google-chrome-h... [1] https://www.androidpolice.com/2019/04/16/amp-pages-will-now-show-original-url-in-chromes-address-bar/ https://www.androidpolice.com/2019/04/16/amp-pages-will-now-... [2] https://www.forbes.com/sites/gordonkelly/2022/04/16/google-chrome-hack-attacks-zero-day-exploit-new-chrome-release https://www.forbes.com/sites/gordonkelly/2022/04/16/google-c... [3] https://www.forbes.com/sites/daveywinder/2022/10/28/emergency-chrome-security-update-google-confirms-0day-attack-threat/ https://www.forbes.com/sites/daveywinder/2022/10/28/emergenc...

olliej 4y ago
Except [0] has been demonstrated to actually be more useful for average users, as it hides parts of the url that are not actually relevant. I don't know what google's current UI for it is, but in safari by default https:// https:// is not shown. Instead if you visit a http: site you get a completely different UI "not secure - example.com". The reason for these UI changes is very simple: signaling secure vs insecure via a single character in a string that is meaningless to most people makes it essentially useless. Similarly making "secure" websites get a padlock is not helpful - it's essentially the same as a car engine light, except the engine light is surrounded by a dozen other lights, and it turns off when there's a problem. Unending amounts of research show that that kind of design means people will not notice problems. This is not to say Google is a shining example of privacy engineering (see their core business model), but you're being incredibly dismissive of the work that their chrome and browser privacy engineering teams do.