71–80 of 161 posts
Can this be changed to the normal twitter URL, not the mobile version?
When I removed the "mobile" it looks exactly the same. I guess there is no non-mobile version of Twitter anymore.
Earlier quoted context omitted.
Wait, this is not happening locally, against bloom filters or something?
There is a first step which uses bloom filters, and if the filter gives a result, it is hashed and the hash is sent to the google service to double-check. That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. It's a problem without a good solution because if you create many collisions then you als…
What CRLite does achieves zero for both false positives BUT at quite a price. You need to know absolutely all the things that might ever be in the set before you start.
For CRLite they can almost wave that away by declaring that the set of things that might ever be in the CRL set is the set of logged certificates, so we can get that set from the log servers within 24 hours (the "Maximum Merge Delay" in public certificate transparency logs).
But you can't do that for URLs. The set of possible future phishing URLs has infinite size.
Earlier quoted context omitted.
If you are logged into Chrome your history is synchronized across platforms, tied to your Google account. Same as with Firefox Sync. Not sure about behavior when not logged in, or when incognito.
Firefox Sync is quite different than Chrome's version; with Firefox your data is encrypted locally on your machine before it is synced.
Every time I see people on HN campaigning for Microsoft as some kind of reformed tech company that has seen the errors of its past and turned into a force for good, something like this comes up. Same old Microsoft. Second verse same as the first.
Earlier quoted context omitted.
because the rumor has it that "Edge sends full URLs of pages visited to Microsoft" and we haven't yet caught google in such embarrassing situation
Well, by default, Chrome sends whatever you're typing in the URL bar to Google for auto-completion. No need to catch Google in such situation, it's a feature of Chrome.
Earlier quoted context omitted.
>That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. Why not send less bits (eg. 24 bit) of the hash?
The utility of the hash for a user and some potential attacker is the same. Yes, passing 8 fewer bits means that they have 256 times more possible sites you might have visited. But it also means that you get 256 times as many false positives of websites being labeled as phising. This is what GP meant by it being problem without a good solution. One possible option is to do what haveibeenpwned does, where you give few…
Say I go to https://fakebank.example/security/login and Google has decided all of fakebank.example is a phishing site.
My browser computes [among other things] SHA256('fakebank.example') and then it snips off the first four bytes and compares that to a large dataset it got from Google. It fetches updates to this dataset every few hours. Sure enough the four byte prefix is present in the dataset.
So, we've got an alarm - it calls Google, but it doesn't tell them it's thinking about https://fakebank.example/security/login at all, it just tells them the 4 byte prefix. Google responds with a list of full SHA256 hashes beginning with that prefix that it considers _right now_ to be phishing. The list might be empty (maybe fakebank.example was actually a Greek yoghurt company subject to a PHP 4.x attack, and they upgraded PHP and removed the phishing site so now it's fine) but if it has the entire SHA256 hash we calculated then I get an alert telling me that my browser thinks this is a phishing site and I might want to not visit.
Earlier quoted context omitted.
It is not so easy to do this MITM trick with Chrome, it has Google certs pinned down. "For the transparent proxy to work, it needs .google.com to be added to the URL whitelist to allow all traffic to .google.com. This configuration is not supported because of Chrome security features that are in place, and we recommend that you avoid the use of transparent proxies." https://support.google.com/chrome/a/answer/3504942?…
This link refers to Chrome devises, like Chromebooks, not to the Chrome browser.