5 ms·

Some Gov.uk URLs blocked by deceptive site warning

debarshri 4y ago
While doing SEO and content for my startup, I have realised Google has way too much power to make or break an organisation. When it works in your favour you can build billion dollar businesses when it works against you it can kill billion dollar businesses.
blue_cookeh 4y ago
We had a similar incident with Google's Safe Browsing list at work several weeks ago. It's the most infuriating thing to one day wake up and have all our (legitimate) sites effectively taken off the Internet for the public because some AI at Google decided our site was unsafe (in our case, presumably, because a self hosted Atlassian login page on a subdomain looked too similar to other sites). To make matters worse getting hold of anyone at Google is next to impossible and in our case it took 48 hours before the review we requested in their console had any effect. On top of that though it didn't only affect Google Chrome, it was all major browsers _and_ services such as NextDNS, or DNS services provided by ISPs(!) which took far longer than 48h to eventually drop off.
samwillis 4y ago
Nice to see thorough incident reports from gov.uk and I think actually this shows the google safe browsing system working well. The domain assets-origin.production.govuk.digital "looks" very much like a phishing url, even if it's internal.
- logifail 4y ago
  > The domain assets-origin.production.govuk.digital "looks" very much like a phishing url, even if it's internal .digital is a real TLD, and govuk.digital is an actual domain, registered by "Government Digital Service" (created 2017-07-14T14:17:30Z) although the registrant's details are redacted "for privacy". Is this domain really registered to some part of uk.gov? ...or is this some bad actor/squatter who found out about the internal naming and snapped up the matching public domain? Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :)
  - mkl95 4y ago
    > Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) The main reason to buy those domains is to spend as little money as possible. Someone at gov.uk is a cheapskate or works with a really limited budget.
    - IndigoIncognito 4y ago
      Limited budget, the UK public sector funding right now is atrocious, even in IT
      - robertlagrant 4y ago
        Not at this level. There are still roomfulls of people that cost more than the amount of money they're deciding whether or not to spend.
    - danw1979 4y ago
      Aren’t gov.uk domains transferred internally within UK government depts at zero cost ? I guess there’s got to be some incentive for teams to not register hundreds of subdomains, but if they are turning to 3rd party TLDs to host government assets, I’d say something has gone wrong.
      - mkl95 4y ago
        If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster, and can be the only way to test something in an env that resembles prod. I have done it myself for non critical stuff, although I'm not sure I would at some government org.
        logifail 4y ago
        > If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster [..] Isn't this basically the very definition of "shadow IT"? Then you find that some prod[-ish] service relies on an external provider that's not listed as a provider in any of your org's financial systems, is paid by some random internal person's credit card and expensed back ... then that internal person leaves, and N weeks/months later all hell breaks loose when your service falls over and no-one knows why.
ghusto 4y ago
90s, Microsoft IE, blah blah blah — you know the history. For my part, I'm pushing as hard as I can to replace Chrome on everyone's machines with Firefox. It's not even the same game any more though. In the 90s there was still a fighting chance — and we won! — because the technologies at play were not entrenched in every day life. Now it's more akin to replacing every car with an EV.
- tick_tock_tick 4y ago
  IE lost because it was way worse. Chrome is good enough or even better that no one is going to leave it.
- myfonj 4y ago
  I praise your effort, I'd like to see more diverse browser landscape as well. But in this particular case I think that different browser (or particularly Firefox) would not possibly prevent that problem, since (Firefox) shares same "Safe Browsing" database with Google, for "Phishing Protection". https://wiki.mozilla.org/Security/Safe_Browsing https://wiki.mozilla.org/Security/Safe_Browsing
  - mritzmann 4y ago
    > (..) since Firefox shares same "Safe Browsing" database with Google This. Firefox even sends the hash and filename of each download to Google. So if you use Firefox to download the Tor browser, an abortion price list or a secret PDF, Google knows you downloaded it. https://www.pentagrid.ch/en/blog/block_browser_requests_to_google_during_security_analysis_in_burp/ https://www.pentagrid.ch/en/blog/block_browser_requests_to_g... Disclaimer: The blogpost is two years old, but I assume this is still current.
lynx23 4y ago
- krisoft 4y ago
  No, not every government site is deceptive. Why do you even think that?
  - urbandw311er 4y ago
    Probably a sad reflection of recent prominent news stories regarding governments that don’t tell the truth to their people. By my calculation covering a sizeable chunk of the world’s population.
    - lynx23 4y ago
      True that. However, some people prefer to shoot the messenger, then to start to see the truth.
Zpalmtree 4y ago
Google safe browser API returns safe for some URLs blocked in chrome so you don't even know what content is unsafe to fetch (like images) before your site gets this hideous red warning appear
nonrandomstring 4y ago
I am so impressed by the transparent and accessible writing style of uk.gov. As each paragraph raised questions in my mind, they were precisely answered in the next. For once I can't blame Google. Production should have known better than to roll out some random .digital domain. I would definitely not trust this if I had spotted it manually.
- robin_reala 4y ago
  If you’re interested, GOV.UK has a bunch of information on how to write a high quality incident report / review: https://docs.publishing.service.gov.uk/manual/incident-reports.html https://docs.publishing.service.gov.uk/manual/incident-repor...
midenginedcoupe 4y ago
I had this too. Google decided to block my company's domain for no good reason. I also couldn't reach anyone in Google to sort it out - I eventually had a response that "it's an automated system, there is noone who looks after it or can do anything about it". My company's email is hosted on GMail, and that also silently swallowed any in- or out-bound emails that as much as mentioned my domain. Including the email to our support inbox from our customer telling us they were having problems. Running anything in production at the whim of Google is too much of a risk, and I've been migrating everything I can off them ever since. They're a menace.

