Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

211–220 of 713 posts

Re: Google flags Immich sites as dangerous

#211

Post by jeroenhd »

heavyset_go wrote: post #46

Insane that one company can dictate what websites you're allowed to visit. Telling you what apps you can run wasn't far enough.

It's the result of failures across the web, really. Most browsers started using Google's phishing site index because they didn't want to maintain one themselves but wanted the phishing resistance Google Chrome has. Microsoft has SmartScreen, but that's just the same risk model but hosted on Azure.

Google's eternal vagueness is infuriating but in this case the whole setup is a disaster waiting to happen. Google's accidental fuck-up just prevented "someone hacked my server after I clicked on pr-xxxx.imiche.app" because apparently the domain's security was set up to allow for that.

You can turn off safe browsing if you don't want these warnings. Google will only stop you from visiting sites if you keep the "allow Google to stop me from visiting some sites" checkbox enabled.

Re: Google flags Immich sites as dangerous

#213

Post by jeroenhd »

skrebbel wrote: post #183
curioussquirrel wrote: post #164

Looking forward to Louis Rossmann's reaction. Wouldn't be surprised if this leads to a lawsuit over monopolistic behavior - this is clearly abusing their dominant position in the browser space to eliminate competitors in photos sharing.

Who is that and why is his reaction relevant?

He's a right-to-repair activist Youtuber who is quite involved in GrayJay, another app made by this company, which is a video player client for other platforms like YouTube.

I'm not sure why his reaction would be relevant, though. It'll just be another rant about how Google has too much control like he's done in the past. He may be right, but there's nothing new to say.

Re: Google flags Immich sites as dangerous

#214

Post by kaoD »

kyle-rb wrote: post #155
NelsonMinar wrote: post #6

Be sure to see the team's whole list of Cursed Knowledge. https://immich.app/cursed-knowledge

> JavaScript date objects are 1 indexed for years and days, but 0 indexed for months. I don't disagree that months should be 1-indexed, but I would not make that assumption solely based on days/years being 1-indexed, since 0-indexing those would be psychotic.

The only reason I can think of to 0-index months is so you can do monthName[date.getMonth()] instead of monthName[date.getMonth() - 1].

I don't think adding counterintuitive behavior to your data to save a "- 1" here and there is a good idea, but I guess this is just legacy from the ancient times.

Re: Google flags Immich sites as dangerous

#215

Post by jeroenhd »

sureglymop wrote: post #150
aetherspawn wrote: post #121

A good takeaway is to separate different domains for different purposes. I had prior been tossing up the pros/cons of this (such as teaching the user to accept millions of arbitrary TLDs as official), but I think this article (and other considerations) have solidified it for me. For example www.contoso.com (public) www.contoso.blog (public with user comments) contoso.net (internal) staging.contoso.dev (dev/zero trust…

The biggest con of this is that to a user it will seem much more like phishing. It happened to me a while ago that I suddenly got emails from "githubnext.com". Well, I know Github and I know that it's hosted at "github.com". So, to me, that was quite obviously phishing/spam. Turns out it was real...

PayPal is a real star when it comes to vague, fake-sounding, official domains.

Real users don't care much about phishing as long as you got redirected from the main domain, though. github.io has been accepted for a long time, and githubusercontent.com is invisible 99% of the time. Plus, if your regular users are not developers and still end up on your dev/staging domains, they're bound to be confused regardless.

Re: Google flags Immich sites as dangerous

#216

Post by gmueckl »

shadowgovt wrote: post #111
gmueckl wrote: post #109

Earlier quoted context omitted.

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.

How else am I going to make a game in the browser that be controlled with a controller?

Every decent host OS already has a dedicated driver stack to provide game controller input to applications in a useful manner. Why the heck would you ship a reimplementation of that in JS in a website?

Re: Google flags Immich sites as dangerous

#217

Post by gmueckl »

Kim_Bruning wrote: post #139
gmueckl wrote: post #76

Earlier quoted context omitted.

A part of the issue is IMO that browsers have become ridiculously bloated everything-programs. You could take about 90% of that out and into dedicated tools and end up with something vastly saner and safer and not a lot less capable for all practical purposes. Instead, we collectively are OK with frosting this atrocious layer cake that is today's web with multiple flavors of security measures of sometimes questionabl…

Are you saying we should make a A large set of really simple tools that each do one thing really really really pedantically well? This might be what's needed to break out of the current local optimum.

I haven't thought of it that way, but that might be a solution.

Re: Google flags Immich sites as dangerous

#218

Post by lucideer »

thayne wrote: post #96
arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

Looking through some of the links in this post, I there are actually two separate issues here: 1. Immich hosts user content on their domain. And should thus be on the public suffic list. 2. When users host an open source self hosted project like immich, jellyfin, etc. on their own domain it gets flagged as phishing because it looks an awful lot like the publicly hosted version, but it's on a different domain, and pos…

> I don't know of a good solution for the second though.

I know the second issue can be a legitimate problem but I feel like the first issue is the primary problem here & the "solution" to the second issue is a remedy that's worse than the disease.

The public suffix list is a great system (despite getting serious backlash here in HN comments, mainly from people who have jumped to wildly exaggerated conclusions about what it is). Beyond that though, flagging domains for phishing for having duplicate content smells like an anti-self-host policy: sure there's phishers making clone sites, but the vast majority of sites flagged are going to be legit unless you employ a more targeted heuristic, but doing so isn't incentivised by Google's (or most company's) business model.

Re: Google flags Immich sites as dangerous

#219

Post by jeroenhd »

ozgrakkurt wrote: post #187

Curious if anyone had an instance where this blocking mechanism saved them. I can’t remember a single instance in last 10 years

I've had it work for me several times. Most of the time following links/redirects from search engines, ironically a few times from Google itself. Not that I was going to enter anything (the phishing attempts themselves were quite amateurish) but they do help in some rare cases.

When I worked customer service, these phishing blocks worked wonders preventing people from logging in to your-secure-webmail.jobz. People would be filling in phishing forms days after sending out warnings on all official channels. Once Google's algorithm kicked in, the attackers finally needed to switch domains and re-do their phishing attempts.

Re: Google flags Immich sites as dangerous

#220

Post by asplake »

jadengeller wrote: post #154
lukan wrote: post #71

Earlier quoted context omitted.

"The engineering equivalent of a car made of duct tape" Kind of. But do you have a better proposition?

I'd probably say we ought to use DNS.

And while we’re at it, 1) mark domains as https-only, and 2) when root domains map to a subdomain (eg www).
Post reply on HN