Google Safe Browsing can kill a startup • Hacker News Board

Re: Google Safe Browsing can kill a startup

#531

Post by apple_innocent » Sun, Jan 17, 2021, 8:04 PM UTC

kelnos wrote: post #496

apple_innocent wrote: post #486

Earlier quoted context omitted.

"For years, they said no, because they were worried about the liability of accidentally blocking something that wasn't a phishing site." Can anyone explain how a web browser author could be liable for using a blacklist. Once past the disclaimer in uppercase that precedes every software install, past the Public Suffix (White)List that browsers include, how do you successfully sue the author of a software program, a we…

I think the situation is actually exactly like the Spamhaus case you describe: it wouldn't be the browser user that sues, but the blocked website's owner. The website's owner need not have accepted any kind of agreement from the browser maker in order to be harmed by the blocklist.

Perhaps the website would sue the author of the list.

That does not explain why this comment suggests a browser author was afraid to use the list.

The browser author could easily require the list author to agree that the browser author has no obligations to the list author if the list author gets sued by a website, and the list author must idemnify the browser author if the browser author is named in any suit over the list. The list author must assume all the risk.

Re: Google Safe Browsing can kill a startup

#532

Post by gzalo » Sun, Jan 17, 2021, 8:32 PM UTC

londons_explore wrote: post #218

judge2020 wrote: post #109

Earlier quoted context omitted.

> What's most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome. I'm assuming they make this decision based on some database of checksums. Doesn't Chrome upload everything downloaded to VirusTotal (a Google product)?

The hashes of all things that match a "probably evil" bloom filter, yes. Hosting a virus on a domain and then downloading it a few times with different chrome installations sounds like a good way to get the whole domain blacklisted...

I wonder if that could be triggered even when the certificate chain is not validated... you could MITM yourself (for example, using Fiddler) and make Chrome think it's downloading files from the real origin. In that case, an attacker could do that from multiple IPs and force Google to flag your whole domain.

Re: Google Safe Browsing can kill a startup

#533

Post by temp667 » Sun, Jan 17, 2021, 9:45 PM UTC

psyc wrote: post #100

mcguire wrote: post #75

Of particular note: " Don't host any customer generated data in your main domains. A lot of the cases of blacklisting that I found while researching this issue were caused by SaaS customers unknowingly uploading malicious files onto servers. Those files are harmless to the systems themselves, but their very existence can cause the whole domain to be blacklisted. Anything that your users upload onto your apps should b…

Pardon my ignorance as I have few years of web dev experience. What exactly does it mean to store data on a domain? Does he mean serve data via a domain URL? And if so, how does Google have discovery of that data?

We use a fair number of google products, and you can turn on a lot of enhanced protection, and many businesses do. This means even password protected / private URLs may generate scans from what I've seen. I'm not sure how they actually fingerprint files (maybe locally) but it seems pretty broad

This seems to work across a lot of google products (gmail, drive, chome etc) so it scoops up a ton.

More here:

https://security.googleblog.com/2020/05/enhanced-safe-browsi...

Not sure if this is related to safe browsing. We also can turn on more scanning and other features of all email users.

The key though, if you allow users to PUT files onto your S3 (even private / signed in) then google may scan them. That means if your user uploads a suspicious file to a trouble ticket system, if there IS a virus in there and google sees it, wham. Obviously most folks will segregate those uploads off into their own s3 bucket by user/account to avoid contamination, but you really have to be careful not to hose viruses AT ALL on your key domains.

Re: Google Safe Browsing can kill a startup

#534

Post by tjalfi » Sun, Jan 17, 2021, 11:00 PM UTC

at_a_remove wrote: post #96

freedomben wrote: post #20

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

Jon Williams, circa 1987, wrote a story of a far-flung humanity's future in "Dinosaurs," in which humans had been engineered into a variety of specialized forms to better serve humanity. After nine million years of tweaking, most of them are not too bright but they are perfect at what they do. Ambassador Drill is trying to prevent a newly discovered species, the Shar, from treading on the toes of humanity, because if…

Thanks for mentioning this story; I just finished it and it's a great read.

Re: Google Safe Browsing can kill a startup

#535

Post by donmcronald » Sun, Jan 17, 2021, 11:55 PM UTC

ehsankia wrote: post #379

yuvalr1 wrote: post #325

Earlier quoted context omitted.

This is an amazing story. It really demonstrates the way we pave our road to hell with good intentions... We should really do something about this issue, where so few companies (arguably, a single one) hold so much power over the most fundamental technology of the era.

Are you implying that the list no longer has a good intention? I wouldn't be surprised if there are multiple orders of magnitude more phishing and hacked websites in 2021 than there was in 2004. Even with human checking, I doubt you'll even have 0% failure rate. Is the solution to just give up on blocking phishing sites?

> Are you implying that the list no longer has a good intention?

Most of the time I run into blocked sites they seem to be blocked because of copyright infringement, not phishing. The only phishing sites I've seen in the last year or so are custom tailored. For example, I had to deal with a compromised MS365 account last year where the bad actor spun up a custom phishing site using the logo, signature, etc. of the victim.

So IMHO the intentions are no longer pure plus the effect is diminished and being worked around.

