Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Sending URLs to Tencent?

twitter.com

Post reply on HN
Print view View original

101–110 of 154 posts

Re: Apple Is Sending URLs to Tencent?

#101

Post by tomxor »

pmoriarty wrote: post #79
robocat wrote: post #57

Earlier quoted context omitted.

Bloom filters are likely useless in this situation - following facts for phishing only: 1. Phishing sites have a lifecycle of about 15 hours. 2. Most malicious links are hidden within benign domains. 3. About 400,000 phishing sites are created each month. From: https://www.itgovernance.co.uk/blog/4-eye-opening-facts-abou... I haven't run the numbers, but I am guessing that a clientside solution would have a lot of ba…

400,000 sounds like a lot, but I wonder how many new URLs Tencent adds to its database each month. I expect they don't add every phishing URL but some small subset of them (possibly even a very small subset.. we'll proably never know). But let's say it is 400,000. I took the URL you linked and made a file of 400,000 copies of it. The file size was 28 MB. I didn't bother compressing that particular file since the URL…

> 28 MB extra every month shouldn't even be noticeable

Parent comment suggests phishing site life-cycle At such a frequency, efficiency becomes less about bandwidth and more about the overhead of continuously synchronising so many clients (think of that 28 MiB spread out over 400k separate messages over one month, one every 154ms, that not only inflates the size, but causes a constant network usage and processing that is far less efficient than a single 28MiB download).

Or you could just send the URL hash when you visit a URL... (do you request any where near 8k URLs every 15hrs?, 1 URL every 154ms? no), it's so clearly a simpler solution that will be faster for everyone without letting bad URLs slip through before a latent sync.

Re: Apple Is Sending URLs to Tencent?

#102

Post by yorwba »

solidangle wrote: post #80
eastendguy wrote: post #70

Earlier quoted context omitted.

> if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: So even for US and EU based users the data is send to Tencent just because they enabled Chinese language support? Who programmed that?

Not just EU and US based users, but also Hong Kong and Taiwan based users.

Hong Kong, Macao and Taiwan all have their own ISO 3166 codes and users there are unlikely to accidentally set the region to CN, since the difference between simplified and traditional characters is quite obvious.

Re: Apple Is Sending URLs to Tencent?

#103

Post by pmoriarty »

tomxor wrote: post #101
pmoriarty wrote: post #79

Earlier quoted context omitted.

400,000 sounds like a lot, but I wonder how many new URLs Tencent adds to its database each month. I expect they don't add every phishing URL but some small subset of them (possibly even a very small subset.. we'll proably never know). But let's say it is 400,000. I took the URL you linked and made a file of 400,000 copies of it. The file size was 28 MB. I didn't bother compressing that particular file since the URL…

> 28 MB extra every month shouldn't even be noticeable Parent comment suggests phishing site life-cycle At such a frequency, efficiency becomes less about bandwidth and more about the overhead of continuously synchronising so many clients (think of that 28 MiB spread out over 400k separate messages over one month, one every 154ms, that not only inflates the size, but causes a constant network usage and processing tha…

Do you really think Tencent is detecting a new phishing site every 154ms?

I'd seriously question how many of the total new phising sites they detect to start off with, and then how frequently they do so.

If a user only downloads the deltas periodically they'd risk being out of sync with the master list (which might not be updated even once a month or at all, for all we know), but that's the price they'd need to pay to have to send any information about their web browsing to parties they don't trust.

One other thing to consider is the likelihood that the URL you happen to be surfing is both a phishing URL to begin with and one of the ones that just appeared since the last delta download you did, compared to the likelihood that it's one of those already in the entire phishing URL database you've already downloaded. I'd expect those odds to be very low.

Re: Apple Is Sending URLs to Tencent?

#104

Post by sanxiyn »

phyzome wrote: post #12
slenk wrote: post #11

Earlier quoted context omitted.

I think a lot of browsers do for the "Safe Browsing" checks

Firefox downloads a big blob of unsafe URLs and checks against that, last I saw.

No, Firefox uses the exactly same Safe Browsing protocol. In fact, the protocol was co-developed by Google and Mozilla.

Re: Apple Is Sending URLs to Tencent?

#106

Post by lern_too_spel »

derefr wrote: post #74
lern_too_spel wrote: post #55

Earlier quoted context omitted.

That doesn't mean that the user is in China. It means that the user wants their interface in Chinese as it is written in mainland China. In other words, the CN means simplified Chinese instead of traditional Chinese, which is what the TW region code corresponds to.

