Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Safe Browsing incident

statichost.eu

Post reply on HN
Print view View original

101–110 of 183 posts

Re: Google Safe Browsing incident

#101

Post by yafinder »

kbolino wrote: post #11

Putting user content on another domain and adding that domain to the public suffix list is good advice. So good, in fact, that it should have been known to an infrastructure provider in the first place. There's a lot of vitriol here that is ultimately misplaced away from the author's own ignorance.

For something that you think is a de-facto standard, public suffix list seems kinda raw to me for now.

I checked it for two popular public suffixes that came to mind: 'livejournal.com' and 'substack.com'. Both weren't there.

Maybe I'm mistaken, it's not a bug and these suffixes shouldn't be included, but I can't think of the reason why.

Re: Google Safe Browsing incident

#102

Post by jeroenhd »

kbolino wrote: post #11

Putting user content on another domain and adding that domain to the public suffix list is good advice. So good, in fact, that it should have been known to an infrastructure provider in the first place. There's a lot of vitriol here that is ultimately misplaced away from the author's own ignorance.

The PSL is something you find out about after it goes wrong.

It's a weird thing, to be honest, a Github repo mentioned nowhere in any standards that browsers use to treat some subdomains differently.

Information like this doesn't just manifest itself into your brain once you start hosting stuff, and if I hadn't known about its existence I wouldn't have thought to look for a project like this either. I certainly wouldn't have expected it to be both open for everyone and built into every modern internet-capable computer or anti malware service.

Re: Google Safe Browsing incident

#103

Post by jeroenhd »

yafinder wrote: post #101
kbolino wrote: post #11

Putting user content on another domain and adding that domain to the public suffix list is good advice. So good, in fact, that it should have been known to an infrastructure provider in the first place. There's a lot of vitriol here that is ultimately misplaced away from the author's own ignorance.

For something that you think is a de-facto standard, public suffix list seems kinda raw to me for now. I checked it for two popular public suffixes that came to mind: 'livejournal.com' and 'substack.com'. Both weren't there. Maybe I'm mistaken, it's not a bug and these suffixes shouldn't be included, but I can't think of the reason why.

I don't know about LiveJournal, but I don't believe you can host any interactive content on substack (without hacking substack at least). You can't sign up and host a phishing site, for instance.

User-uploaded content (which does pose a risk) is all hosted on substackcdn.com.

The PSL is more for "anyone can host anything in a subdomain of any domain on this list" rather than "this domain contains user-generated content". If you're allowing people to host raw HTML and JS then the PSL is the right place to go, but if you're just offering a user post/comment section feature, you're probably better off getting an early alert if someone has managed to breach your security and hacked your system into hosting phishing.

Re: Google Safe Browsing incident

#104

Post by jeroenhd »

AlienRobot wrote: post #93
gkbrk wrote: post #71

Earlier quoted context omitted.

If youtube.com doesn't end up on the Safe Browsing blacklist because of phishing videos, but your own website can easily end up there, it's a pretty clear case of Google abusing their power.

What is a phishing video?

YouTube hosts millions of videos telling people that they are the government/your bank and that you should move money/contact a scam center/buy cryptocurrency. Even worse is the fact you can pay to turn these videos into ads that will roll in front of other videos.

On the whole of YouTube, it's a tiny sliver of a percentage, but because YouTube has grown too large to moderate, it's still hosting these videos.

If Google applied the same rules they apply to the safe browsing list, they'd probably get YouTube flagged multiple times a week.

Re: Google Safe Browsing incident

#105

Post by ericselin »

zamadatix wrote: post #96
ericselin wrote: post #92

Earlier quoted context omitted.

Please note that this tool (PSL) is not available until you have a significant user base. Which probably means a significant amount of spam as well.

Where'd you see/hear that? It hasn't been my experience at least - but maybe I've just been lucky or undercounting the sites. There are required steps to follow but none are "have x users" or "see a lot of spam". It's mostly "follow proper DNS steps and guidelines in the given format" with a little "show you're doing this for the intended reason rather than to circumvent something the PSL is not meant for/for somethi…

https://github.com/publicsuffix/list/wiki/Guidelines#validat...

"Projects that are smaller in scale or are temporary or seasonal in nature will likely be declined. Examples of this might be private-use, sandbox, test, lab, beta, or other exploratory nature changes or requests. It should be expected that despite whatever site or service referred a requestor to seek addition of their domain(s) to the list, projects not serving more then thousands of users are quite likely to be declined."

