Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Chrome heuristic warnings pose threat to our business

news.ycombinator.com

Post reply on HN
Print view View original

81–85 of 85 posts

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#81

Post by markshepard »

mayanksinghal wrote: post #80
markshepard wrote: post #77

Earlier quoted context omitted.

Even though this looks like a troll attempt, lets try this. The problem is 1. No clarity on what constitutes a problem. 2. No way to officially contact to clear up a problem resulting in possible irreparable loss of business. So, if you insist on interesting and orthogonal "analogies".. please carry on.

I was NOT trolling. I was pointing out that (A) Exaggeration is not a great debating tactic, in your case it was a clear slippery slope argument (B) It will not help in convincing the other stakeholders into being empathetic with your situation because you equated them to mindless psychopaths. > So, if you insist on interesting and orthogonal "analogies".. please carry on. If it was not clear, I was trying to describ…

I agree (and have posted in this very thread) that having controls for detecting spam/fraud is good. Also, I have posted that the primary problem is, no way to either a) avoid this problem by adhering to some guidelines b) no way to directly contact the developer to figure out the problem to resolve it.

Every update to the browser can potentially change the model that affects a large number of the users and the only way to figure out the problem is using some sort of trial and error method.

This would have been fine if the product in question is a niche product or a exotic browser. But the fact of the matter is, with Chrome (being one of the dominant browser) and Google being the product owner, the reach of Google's opinion is far reaching and can easily destroy a product (akin to killing a person based on some assumption).

Also note that, the "communication channels" listed earlier were completely useless for this type of problem where the client side is throwing the error (Not related to a specific domain or even url included in the page).

Understand that, being a commercial product, ALL possible methods were tried (obviously) to resolve it by using those methods and could not resolve it. You can see that, this specific instance gets triggered by simply having a button with the name "Connexion" instead of "Login" (purely detected by backtracking the changes).

So the frustration is not meant to belittle Google's effort at combating spam/fraud but to point out the effect of such wide ranging blanket solutions.

While "Collateral damage" is a very nice way to de-sanitize and make things palatable for all parties involved except those getting to be the "Collateral damage".

At the end of the day, I am sure folks understand that Google being Google can do what they want and probably even bury the whole issue from getting any traction.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#82

Post by miomyosky »

hiddenfeatures wrote: post #69
miomyosky wrote: post #51

Earlier quoted context omitted.

Thanks for the really useful tip to look into Chrome's debug log. First of all we see that this so called phishing detection filter's code is found at http://src.chromium.org/svn/trunk/src/chrome/renderer/safe_b... Second, this code and the logic it employs is really bull . The world wide web is not a kiddie playground especially for a browser, and especially for a plugin whose's job is to detect phishing. The way Ch…

As much as I can understand you being upset that Chrome shows a warning for your site, I don't think that the approach they are using is unreasonable. I'd take bets that those criteria show a correlation to phishy sites. Especially if you combine those metrics together. Is it perfect? No. Does it produce false positives? Yes. Is it beneficial on average? I think so. PS: Since you have found the relevant file in the o…

My point is that with an browser (similar to an OS), they cannot take things lightly and flag things left and right based on "heuristics". With great power comes great responsibility.

My point is that if you are going to design a system to identify bad websites it better be fail safe otherwise it is going to cause a lot of hurt.

The message shown in the browser for a phishing warning is the same as when a website has an invalid SSL certificate. The first is vaguely accurate, the latter is 100% accurate and no one is going to argue if the warning is needed. Both show the mind chilling warning no sane user will click through.

I am more interested in removing the phishing filter than in writing a phishing filter.

Anyways, with a 'closed' server component also in the mix, what option is there to provide any implementation.

IMHO, I think that doing things for the 'benefit of most' will lead to eroded freedoms for all over time.

PS: 'Supply a better implementation' is not an answer to writing poor code and hoisting on the world.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#83

Post by mayanksinghal »

markshepard wrote: post #81
mayanksinghal wrote: post #80

Earlier quoted context omitted.

I was NOT trolling. I was pointing out that (A) Exaggeration is not a great debating tactic, in your case it was a clear slippery slope argument (B) It will not help in convincing the other stakeholders into being empathetic with your situation because you equated them to mindless psychopaths. > So, if you insist on interesting and orthogonal "analogies".. please carry on. If it was not clear, I was trying to describ…

I agree (and have posted in this very thread) that having controls for detecting spam/fraud is good. Also, I have posted that the primary problem is, no way to either a) avoid this problem by adhering to some guidelines b) no way to directly contact the developer to figure out the problem to resolve it. Every update to the browser can potentially change the model that affects a large number of the users and the only…

> even bury the whole issue from getting any traction.

Wasn't your site explicitly whitelisted?

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#84

Post by markshepard »

mayanksinghal wrote: post #83
markshepard wrote: post #81

Earlier quoted context omitted.

I agree (and have posted in this very thread) that having controls for detecting spam/fraud is good. Also, I have posted that the primary problem is, no way to either a) avoid this problem by adhering to some guidelines b) no way to directly contact the developer to figure out the problem to resolve it. Every update to the browser can potentially change the model that affects a large number of the users and the only…

> even bury the whole issue from getting any traction. Wasn't your site explicitly whitelisted?

Yes. I believe it has been added to a temp whitelist. But it is not clear if is domain based or somekind of signature based. If it is domain based, then whitelisting is not useful (This is hosted on various domains as noted by others). If it is signature based, it will be more effective (though the signature will change as the server code changes and since there is no idea what gets into the signature, there is no way to avoid).

Also, dev1.codelathe.com was re-setup specifically to trigger the warning (It was determined that if the login button has the keyword "Connexion", it was pushing the phishing score past 0.5)

The main thing is, if there is a clear way to contact the team responsible for this to resolve such issues, that will be the best way for anyone with similar problem and at this point there is no such avenue.

Post reply on HN