Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

31–40 of 713 posts

Re: Google flags Immich sites as dangerous

#31

Post by akerl_ »

donmcronald wrote: post #2

I tried to submit this, but the direct link here is probably better than the Reddit thread I linked to: https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a... I had my personal domain I use for self-hosting flagged. I've had the domain for 25 years and it's never had a hint of spam, phishing, or even unintentional issues like compromised sites / services. It's impossible to know what Google's black box is do…

> I suspect my flagging was the result of failing to use a large email provider.

This seems like the flagging was a result of the same login page detection that the Immich blog post is referencing? What makes you think it's tied to self-hosted email?

Re: Google flags Immich sites as dangerous

#33

Post by tym0 »

strken wrote: post #24
levkk wrote: post #14

Earlier quoted context omitted.

The Postgres query parameters one is funny. 65k parameters is not enough for you?!

As it says, bulk inserts with large datasets can fail. Inserting a few thousand rows into a table with 30 columns will hit the limit. You might run into this if you were synchronising data between systems or running big batch jobs. Sqlite used to have a limit of 999 query parameters, which was much easier to hit. It's now a roomy 32k.

Right, for postgres I would use unnest for inserting a non-static amount of rows.

Re: Google flags Immich sites as dangerous

#34

Post by beala »

donmcronald wrote: post #22
snailmailman wrote: post #17

Earlier quoted context omitted.

I’ve heard anecdotes of people using an entirely internal domain like “plex.example.com” even if it’s never exposed to the public internet, google might flag it as impersonating plex. Google will sometimes block it based only on name, if they think the name is impersonating another service. Its unclear exactly what conditions cause a site to get blocked by safe browsing. My nextcloud.something.tld domain has never be…

I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL…

It doesn’t seem like email scanning is necessary to explain this. It appears that simply having a “bad” subdomain can trigger this. Obviously this heuristic isn’t working well, but you can see the naive logic of it: anything with the subdomain “apple” might be trying to impersonate Apple, so let’s flag it. This has happened to me on internal domains on my home network that I've exposed to no one. This also has been reported at the jellyfin project: https://github.com/jellyfin/jellyfin-web/issues/4076

Re: Google flags Immich sites as dangerous

#35

Post by r_lee »

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

Does Google use this for Safe Browsing though?

Re: Google flags Immich sites as dangerous

#36

Post by im3w1l »

donmcronald wrote: post #22
snailmailman wrote: post #17

Earlier quoted context omitted.

I’ve heard anecdotes of people using an entirely internal domain like “plex.example.com” even if it’s never exposed to the public internet, google might flag it as impersonating plex. Google will sometimes block it based only on name, if they think the name is impersonating another service. Its unclear exactly what conditions cause a site to get blocked by safe browsing. My nextcloud.something.tld domain has never be…

I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL…

Chrome sends visited urls to Google (ymmv depending on settings and consents you have given)

Re: Google flags Immich sites as dangerous

#37

Post by akerl_ »

r_lee wrote: post #35
arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

Does Google use this for Safe Browsing though?

Looks like it? https://developers.google.com/safe-browsing/reference/URLs.a...

Re: Google flags Immich sites as dangerous

#38

Post by r_lee »

donmcronald wrote: post #22
snailmailman wrote: post #17

Earlier quoted context omitted.

I’ve heard anecdotes of people using an entirely internal domain like “plex.example.com” even if it’s never exposed to the public internet, google might flag it as impersonating plex. Google will sometimes block it based only on name, if they think the name is impersonating another service. Its unclear exactly what conditions cause a site to get blocked by safe browsing. My nextcloud.something.tld domain has never be…

I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL…

if it was just the domain, remember that there is a Cert Transparency log for all TLS certs issued nowadays by valid CAs, which is probably what Google is also using to discover new active domains

Re: Google flags Immich sites as dangerous

#39

Post by EdwardKrayer »

donmcronald wrote: post #22
snailmailman wrote: post #17

Earlier quoted context omitted.

I’ve heard anecdotes of people using an entirely internal domain like “plex.example.com” even if it’s never exposed to the public internet, google might flag it as impersonating plex. Google will sometimes block it based only on name, if they think the name is impersonating another service. Its unclear exactly what conditions cause a site to get blocked by safe browsing. My nextcloud.something.tld domain has never be…

I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL…

Well, that's potentially horrifying. I would love for someone to attempt this in as controlled of a manner as possible. I would assume it's possible for anyone using Google DNS servers to also trigger some type of metadata inspection resulting in this type of situation as well.

Also - when you say banned, you're speaking of the "red screen of death" right? Not a broader ban from the domain using Google Workplace services, yeah?

Re: Google flags Immich sites as dangerous

#40

Post by CaptainOfCoit »

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

I think it's somewhat tribal webdev knowledge that if you host user generated content you need to be on the PSL otherwise you'll eventually end up where Immich is now.

I'm not sure how people not already having hit this very issue before is supposed to know about it beforehand though, one of those things that you don't really come across until you're hit by it.

Post reply on HN