Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

101–110 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#101
post #11

Earlier quoted context omitted.

That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding…

> That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Google is a company that nets 60 billion $ a year in profits. They can afford hiring a few thousand people to ma…

Your math is off, without more data.

What do you think the number of different ads being displayed is, given how much each ad costs?

Estimates suggest it's about 30 billion ad impressions per day to earn that.

If each distinct ad gets 1000 impressions, that's 10 billion ads to review per year.

Let's be super generous, and assume it's 10k impressions, leaving us with 1 billion ads to review.

Let's further assume it's 1 minute per ad to review them, because people are super good at it. This will take 694440 person/days to review.

So to even give a 24 hour turnaround time, they'd have to hire 694,000 people.

If they pay them 65k each (yearly minimum wage in california), that's 45 billion a year.

This again, assumes we have ads with lots of impressions, it's only a minute per ad, and that we are okay with 24 hour turnaround time. Otherwise, it costs more.

It's really easy for people to play the "company makes x, they can afford y" game, but without real data it's sort of magical thinking.

I doubt humans could easily keep up with the review load here, at scale, at any reasonable cost/living wage.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#103

While Google is waging war against adblockers on YouTube they are once again showing they absolutely cannot be trusted with the responsibility of showing safe ads. That, and them showing war videos in ads to little kids.

Im constantly reporting ads that are inappropriate, scams, or flat out illegal, usually they are back within a week or two, if they even get removed at all.

My favorites are the dumb-brick phone charger that "magic defrags your phone", and the micro-ghost pistol.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#104
It's must be serendipitous that the article just above this in my feed is about an AI banning someone for life from advertising on Meta because the AI thought they were trafficking animals for advertising python courses.

And my guess is, absolutely nothing will be done, accountability wise, in either case.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#105

While there's no foolproof way to detect scams like these, there are some proactive steps we can take: 1. Always type in URLs manually when downloading critical software to bypass the potential risks from ads. 2. Make use of browser plugins that identify malicious websites or unverified SSL/TLS certificates. 3. Before making any downloads, inspect the TLS certificate of the website by clicking on the padlock icon nex…

> 1. Always type in URLs manually

This is the time for typosquatters to strike :(

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#107
"the company has said it promptly removes fraudulent ads as soon as possible after they’re reported"

If they wanted to be part of the solution they'd vet the ads before they're made public. But that doesn't scale, and so people get scammed and society suffers and Google makes more money than it knows what to do with. Pretty fair trade...?

As others have said in one way or another, blocking internet advertising is part of healthy and safe internet usage.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#108
post #26

Browsers should display punycode by default in the address bar. 99.9% of these websites are scams. If you live in a place that commonly uses non-ASCII characters in the URL then you should be able to manually toggle it on.

That or whitelist specific characters based on the users locale. E.g. on a system set to german I could expect umlauts and ß to be rendered properly, but anything else should just show the punycode. Basically any legitimate use case should be covered by that.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#109

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!

But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode. Also, while I can agree that url are "security-critical", the same…

> But we need these alphabets to allow people of various culture to be able to have url in their native language

Those of them who want to accept the security risk that comes with that should have the option to turn it on, but it shouldn't be on by default for the rest of us.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#110
post #96

What can I as a user even do to protect myself from this? Like what is the best practice for finding the official website of some organization in a high stakes situation?

To answer the first half of your post, use Firefox and enable network.IDN_show_punycode in about:config.
Post reply on HN