Re: Google Safe Browsing can kill a startup

#536

Post by gomox » Mon, Jan 18, 2021, 12:43 AM UTC

koalaman wrote: post #516

freedomben wrote: post #20

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

(Googler) You are only focusing on the negatives while completely ignoring the positives here. Here are a few questions to consider that may give you better perspective: 1) Do you know the magnitude of financial and psychological damage caused by malware, phishing, etc on the web? 2) Do you believe that it is possible to have a human review every piece of automation generated malware on the internet? 3) Do you believ…

Author here - I don't underestimate the complexity of the task that Google Safe Browsing tries to accomplish.

But: Do you believe there is no room for improvement in an automated, opaque system with clear evidence of malfunction, that quite succinctly decides if hundreds of people go unemployed when their company tanks for nothing other than an incorrectly set threshold on some algorithm?

That is the real question to ask. Google is nowhere near its limits in terms of capability, as is made abundantly clear by its extremely comfortable financial position.

Re: Google Safe Browsing can kill a startup

#537

Post by gomox » Mon, Jan 18, 2021, 12:44 AM UTC

Tyr42 wrote: post #525

rdm70 wrote: post #521

Earlier quoted context omitted.

2*) Do you believe that it is possible to have a human review every FALSE POSITIVE result from automated malware detection on the internet, when reported by those adverse affected by the false positive result? Yes, yes I do. Banks do it for their customers today at scale.

So what happens when the fraudsters automate clicking the "request review" button? They can spin up as many phishing sites as they want, and request as many human hours in review as they want. With banks, they only have to do that for their customers, whom they've at least had a chance of getting money from. But Google would need to provide it to every site which gets blocked, (as malware sites pretend to be legitima…

There are plenty of mechanisms to tackle this problem. But you have to want to care.

Re: Google Safe Browsing can kill a startup

#538

Post by kortilla » Mon, Jan 18, 2021, 2:47 AM UTC

lotsofpulp wrote: post #329

kortilla wrote: post #313

Earlier quoted context omitted.

The saying is for your own sanity. If you go around assuming every mistake is malicious, it’s going to fuck up your interactions with the world. Everyone I know who approaches the world with a me vs. them mentality appears to be constantly fraught with the latest pile of actors “trying to fuck them”. It’s an angry, depressing life when you think that the teller at the grocery store is literally trying to steal from y…

One does not have to choose between assuming everything is malice or everything is stupid. Situations in the real world are more nuanced, and hence the saying is inane.

It’s not though. Assuming malice is incorrect 99.9% of the time and correctly identifying that other fraction offers so little upside. What good does it do to realize earlier that the person is malicious and not incompetent?

Re: Google Safe Browsing can kill a startup

#539

Post by coldtea » Mon, Jan 18, 2021, 3:20 AM UTC

msh wrote: post #519

coldtea wrote: post #503

Earlier quoted context omitted.

All? I doubt it. Not to mention they could offer control to override whatever you like.

Well enough that it will still be a blocker.

Well, that goes without saying. If you want a blocker, you want a blocker. So all the nigerian princes and the like should still be blocked.

You just don't want to give control over the blocking blacklist/whitelist to a single entity, even less so to a huge powerful one, possibly in a country other than your own (which e.g. forces their foreign policy dictums to your blacklist), and even less so the one that already makes your browser, that should be a totally neutral conduit.

Re: Google Safe Browsing can kill a startup

#540

Post by smsm42 » Mon, Jan 18, 2021, 4:16 AM UTC

mewse wrote: post #479

smsm42 wrote: post #470

Earlier quoted context omitted.

Since phishing is not going to go anywhere with or without blacklists - for obvious reasons, e.g. lists can't cover everything, and you can't add sites to the list instantly - I am willing to tolerate a slight increase in fishing which is going to exist anyway in exchange for not having Google (or any other megacorp, or any other organization for that matter) as a gatekeeper of everybody's access to the internet. The…

> I am willing to tolerate a slight increase in fishing According to Google's most recent transparency report[1], as of December 20th of last year they were blocking around 27,000 malware distribution sites and a little over 2,000,000 phishing sites. In your view, would turning off those blacklists and allowing those >2,000,000 sites to become functional again count as a "slight" increase? (edit: That's a real questi…

I'm not sure what is counted as "sites" - i.e. if Google closes foo.bar/baz123 and the same server gets assigned bar.foo/zab345 and continues to serve malware, is it 2 separate sites? Did Google really achieve this much by forcing the changing of the URL? Sure, bunch of people that got the phish link in the mail that was sent before switch but then shut down won't be phished, but I have no idea how much that changes the picture - I'm sure phishers are well aware that their domains are short-lived and already adapted for that, otherwise they'd be extinct. However, I'd be glad to read some field-validated data about how much closing those 2M sites, whatever is meant by "sites", actually helps against phishing.

I mean if we could trust Google (or anybody else of that kind) to have blacklist strictly limited to reasonable definition of malware and phishing, and knew that usage of such list if strictly voluntary under control of the user, it would be an acceptable, if decidedly imperfect, remedy. But we know we can't trust any of this, even if whoever works on this at Google right now are sincerely ironclad committed to never any mission creep and abuse happen, once the means exist, these people can always be replaced with others that would use it to fight "misinformation", or "incitement", or "blasphemy", or whatever it is in fashion to fight this week. There's no mechanism that ensures it won't be abused, and abuse is very easy once the system is deployed.

Moreover, we (as, people not in control of Google's decisions) have absolutely no means to prevent any abuse of this, since Google owns the whole setup and we have no voice in their decision making process. Given that, it seems to be prudent to make all effort to reject it while we still can. Otherwise next time you'd want to make a site questioning Google's decisions about the malware list, nobody would be able to read it because it'd be marked as a malware site.