Google flags Immich sites as dangerous

Post by a456463 » Thu, Oct 23, 2025, 2:47 PM UTC

0xbadcafebee wrote: post #65

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

In the past, browsers used an algorithm which only denied setting wide-ranging cookies for top-level domains with no dots (e.g. com or org). However, this did not work for top-level domains where only third-level registrations are allowed (e.g. co.uk). In these cases, websites could set a cookie for .co.uk which would be passed onto every website registered under co.uk. Since there was and remains no algorithmic meth…

Post by bo0tzz » Thu, Oct 23, 2025, 2:49 PM UTC

lucideer wrote: post #449

Gormo wrote: post #401

Earlier quoted context omitted.

It's true that putting locks on your front door will reduce the chance of your house getting robbed, but if you do get robbed, the fact that your front door wasn't locked does not in any way absolve the thief for his conduct. Similarly, if an organization deploys a public system that engages in libel and tortious interference, the fact that jumping through technical hoops might make it less likely to be affected by t…

> mitigating false positives First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. I think there's likely a conversation to be had about messaging - Chrome's warning page seems a little scarier than it should be, Firefox's is more measured in its messaging. But in terms of the API service Google are pro…

Post by 14 » Thu, Oct 23, 2025, 2:56 PM UTC

93po wrote: post #480

mcv wrote: post #470

Earlier quoted context omitted.

It would be glorious if everybody unjustly screwed by Google did that. Barring antitrust enforcement, this may be the only way to force them to behave.

it wouldn't work. they'd hire some minimum wage person to go to all of them and just read the terms and conditions you agreed to that include language about arbitration or whatever

Post by david_van_loon » Thu, Oct 23, 2025, 2:56 PM UTC

darkwater wrote: post #265

david_van_loon wrote: post #85

I'm fighting this right now on my own domain. Google marked my family Immich instance as dangerous, essentially blocking access from Chrome to all services hosted on the same domain. I know that I can bypass the warning, but the photo album I sent to my mother-in-law is now effectively inaccessible.

Out of curiosity, is your Immich instance published as https://immich.example.com ?

Post by david_van_loon » Thu, Oct 23, 2025, 2:59 PM UTC

shaky-carrousel wrote: post #291

donmcronald wrote: post #238

Earlier quoted context omitted.

Just in case you're not sure how to deal with it, you need to request a review via the Google Search Console. You'll need a Google account and you have to verify ownership of the domain via DNS (if you want to appeal the whole domain). After that, you can log into the Google Search Console and you can find "Security Issues" under the "Security & Manual Actions" section. That area will show you the exact URLs that got…

It's a bit ironic that a user installing immich to escape Google's grip ends up having to create again a Google account to be able to remove their Google account.