Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Chrome heuristic warnings pose threat to our business

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#51

Post by miomyosky »

markshepard wrote: post #49
markshepard wrote: post #45

Earlier quoted context omitted.

Very nice! This will actually be very helpful in tracking this. Thank you.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

Thanks for the really useful tip to look into Chrome's debug log.

First of all we see that this so called phishing detection filter's code is found at http://src.chromium.org/svn/trunk/src/chrome/renderer/safe_b...

Second, this code and the logic it employs is really bull.

The world wide web is not a kiddie playground especially for a browser, and especially for a plugin whose's job is to detect phishing. The way Chrome's anti-phishing works is to use several foolish measures that mean nothing in the real world and then 'punish' and push websites into oblivion when someone crosses these arbitrary sets of rules.

The way the plugin appears to work is to look at various things * The type of URL (IP vs domainname, number of subdomains, size of the subdomain names, the strings in the Path URL) * Whether the page contains form data * Whether the page contains password input box * Whether the page contains checkboxes/radio boxes * Whether the page text contains some terms (in this case 'connexion') * Whether page has links/images to other domains

and so on.

None of these are ANY indication of phishing behavior and if this set of quackery based logic is what we see from Google Chrome, where else can we go to really feel safe and protected?

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#52

Post by markshepard »

markshepard wrote: post #49
markshepard wrote: post #45

Earlier quoted context omitted.

Very nice! This will actually be very helpful in tracking this. Thank you.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

@alternize

That, precisely is the issue. We can only speculate as to what might be good or bad. There is no way to really know is correct (and infact why is it even the business of a browser to determine that). In a lot of situation, it is not something the product gets to decide. For example, this got triggered when a customer added translations to the application (which changes that button).

.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#53

Post by magicalist »

markshepard wrote: post #49
markshepard wrote: post #45

Earlier quoted context omitted.

Very nice! This will actually be very helpful in tracking this. Thank you.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

According to this[1], the classifier is intentionally obfuscated to prevent reverse engineering, so I don't know how far you're going to get with the log beyond just knowing your score (and the score can change if they change the model, which may explain why some people aren't seeing a problem (I see no phishing warning in Chrome dev channel, for instance)).

Since it looks like it's a model trained offline on known phishing sites, unfortunately I think your best bet is tweaking until you fall under the threshold and (if you're feeling magnanimous) filing a bug on Chrome with an example of how the current model is flawed (though if the page is working in dev channel, something may already have been fixed).

That sucks, sorry :(

[1] https://code.google.com/p/chromium/codesearch#chromium/src/c...

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#54

Post by fotcorn »

markshepard wrote: post #49
markshepard wrote: post #45

Earlier quoted context omitted.

Very nice! This will actually be very helpful in tracking this. Thank you.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

Better format: http://pastebin.com/1NE2Tud8

Can you remove the "core" part of the url? => UrlPathToken=core = 1

You could try another file extensions for the page (don't now if this is possible with gwt). => UrlPathToken=html = 1

The "powered by" link seems also problematic => PageLinkDomain=tonido.com = 1

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#57

Post by markshepard »

fotcorn wrote: post #54
markshepard wrote: post #49

Earlier quoted context omitted.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

Better format: http://pastebin.com/1NE2Tud8 Can you remove the "core" part of the url? => UrlPathToken=core = 1 You could try another file extensions for the page (don't now if this is possible with gwt). => UrlPathToken=html = 1 The "powered by" link seems also problematic => PageLinkDomain=tonido.com = 1

Interesting! I guess most phishing guys have this on their URL and in their page. Therefore it MUST mean that every page with those keys are phishing... just great.

Chrome user$ grep phish chrome_debug.log | grep -e "UrlPath" -e "PageTerm"

[5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=html = 1

[5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=core = 1

[5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=password = 1

[5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=connexion = 1

[5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=index = 1

[5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=account = 1

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#59

Post by miomyosky »

daave wrote: post #56

I work at Google but not on this product.. so I escalated your issue to the team that works on the anti-phishing classifier. They're looking into it now, and put you on a temporary whitelist in the mean time (should take effect within 30 mins).

It would be nice if the antiphishing filter also gave some good way for web developers to figure out why this happened and what to do to correct this.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#60

Post by alternize »

markshepard wrote: post #52
markshepard wrote: post #49

Earlier quoted context omitted.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

@alternize That, precisely is the issue. We can only speculate as to what might be good or bad. There is no way to really know is correct (and infact why is it even the business of a browser to determine that). In a lot of situation, it is not something the product gets to decide. For example, this got triggered when a customer added translations to the application (which changes that button). .

translation implies "other language". instead of still defining the page as being english, why not trying to define the page's language to the language the customer (allegedly) translated into?

in your case, non-translated "Account" and "Password" texts in a french corpus are most probably much much more common than a wrongly-translated french "Connexion" in an english corpus...

that said, i do not know if chrome is really considering the language or not, but i certainly would hope so. :)

Post reply on HN