Google Safe Browsing is blocking small Mastodon servers

https://snake.club/@brenns10/109310758358453347

by brenns10 • 4 years ago

106 46 4 years ago

brenns104• 4 years ago

Hi folks, my Mastodon server is now blocked as a "deceptive site," likely because its login pages are similar to other Mastodon servers. To a machine learning or rule-based system, I could see how that seems deceptive. But I'm now stuck in a several days to several weeks long wait for manual review. And of course there's no guarantee that manual review will result in a correct decision.

Meanwhile, it's truly incredible how fully my site is now blocked off from the world. Firefox Android won't even let me access it, while Chrome hides the click-through underneath the "details" button. My friends who use the site are understandably concerned, but there's not much I can do. It's crazy how a false positive in one centralized system can impact my little piece of the fediverse.

thrtythreeforty• 4 years ago

Pushbullet has also learned the hard way how to respond to Google's faceless review process:

Now that you know you’re up against an automated policy enforcement AI, your goal is to look as much as possible like the training data. Unfortunately, this can be easier said than done since we do not have access to the training data.
All is not lost, however. You have actionable info in the simple fact that what your app looks like now is not acceptable.

https://blog.pushbullet.com/2022/10/27/how-we-became-the-wor...

brenns104• 4 years ago

As an update, Google's "warning level" seems to have dropped to Yellow from Red: https://transparencyreport.google.com/safe-browsing/search?u...

I still see an exclamation mark in mobile Chrome, but it looks like the big scary red interstitial is gone from most browsers I've seen. Perhaps it was enough different people reporting false positive? Or maybe a re-scan or manual action. Unclear but it's appreciated. Wish there was more transparency (ironic given the "transparencyreport" subdomain that URL is hosted at).

josephcsible• 4 years ago

Firefox on Android says this:

has been reported as a deceptive site and has been blocked based on your security preferences.

I checked its settings page and saw no such preference, and about:config is a blank page there. So where is this alleged preference?

brenns104• 4 years ago

I don't know, I got that exact error and searched the settings. I couldn't find that preference either.

Ptchd3• 4 years ago

maybe the "safe browsing" setting that uses a list from google to block sites (which I always disable)... Mozilla is in bed with Google on so many levels...

Beltalowda• 4 years ago

There's a setting on the Firefox desktop version; I guess it's not exposed in the Android version for some reason. These mobile phone browsers tend to be "dumbed-down" in general. Not hard to imagine it just re-uses the same error message from the desktop version, probably just as a simple oversight.

brenns104• 4 years ago

Yeah it's probably an oversight, but that oversight feels particularly irresponsible given that it completely blocks the ability to access web sites (the primary function of a web browser) based on a third-party block list which can't be disabled.

cwillu• 4 years ago

They removed about:config from android firefox builds except for the nightly builds. Mildly enraging, that.

nic-waller• 4 years ago

I saw a similar aggressively red warning on Mobile Safari. Apparently it uses the same database of "deceptive" pages.

I turned off "Fraudulent Website Warning" in Settings and then I was able to access your site.

account423• 4 years ago

Yes, sadly all browser's just trust Google even when Google has shown that they don't care about false positives.

amatecha6• 4 years ago

Stuff like this is why I never use those "block malicious sites" sort of features -- not only because I assume they involve sending every URL I access to some kind of checking service, but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy". Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems?

To me there's also some irony to the name "Google Safe Browsing", because IMHO that is an oxymoron -- browsing with Chrome is never "safe" for you because of the inherent/persistent violations of your privacy.

cmeacham983• 4 years ago

As much as I love to hate Google:

not only because I assume they involve sending every URL I access to some kind of checking service

This isn't even remotely close to true.

but also because I don't trust Google or Mozilla (or any other corporate software vendor) to be the arbiter of what makes a site "trustworthy"

Maybe you're a genius that can navigate the web with ease, but the reality is this feature has probably stopped millions or even billions of malware downloads and/or phishing attempts.

Further, maybe I wouldn't have to worry so much about whether I can "trust a website" if they would stop turning their web browsers into full-blown operating systems?

Safe browsing is more about stopping people from accidentally downloading malware or falling for a phish, and very little about exploits in the browser itself which are few and far between.

krono2• 4 years ago

At least some data is definitely shared with Google's safe browsing service by default, more and with greater detail still when "enhanced protection" or "make searches and browsing better" is enabled.

https://security.googleblog.com/2022/08/how-hash-based-safe-...

https://security.googleblog.com/2020/05/enhanced-safe-browsi...

amatecha6• 4 years ago

Yeah for the first thing, I said I assume it -- I wasn't actually making an assertion that all the requests get sent to a server. I can't realistically spend the effort to double-check every single thing like this (as in how badly every corp is spying on me), and it's substantially easier to just assume the worst and act accordingly.