Maybe the rules have changed, or maybe you were lucky? :)

Re: Google Safe Browsing incident

#106

Post by jeroenhd »

gkbrk wrote: post #71
progbits wrote: post #7

Hosts phishing sites, gets blocked by anti phishing mechanism. Works as expected from my point of view. Get yourself on public suffix list or get better moderation. But of course just moaning about bad google is easier.

If youtube.com doesn't end up on the Safe Browsing blacklist because of phishing videos, but your own website can easily end up there, it's a pretty clear case of Google abusing their power.

YouTube doesn't allow you to put your credentials into text box and hit send. Google sites, on the other hand, does pose a disk, but they'll likely be treated the same as any other domain on the PSL.

In my experience, safe browsing does theoretically allow you to report scams and phishing in terms of user generated content, but it won't apply unless there's an actual interactive web page on the other end of the link.

There is the occasional false positive but many good sites that end up on that list are there because their WordPress plugin got hacked and somewhere on their site they are actually hosting malware.

I've contacted the owners of hacked websites hosting phishing and malware content several times, and most of the time I've been accused of being the actual hacker or I've been told that I'm lying. I've given up trying to be the good guy and report the websites to Google and Microsoft these days to protect the innocent.

Google's lack of transparency what exact URLs are hosting bad material does play a role there.

Re: Google Safe Browsing incident

#107

Post by [deleted] »

gkbrk wrote: post #71
progbits wrote: post #7

Hosts phishing sites, gets blocked by anti phishing mechanism. Works as expected from my point of view. Get yourself on public suffix list or get better moderation. But of course just moaning about bad google is easier.

If youtube.com doesn't end up on the Safe Browsing blacklist because of phishing videos, but your own website can easily end up there, it's a pretty clear case of Google abusing their power.

[deleted]

Re: Google Safe Browsing incident

#108

Post by lcnPylGDnU4H9OF »

kbolino wrote: post #99
lcnPylGDnU4H9OF wrote: post #97

Earlier quoted context omitted.

> There's a lot of vitriol here that is ultimately misplaced away from the author's own ignorance. For what it's worth, this makes it sound like you think the vitriol should be aimed at the author's ignorance rather than the circumstances which led to it, presuming you meant the latter.

I do think the author's ignorance was a bigger problem--both in the sense of he should have known better and also in the sense that the PSL needs to be more discoverable--than anything Google('s automated systems) did. However, I'm now reflecting on what I said as "be careful what you wish for", because the comments on this HN post have done a complete 180 since I wrote it, to the point of turning into a pile-on in t…

> also in the sense that the PSL needs to be more discoverable

Well, this is a problem that caused the author's ignorance but you present it as though it's the other way around. That's primarily what I meant. Not really disagreeing with "should have known better", mostly in the sense that user-generated content is a huge yellow flag.

Re: Google Safe Browsing incident

#109

Post by jeroenhd »

watermelon0 wrote: post #91
seanw265 wrote: post #78

I’ve got a random subdomain hosting a little internal tool. About twice a year, Google Safe Browsing decides it’s phishing and flags it. Sometimes they flag the whole domain for good measure. Search Console always points to my internal login page, which isn’t public and definitely isn’t phishing. They clear it quickly when I appeal, and since it’s just for me, I’ve mostly stopped worrying about it.

I encountered something similar. I have `*.domain.tld` pointed to an internal IP address, and over the past few years it happened a few times where some subdomain would be flagged as dangerous by Google Safe Browsing.

Internal IP addresses in public DNS are sometimes used to do things like DNS rebind attacks. It's possible that's tripping up their detection mechanism.

My workaround is to use an IPv6 ULA for my publicly hosted private IP addresses, which is extremely unlikely to ever be reused by a bad actor.

Re: Google Safe Browsing incident

#110

Post by jeroenhd »

dynm wrote: post #60

This is a bit of a tangent, the whole concept of "domain reputation" can be infuriating. For example, my blog has been marked as suspicious by spamhaus.org: https://check.spamhaus.org/results?query=dynomight.net As a result, some ISPs apparently block the domain. Why is it listed? I have no idea. There are no ads, there is no user content, and I've never sent any email from the domain. I've tried contacting spamhaus,…

> As a result, some ISPs apparently block the domain

This is the infuriating part. I get that someone buying cheap hosting may end up with an IP address that used to send spam, but spam lists are not reliable indicators of website security.

Overzealous security products are a blight on the internet. I'd be less annoyed at them if they weren't so trivial to bypass as a hacker with access to a stolen credit card.

Post reply on HN