While doing SEO and content for my startup, I have realised Google has way too much power to make or break an organisation. When it works in your favour you can build billion dollar businesses when it works against you it can kill billion dollar businesses.

blue_cookeh 4y ago

We had a similar incident with Google's Safe Browsing list at work several weeks ago. It's the most infuriating thing to one day wake up and have all our (legitimate) sites effectively taken off the Internet for the public because some AI at Google decided our site was unsafe (in our case, presumably, because a self hosted Atlassian login page on a subdomain looked too similar to other sites). To make matters worse getting hold of anyone at Google is next to impossible and in our case it took 48 hours before the review we requested in their console had any effect. On top of that though it didn't only affect Google Chrome, it was all major browsers _and_ services such as NextDNS, or DNS services provided by ISPs(!) which took far longer than 48h to eventually drop off.

samwillis 4y ago

Nice to see thorough incident reports from gov.uk and I think actually this shows the google safe browsing system working well. The domain assets-origin.production.govuk.digital "looks" very much like a phishing url, even if it's internal.

logifail 4y ago
> The domain assets-origin.production.govuk.digital "looks" very much like a phishing url, even if it's internal .digital is a real TLD, and govuk.digital is an actual domain, registered by "Government Digital Service" (created 2017-07-14T14:17:30Z) although the registrant's details are redacted "for privacy". Is this domain really registered to some part of uk.gov? ...or is this some bad actor/squatter who found out about the internal naming and snapped up the matching public domain? Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :)
- mkl95 4y ago
  > Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) The main reason to buy those domains is to spend as little money as possible. Someone at gov.uk is a cheapskate or works with a really limited budget.
  - IndigoIncognito 4y ago
    Limited budget, the UK public sector funding right now is atrocious, even in IT
    - robertlagrant 4y ago
      Not at this level. There are still roomfulls of people that cost more than the amount of money they're deciding whether or not to spend.
  - danw1979 4y ago
    Aren’t gov.uk domains transferred internally within UK government depts at zero cost ? I guess there’s got to be some incentive for teams to not register hundreds of subdomains, but if they are turning to 3rd party TLDs to host government assets, I’d say something has gone wrong.
    - mkl95 4y ago
      If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster, and can be the only way to test something in an env that resembles prod. I have done it myself for non critical stuff, although I'm not sure I would at some government org.
      - logifail 4y ago
        > If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster [..] Isn't this basically the very definition of "shadow IT"? Then you find that some prod[-ish] service relies on an external provider that's not listed as a provider in any of your org's financial systems, is paid by some random internal person's credit card and expensed back ... then that internal person leaves, and N weeks/months later all hell breaks loose when your service falls over and no-one knows why.

ghusto 4y ago

90s, Microsoft IE, blah blah blah — you know the history. For my part, I'm pushing as hard as I can to replace Chrome on everyone's machines with Firefox. It's not even the same game any more though. In the 90s there was still a fighting chance — and we won! — because the technologies at play were not entrenched in every day life. Now it's more akin to replacing every car with an EV.

tick_tock_tick 4y ago
IE lost because it was way worse. Chrome is good enough or even better that no one is going to leave it.
myfonj 4y ago
I praise your effort, I'd like to see more diverse browser landscape as well. But in this particular case I think that different browser (or particularly Firefox) would not possibly prevent that problem, since (Firefox) shares same "Safe Browsing" database with Google, for "Phishing Protection". https://wiki.mozilla.org/Security/Safe_Browsing https://wiki.mozilla.org/Security/Safe_Browsing
- mritzmann 4y ago
  > (..) since Firefox shares same "Safe Browsing" database with Google This. Firefox even sends the hash and filename of each download to Google. So if you use Firefox to download the Tor browser, an abortion price list or a secret PDF, Google knows you downloaded it. https://www.pentagrid.ch/en/blog/block_browser_requests_to_google_during_security_analysis_in_burp/ https://www.pentagrid.ch/en/blog/block_browser_requests_to_g... Disclaimer: The blogpost is two years old, but I assume this is still current.

lynx23 4y ago

krisoft 4y ago
No, not every government site is deceptive. Why do you even think that?
- urbandw311er 4y ago
  Probably a sad reflection of recent prominent news stories regarding governments that don’t tell the truth to their people. By my calculation covering a sizeable chunk of the world’s population.
  - lynx23 4y ago
    True that. However, some people prefer to shoot the messenger, then to start to see the truth.

Zpalmtree 4y ago

Google safe browser API returns safe for some URLs blocked in chrome so you don't even know what content is unsafe to fetch (like images) before your site gets this hideous red warning appear

nonrandomstring 4y ago

I am so impressed by the transparent and accessible writing style of uk.gov. As each paragraph raised questions in my mind, they were precisely answered in the next. For once I can't blame Google. Production should have known better than to roll out some random .digital domain. I would definitely not trust this if I had spotted it manually.

robin_reala 4y ago
If you’re interested, GOV.UK has a bunch of information on how to write a high quality incident report / review: https://docs.publishing.service.gov.uk/manual/incident-reports.html https://docs.publishing.service.gov.uk/manual/incident-repor...

midenginedcoupe 4y ago

I had this too. Google decided to block my company's domain for no good reason. I also couldn't reach anyone in Google to sort it out - I eventually had a response that "it's an automated system, there is noone who looks after it or can do anything about it". My company's email is hosted on GMail, and that also silently swallowed any in- or out-bound emails that as much as mentioned my domain. Including the email to our support inbox from our customer telling us they were having problems. Running anything in production at the whim of Google is too much of a risk, and I've been migrating everything I can off them ever since. They're a menace.