Google Safe Browsing can kill a startup

Post by Ayesh » Sat, Jan 16, 2021, 7:57 PM UTC

erikpukinskis wrote: post #279

stingraycharles wrote: post #84

“Don't host any customer generated data in your main domains. ” This is extremely important for multiple reasons. One reason is the blacklisting as mentioned in the article, the other reason is security: browser typically implement security policies around domains as well, such as cookie scoping and whatnot. Putting all user generated content under a completely separate domain avoids a whole category of potential iss…

How do you do this in practice though? Let's say my marketing site is at turtlepics.com and then the pics, captions, feeds, etc are served off of turtlepicscontent.com. So I can serve my app off of turtlepics.com, that's fine. But it can't load any content directly. I'd have to have a separate https://turtlepicscontent.com/feeds/erik "> or whatever that loads a user's feed. But that needs to be authenticated too, so…

Post by rcoveson » Sat, Jan 16, 2021, 7:59 PM UTC

gomox wrote: post #286

rcoveson wrote: post #156

Earlier quoted context omitted.

No, I don't think that's how it would play out. 1. Google bans parler.com on Jan. 8th by adding it as an "unsafe URL" to their blacklist. 2. Mozilla issues statement: "While we don't believe it was prudent to use the Safe Browsing blacklist for this purpose, given recent events, we will not be unblocking parler.com, and do not currently deem it necessary to maintain a separate safe browsing list." 3. Something simila…

I can't tell if this is true or not - was parler.com actually blocked with this mechanism?

Post by hirsin » Sat, Jan 16, 2021, 8:00 PM UTC

gomox wrote: post #161

treis wrote: post #145

Earlier quoted context omitted.

IMHO, it sounds like it worked. The things you changed sound like it's made your site more secure. In the future, Googles hammer can be a bit more precise since you've segregated data. And you don't know what triggered it. It's possible that one of your clients was compromised or one of their customers was trying to use the system to distribute malware.

It's only more secure from Google's blacklist hammer. No significant security is introduced by splitting our company's properties into a myriad of separate domains. This type of incident can be a deadly blow to a B2B SaaS company since you are essentially taking out an uptime sensitive service that a lot of times has downtime penalties written down in a contract. Whether this is downtime will depend on how exactly th…

Post by [deleted] » Sat, Jan 16, 2021, 8:10 PM UTC

dheera wrote: post #234

freedomben wrote: post #20

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

Google Safe Search is only half the story. Another huge problem is Google's opaque and rash decisions about what sites throw up warnings in Chrome. I once created a location-based file-transfer service called quack.space [0] very similar to Snapdrop, except several years before they existed. Unfortunately the idiot algorithms at Chrome blocked it, throwing up a big message that the site might contain malware. That wa…

Post by gomox » Sat, Jan 16, 2021, 8:13 PM UTC

jefftk wrote: post #244

cadence- wrote: post #169

I can confirm everything that was said in that article. I run a free dynamic dns service (freemyip.com) and every time someone creates a subdomain that later hosts some questionable material, Google will immediately block my whole domain. Their response time for clearing these up varies from a few hours to two weeks. It feels completely random. I once had a malicious subdomain that I removed within two hours, yet the…

Have you considered requesting that your domain be added to the public suffix list? https://publicsuffix.org/ If subdomains of your domain should be treated as independent sites, the public suffix list is (sadly) how you communicate that to browsers. (Disclosure: I work for Google, speaking only for myself)