The GP poster is incorrect; the Region setting has nothing to do with setting the region code of the Language setting (each language+region pair being its own listing in Languages.) The Region you choose during initial device setup does determine your default Language region, but you can pick a different one while keeping the same Region. The Region setting in iOS is literally just the question "what Country [or Coun…

This is incorrect. en_GB doesn't mean you're in or from Great Britain. It means you want the device to show English as it is used in Great Britain, with extraneous "u"s and rearranged month and day. A user in the US can request that locale instead of en_US if that is the language they prefer. Locale is for localization of the interface, not for telling where you are from.

See the Australian English example in https://en.m.wikipedia.org/wiki/Locale_%28computer_software%...

Now maybe iOS sets the locale based on where the user is from instead of based on how the user would like their interface localized. If it does, it is doing it wrong. Sending a user's data to Tencent based on a setting instead of based on their location is absolutely wrong.

Re: Apple Is Sending URLs to Tencent?

#107

Post by oarsinsync »

Aperocky wrote: post #87
wolfgke wrote: post #32

Earlier quoted context omitted.

> This is really a "damned if you do, damned if you don't" kind of situation. Why? Simply, when setting up the device/browser, let the user choose what safe browsing API the browser shall use (both, one of them, or none). Letting the user make a conscious choice is the best way to handle "damned if you do, damned if you don't" kind of situation. To make the choice as conscious as possible for the user, provide additi…

That’s entirely against the entirety of Apples modus operandi. It’s always make the user have as little choice as possible and assume that users are idiots. The only exception they made is to developer with cli abilities, and even that they have began to restrict

> assume that the users are idiots

Microsoft didn’t make this assumption. Apple did. My entire extended family are now all Apple users. My tech support calls per year can now be counted on one hand.

In my extended family, the users are idiots, and thanks to Apple, I’m poorer financially but significantly richer in free time.

Re: Apple Is Sending URLs to Tencent?

#109

Post by fireattack »

sqs wrote: post #89
fireattack wrote: post #41

Earlier quoted context omitted.

https://github.com/WebKit/webkit/blob/master/Source/WebKit/U... (For some reason "search in this repo" doesn't work for keyword `malwareDetailsBase` [1], but it's there) [1] https://github.com/WebKit/webkit/search?q=malwareDetailsBase...

URL to same code search on Sourcegraph (which works): https://sourcegraph.com/search?q=repo%3Awebkit%2Fwebkit+malw... (Disclaimer: I am the Sourcegraph CEO.)

It shows

Search timed out Try narrowing your query, or specifying a longer "timeout:" in your query.

right now.

Re: Apple Is Sending URLs to Tencent?

#110

Post by tomxor »

pmoriarty wrote: post #103
tomxor wrote: post #101

Earlier quoted context omitted.

> 28 MB extra every month shouldn't even be noticeable Parent comment suggests phishing site life-cycle At such a frequency, efficiency becomes less about bandwidth and more about the overhead of continuously synchronising so many clients (think of that 28 MiB spread out over 400k separate messages over one month, one every 154ms, that not only inflates the size, but causes a constant network usage and processing tha…

Do you really think Tencent is detecting a new phishing site every 154ms? I'd seriously question how many of the total new phising sites they detect to start off with, and then how frequently they do so. If a user only downloads the deltas periodically they'd risk being out of sync with the master list (which might not be updated even once a month or at all, for all we know), but that's the price they'd need to pay t…

> the likelihood that the URL you happen to be surfing is both a phishing URL to begin with and one of the ones that just appeared since the last delta download you did, compared to the likelihood that it's one of those already in the entire phishing URL database you've already downloaded. I'd expect those odds to be very low.

Ignoring the first condition (otherwise why bother with a list at all)... Consider that this information is very transient (average 15hrs), this is pretty simple: deltaT / 54000

This is still horrible, because your safety is determined by how frequently you can sync with the DB.

> If a user only downloads the deltas periodically they'd risk being out of sync with the master list (which might not be updated even once a month or at all, for all we know).

Being updated monthly doesn't match the statistic of average 15hr lifecycle, because it would be useless after that length of time. And while I don't claim to know 15hrs as a fact, it is intuitive that the average will become ever shorter as malicious URL checkers become updated ever faster.

> but that's the price they'd need to pay to have to send any information about their web browsing to parties they don't trust.

Full URL information need not be sent, a hash of the URL domain and path would probably suffice... if that's not enough then it's a dilemma, but that doesn't make continuous syncing a good or fail safe replacement.

Post reply on HN