Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Apozy (YC W17) – Use browsing habits to stop phishing and spot breaches

news.ycombinator.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: Launch HN: Apozy (YC W17) – Use browsing habits to stop phishing and spot breaches

#31

Post by tptacek »

uzay wrote: post #29
koolba wrote: post #28

Earlier quoted context omitted.

> We don't need to send any information to our service to protect you from bad sites because that is handled locally. The browser history already exists so the load on your machine is the same with or without Apozy. We use the headers to make it efficient for a large number of sites - 1M+ Okay so the local version is comparing the user's current page vs. the sites they've gone to prior? And if it seems off based on s…

> Wouldn't work for me though as I have my browser set to nuke everything each time it's closed. If you don't nuke your local storage, it should still work. I do suspect it may be more annoying without any browser history to go on because there's no model built, so you have to 'prime the pump' a little more than a user who has history would have to. -Erhan

Are you storing a shadow browser history in localStorage?

Re: Launch HN: Apozy (YC W17) – Use browsing habits to stop phishing and spot breaches

#32

Post by koolba »

tptacek wrote: post #31
uzay wrote: post #29

Earlier quoted context omitted.

> Wouldn't work for me though as I have my browser set to nuke everything each time it's closed. If you don't nuke your local storage, it should still work. I do suspect it may be more annoying without any browser history to go on because there's no model built, so you have to 'prime the pump' a little more than a user who has history would have to. -Erhan

Are you storing a shadow browser history in localStorage?

I would imagine it's either that or they're somehow querying localStorage for the existence of any data for a given domain to indicate that you've been there before (which obviously wouldn't work for sites that don't use localStorage).

Re: Launch HN: Apozy (YC W17) – Use browsing habits to stop phishing and spot breaches

#33

Post by rickdeaconx »

tptacek wrote: post #31
uzay wrote: post #29

Earlier quoted context omitted.

> Wouldn't work for me though as I have my browser set to nuke everything each time it's closed. If you don't nuke your local storage, it should still work. I do suspect it may be more annoying without any browser history to go on because there's no model built, so you have to 'prime the pump' a little more than a user who has history would have to. -Erhan

Are you storing a shadow browser history in localStorage?

We keep just the FQDN for sites that you "unlock". If you don't click unlock, nothing is stored.

Re: Launch HN: Apozy (YC W17) – Use browsing habits to stop phishing and spot breaches

#34

Post by hunter2_ »

uzay wrote: post #29
koolba wrote: post #28

Earlier quoted context omitted.

> We don't need to send any information to our service to protect you from bad sites because that is handled locally. The browser history already exists so the load on your machine is the same with or without Apozy. We use the headers to make it efficient for a large number of sites - 1M+ Okay so the local version is comparing the user's current page vs. the sites they've gone to prior? And if it seems off based on s…

> Wouldn't work for me though as I have my browser set to nuke everything each time it's closed. If you don't nuke your local storage, it should still work. I do suspect it may be more annoying without any browser history to go on because there's no model built, so you have to 'prime the pump' a little more than a user who has history would have to. -Erhan

With TOFU, "priming" equates to blind trust in practice. This is an important point even when you don't nuke on browser-quit. You can have TOFU (e.g., SSH), WoT (e.g., PGP), or PKI (e.g., TLS)... each with it's pros and cons. I can only hope that someday we have something without the "priming" hole of TOFU, the UX hurdles of WoT, and the fact that HTTPS doesn't really stop people from being phished.

I think opting in to the server side checking (which is a bit like the domain-based blacklists that modern browsers have, I think) is the best thing we've got at the moment, so long as that channel isn't compromised.

Re: Launch HN: Apozy (YC W17) – Use browsing habits to stop phishing and spot breaches

#35

Post by rickdeaconx »

hunter2_ wrote: post #34
uzay wrote: post #29

Earlier quoted context omitted.

> Wouldn't work for me though as I have my browser set to nuke everything each time it's closed. If you don't nuke your local storage, it should still work. I do suspect it may be more annoying without any browser history to go on because there's no model built, so you have to 'prime the pump' a little more than a user who has history would have to. -Erhan

With TOFU, "priming" equates to blind trust in practice. This is an important point even when you don't nuke on browser-quit. You can have TOFU (e.g., SSH), WoT (e.g., PGP), or PKI (e.g., TLS)... each with it's pros and cons. I can only hope that someday we have something without the "priming" hole of TOFU, the UX hurdles of WoT, and the fact that HTTPS doesn't really stop people from being phished. I think opting in…

We rely on the whitelist to block all new threats, putting us ahead of domain-based blacklists. The server side checking is just to create a grade for privacy which you can look at for informational purposes as you browse.
Post reply on HN