My experience being blocked by Google Safe Browsing (2022) • Hacker News Board

Re: My experience being blocked by Google Safe Browsing (2022)

#61

Post by jmillikin » Sun, Apr 02, 2023, 5:10 PM UTC

mrjin wrote: post #33

I cannot have such BS any more. So I deployed something on my home server and exposed it on a port just above 10000. And I tried to access it with Chrome, and it was blocked coz it on an unusual port!! So obviously one of them had to go. So Chrome went away from my network.

Port 10080 is blocked on most browsers[0] per the WHATWG "bad ports" list[1]. That particular port was added to the list due to the Slipstream attack[2] that made the news a few years ago[3].

You don't have to switch to a browser that ignores standard security mitigations. Just pick a different port for your service.

[0] I just tested Chrome, Firefox, and Safari.

[1] https://fetch.spec.whatwg.org/#bad-port

[2] https://samy.pl/slipstream/

[3] https://news.ycombinator.com/item?id=24955891

Re: My experience being blocked by Google Safe Browsing (2022)

#62

Post by ethbr0 » Sun, Apr 02, 2023, 6:22 PM UTC

lionkor wrote: post #56

esprehn wrote: post #38

Earlier quoted context omitted.

> I don't actually believe that it has blocked that many people from being phished The data says the opposite, the safe browsing list is very effective* which is why many other browsers and systems use the same list to block malicious pages. Google publishes data about the frequency of warnings displayed too: https://transparencyreport.google.com/safe-browsing/overview * Of course it could be better.

Very effective at... what? I mean, they seem to not be able to tell the difference between a legit mastodon instance and a phishing site, so why would they suddenly be able to tell if it effectively blocked a site that was actually malicious? Yes, blocking sites on a blocklist works very well. Whether those sites are legit or not doesnt matter at that point, to them, as they assume they all are malicious. Do you see…

> ... so why would they suddenly be able to tell if it effectively blocked a site that was actually malicious?

The fact that there was one false positive does not imply there are no true positives.

Google crawls malware on sites all the time: https://security.googleblog.com/2009/10/show-me-malware.html...

Re: My experience being blocked by Google Safe Browsing (2022)

#63

Post by londons_explore » Sun, Apr 02, 2023, 9:18 PM UTC

aww_dang wrote: post #50

GartzenDeHaes wrote: post #46

Earlier quoted context omitted.

Everyone just assumes, incorrectly, that their systems are clean and secure. It didn't seem to even occur to OP to seriously investigate his site for "malware or social engineering attacks".

In either case, a clear citation of the alleged "phishing" content would help to avoid ambiguity. >Maybe I would feel better if there had been more transparency in the process. I was left to guess what Google thought was deceptive about my site.

Sometimes the console does tell you which URL they found malicious content at.

However, if they detect you doing dodgy things like trying to cloak from their scanner (eg. giving bad content when given a browser user agent from a home internet IP range, but not when scanned by googlebot from a google datacenter), then they won't give the URL because that would leak what IP range they scan from to detect such cloaking.

Re: My experience being blocked by Google Safe Browsing (2022)

#64

Post by mid-kid » Mon, Apr 03, 2023, 1:17 AM UTC

thrdbndndn wrote: post #12

lionkor wrote: post #5

I feel the "i want my friends and family to be safe" is similar to the "but think of the kids!" excuse. Maybe its some kind of a Stockholm Syndrome variant of people using Chrome, but its definitely not healthy. I don't actually believe that it has blocked that many people from being phished, and I doubt that all the entries on that list are malicious. It seems like a system that was designed by someone to simply get…

The consensus, even among tech people, seems to be that this is a good thing. Sure, lots do argue it shouldn't be maintained by Google, but ultimately such list itself is fine. I personally don't agree with, as I think modern browsers (not just Chrome) already do way too much handholding to a point that neutrality is inevitably lost. I would go even further and say I don't like ideas like Firefox's/Brave's "Enhanced…

>I would go even further and say I don't like ideas like Firefox's/Brave's "Enhanced Tracking Protection" which blocks certain services with a handpick ruleset. Don't get me wrong, I block these trackers myself in uBlock Origin, but I don't like idea that a browser maintains an arbitrary list itself of what to block for the users.

The primary difference is in the messaging. Tracking protection is an opt-in feature, so the user is always aware of it. Additionally, at least in the forms I've encountered it, it doesn't outright prevent you from navigating to a website. At worst it breaks some sites, and you disable it, it's sitting right there in your browser navigation bar. Don't agree with some block? Overriding it is a click away.

Meanwhile, safebrowsing doesn't announce itself anywhere except when it hits you in the face with a giant red screen, specifically designed to inspire a sense of fear/dread. Override buttons are intentionally not outright presented to the user, and the toggles to completely disable the feature are tucked deep into advanced features where no muggle may reach.

It may sound stupid but this simple difference in optics radically changes the effect such a "manual blacklisting" feature has on its users. That said I agree it'd be nice to have more control over the tracking protection feature in firefox, e.g. by allowing custom lists, like uBlock does.

Re: My experience being blocked by Google Safe Browsing (2022)

#65

Post by thrdbndndn » Mon, Apr 03, 2023, 2:29 AM UTC

mid-kid wrote: post #64

thrdbndndn wrote: post #12

Earlier quoted context omitted.

The consensus, even among tech people, seems to be that this is a good thing. Sure, lots do argue it shouldn't be maintained by Google, but ultimately such list itself is fine. I personally don't agree with, as I think modern browsers (not just Chrome) already do way too much handholding to a point that neutrality is inevitably lost. I would go even further and say I don't like ideas like Firefox's/Brave's "Enhanced…

>I would go even further and say I don't like ideas like Firefox's/Brave's "Enhanced Tracking Protection" which blocks certain services with a handpick ruleset. Don't get me wrong, I block these trackers myself in uBlock Origin, but I don't like idea that a browser maintains an arbitrary list itself of what to block for the users. The primary difference is in the messaging. Tracking protection is an opt-in feature, s…

> The primary difference is

Yeah I don't mean they're the same thing.

I just don't like either (hence "go even further").

Re: My experience being blocked by Google Safe Browsing (2022)

#66

Post by baki » Fri, Apr 14, 2023, 9:16 AM UTC

I Never ever use Safe Browsing, just because the ideologically based blockings.Even antivirises' browsing protection is infected with ideological censorship. Fuck them!