Right, I'm sure the "Safe Browsing" stuff has prevented downloads of .exes that the user never would have run anyways (but I digress). Regardless, I still am not going to rely on shareholder-driven megacorps to decide what sites I can trust or not. They have proven they are not trustworthy themselves. To start, Google does things like hiding portions of the URL of the website you're on[0], making the web browsing experience even more opaque than it already is for the average user. In fact, Google has even engaged in phishing-like behaviour themselves, replacing an original website with their own AMP version, while showing the original URL[1].

Of course, this is all without even touching on the shocking depth of surveillance/tracking undertaken by Google.

Regarding exploits in the browser iself, in fact, the extremely massive surface area of web browser software is indeed absolutely a vector for malware. In this sense, Safe Browsing is a solution to a problem browser vendors created by nearly turning the web browser into an OS. By April this year, Chrome had already hit its third zero-day exploit[2] affecting its billions of users. By last month, it had hit its seventh[3]. Basically every month or two there's a new actively-exploited vulnerability in Chrome that may very well allow malware to be installed on your system by simply visiting a web page. If only trying to read some text on a website didn't mean risking having my home network turned into a botnet, or getting ransomware-locked...

[0] https://www.bleepingcomputer.com/news/google/google-chrome-h...

[1] https://www.androidpolice.com/2019/04/16/amp-pages-will-now-...

[2] https://www.forbes.com/sites/gordonkelly/2022/04/16/google-c...

[3] https://www.forbes.com/sites/daveywinder/2022/10/28/emergenc...

olliej3• 4 years ago

Ok, so it sounds like you misunderstand how the Safe Browsing system works.

If you want to be a provider of url blocking you do the following:

    1. Compile a list of "unsafe" urls (malware, phishing, cookie clicker, etc)
    2. Generate a SHA256 hash of every url in (1)
    3. Truncate those hashes to 32 bits (Because there are a lot of them :( )
    4. Publish that list

If you're writing a client that wants to use these providers you do this:

    1. Download the list published above
    2. Before you load a url calculate a SHA256 hash of that url
    3. Truncate that hash to 32 bits
    4. Check your giant list of hashes to see if there's a collision.
    5. If there is no collision you're done, and carry on the load as usual; otherwise
    6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3)
    7. See if the hash from (2) is in the full hashes you get in (6).
    8. If there is no collision then load the url, otherwise display scary warnings.

You can see that at no point does the url being checked go in either direction.

amatecha6• 4 years ago

Oh, no, I didn't even look into it. I only just tonight read the docs about these features in Chrome & Firefox for the first time. I see "modern-day NetNanny" and turn it off. I quite literally assume the worst and disable it.

piaste• 4 years ago

3. Truncate those hashes to 32 bits (Because there are a lot of them :( )

Is it worth all this trouble just to get a Nx space saving?

Because if you just published the 256-bit hashes directly, you could skip the following steps entirely:

6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3) 7. See if the hash from (2) is in the full hashes you get in (6).

which are the parts that require an actual network call, infrastructure costs, and privacy issues. Speaking of which:

You can see that at no point does the url being checked go in either direction.

You're not sending the whole URL, but in step (6) you're still telling the source that you're visiting a website belonging to a particular subset of hashes, hashes which the source knows the plaintext of.

I guess the question is exactly how large the set of 'unsafe' urls is. If it's merely in the billions, then (a) truncating the hashes will only get you a roughly ~4x space saving and (b) the 32-bit hashes you send will almost uniquely identify the website you tried to visit. If it's in the trillions, then it makes more sense.

im3w1l• 4 years ago

6. Ask the source of step 1 to give you the full set of hashes corresponding to the prefix from (3)

This is quite similar to sending the url. Like there might only be a single site with that hash. Or there might be a handful of which one is far more likely than the others because it has 1000x their dau.

throwawayyuno• 4 years ago

Google has also been blocking access to a lot (read: more than 1) of Yunohost selfhosted servers lately: https://forum.yunohost.org/t/google-flags-my-sites-as-danger...

My server hosted at home got flagged. After 2 weeks of submitting appeals every 3-4 days it was finally reviewed and the flag was removed.

How did we let megacorps have so much control over who can access our websites?!

account423• 4 years ago

Good to see more people realizing the kind of control browser makers give Google via this misfeature. It should not be acceptable for an unaccountable for-profit corporation to decide what the average person can or cannot see without any due process for site operators. Yet here we are. Get you software flagged by machine-learning algorithms? Too bad, pretty much every browser will prevent users from downloading it. And yes, prevent - even those browsers that still provide an override hide it well enough that many users will not find it. Appeal? If you are lucky and Google doesn't just deny it without reason then look forward to getting re-listed in a couple of weeks.

Am4TIfIsER0ppos• 4 years ago

This thread has been a good reminder to go check your settings in about:config. I was unaware that firefox had turned one single option into several which seem to be on by default ignoring my previous change.

Google Safe Browsing is blocking small Mastodon servers

Related Stories