> ... Google Safe Browsing service. Chrome checks every website you visit against a list of malicious websites that it periodically downloads from Safe Browsing.
So I have always disabled Safe Browsing because I assumed it was sending all my browsing activity to Google in real time to be checked. But this sounds like it's checking locally from a downloaded list. Anyone know if that's correct?
Documentation for the Safe Browsing implementation in Firefox can be found here[1].
[1]: https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
If you don't want to read [0], I think the Golang parser/lookup at [1] is a reasonable interpretation of what they're doing, but not sure. You can see there that the hashes generated are of different-host-combinations + different-URL-path-combinations. They do the partial hash check in a DB (local, downloaded periodically). If there's a partial hash in the DB, they phone home w/ that partial hash for the full hashes and check if it matches.
So Google gets the partial hash of a URL it had told you could be bad. They return the full hashes for that partial hash. We can hope (and see) that the partial hashes do not match a broad set (and they are host possibility + URL path combo possibility). Surely Google has something that maps the hashes to actual URL patterns, but like the other commenter said, the partial hash you send is only sent when it matches a local DB already.
0 - https://cs.chromium.org/chromium/src/components/safe_browsin...
It sends the first 4 bytes of a 32 byte SHA-256 hash of the URL. There isn't a reasonable map back for that.