This sounds great! I'll report a few of my competitors to Google Safe Browsing, and see how it affects the visits on my own website. /s
My experience being blocked by Google Safe Browsing (2022)
21–30 of 66 posts
Re: My experience being blocked by Google Safe Browsing (2022)
#22Earlier quoted context omitted.
> It’s mostly for me and friends I know personally – nothing like the bigger, public ones. I'd agree with you if it had thousands of users, but not when the user count is 8. If you have 8 users on your SMTP server, damn easy to know with certainty if any of them did anything that might be considered malicious.
Mastodon, perhaps unwisely, replicates all media it encounters.
Again, it's eight users, one of which has full control over the database plus an approximate timestamp when something went wrong.
Super easy to check every outbound click, every post published, every post received... Everything.
Re: My experience being blocked by Google Safe Browsing (2022)
#23Google "Safe browsing" is the blatant excuse by Google to collect all your browsing history. Disabling it is behind dark patterns.
That's just plain wrong. Most SafeBrowsing checks are done locally against a list. They even have an API for it. https://developers.google.com/safe-browsing/v4#update-api-v4 Literally 5 seconds on your favorite search engine could have stopped you from embaressing yourself.
If a website looks suspicious, Chrome sends a subset of likely phishing and social engineering terms found on the page to Google, in order to determine whether the website should be considered malicious. These client-side checks also include comparisons of the visual appearance of the page to a list of images of login pages. If a website appears similar to a page on this list, Chrome will send the URL and the matched entry on the list to Google to determine whether the page is a likely phishing attempt. Chrome can also help protect you from phishing if you type one of your previously saved passwords into an uncommon site. In this case Chrome sends the URL and referrers of the page to Google to see if the page might be trying to steal your password.
https://www.google.com/chrome/privacy/whitepaper.html#malwar...
There's also a handful of other things they will send in the name of safe browsing, should they be enabled (I don't know if any are defaults): https://www.google.com/chrome/privacy/
Re: My experience being blocked by Google Safe Browsing (2022)
#24I feel the "i want my friends and family to be safe" is similar to the "but think of the kids!" excuse. Maybe its some kind of a Stockholm Syndrome variant of people using Chrome, but its definitely not healthy. I don't actually believe that it has blocked that many people from being phished, and I doubt that all the entries on that list are malicious. It seems like a system that was designed by someone to simply get…
Good points. Malicious actors doing actual abuse can just rinse and repeat with new domain names.
Malicious actors can easily change domains, legitimate businesses can't.
So this is a harsh punishment to all good people, and very weak punishment to all scammers and spammers.
Re: My experience being blocked by Google Safe Browsing (2022)
#25I feel the "i want my friends and family to be safe" is similar to the "but think of the kids!" excuse. Maybe its some kind of a Stockholm Syndrome variant of people using Chrome, but its definitely not healthy. I don't actually believe that it has blocked that many people from being phished, and I doubt that all the entries on that list are malicious. It seems like a system that was designed by someone to simply get…
I often click links on phishing mails I get just for fun, and more often than not they result in webpages being blocked by Chrome. Anecdotal, but there you go.
This is a bit dangerous because of zero-days. If you do this in a throw-away isolated virtual machine, this is probably safe.
Re: My experience being blocked by Google Safe Browsing (2022)
#26> hosted a Mastodon server on the domain Mastodon is often used to distribute illegal content. If you self host you need to be ready to deal with this stuff. Like with self hosted SMTP server. Not saying it is good or bad, just reality!
So is google drive.
Re: My experience being blocked by Google Safe Browsing (2022)
#27Yikes, giving Google the power to block any website to the majority of humankind may not be the best idea.
Even worse, the data is crowd sourced. I've been playing whack-a-mole with this service for over a year now. Strongly suspecting that this is negative SEO. It is temporarily unblocked, then in the next week the entire domain is re-flagged.
Yes and no, the public crowdsourcing is only a part.
The biggest influence are trusted security groups, where security teams of influential websites who trust each other can push or remove websites from these lists without any vetting from anyone.
This is also from there that you can download and share lists of unhashed passwords with e-mails (you know this warning "This password has likely been compromised", they need to source it from somewhere).
If the owner of a website complains, he is never going to win the appeal against a member of the special group.
So it's a very (useful and important) political game once your website becomes large.
This is also where you can informally directly communicate with agencies like FBI.
Re: My experience being blocked by Google Safe Browsing (2022)
#28Google "Safe browsing" is the blatant excuse by Google to collect all your browsing history. Disabling it is behind dark patterns.
It's Enhanced Safe Browsing that you are talking about.
It collects all URLs you are visiting, associates it to your Google profile, and send samples of content to Google.
(There are other similar mechanisms in Chrome as well, but it's not called Safe Browsing).
Re: My experience being blocked by Google Safe Browsing (2022)
#29Earlier quoted context omitted.
Good points. Malicious actors doing actual abuse can just rinse and repeat with new domain names.
Malicious actors can easily change domains, legitimate businesses can't. So this is a harsh punishment to all good people, and very weak punishment to all scammers and spammers.
Especially relevant when you consider the organic search traffic legitimate webmasters may rely upon, vs. the email campaigns or even paid traffic bad actors can quickly spin up.
Re: My experience being blocked by Google Safe Browsing (2022)
#30Earlier quoted context omitted.
Even worse, the data is crowd sourced. I've been playing whack-a-mole with this service for over a year now. Strongly suspecting that this is negative SEO. It is temporarily unblocked, then in the next week the entire domain is re-flagged.
Yes and no, the public crowdsourcing is only a part. The biggest influence are trusted security groups, where security teams of influential websites who trust each other can push or remove websites from these lists without any vetting from anyone. This is also from there that you can download and share lists of unhashed passwords with e-mails (you know this warning "This password has likely been compromised", they ne…
> This is also from there that you can download list of unhashed passwords with e-mails (you know this warning "This password has likely been compromised", they need to source it from somewhere).
You (or anyone else) can get such a list (no emails, weak hashing better thought of as obfuscation) from Pwned Passwords[1]. (There used to be direct download links usable without the tricky downloader tool for pre-2022 archives on that page, but not anymore, huh. Take this[2,3].)
[1] https://haveibeenpwned.com/Passwords
[2] https://archive.org/details/pwned-passwords-version-8
[3] magnet:?xt=urn:btih:f9690a02f1accebbee2190b82cfee7b6968d384c&dn=pwned-passwords-sha1-ordered-by-hash-v8.7z