My experience being blocked by Google Safe Browsing (2022)

Malicious actors can easily change domains, legitimate businesses can't.

So this is a harsh punishment to all good people, and very weak punishment to all scammers and spammers.

>I would go even further and say I don't like ideas like Firefox's/Brave's "Enhanced Tracking Protection" which blocks certain services with a handpick ruleset. Don't get me wrong, I block these trackers myself in uBlock Origin, but I don't like idea that a browser maintains an arbitrary list itself of what to block for the users.

The primary difference is in the messaging. Tracking protection is an opt-in feature, so the user is always aware of it. Additionally, at least in the forms I've encountered it, it doesn't outright prevent you from navigating to a website. At worst it breaks some sites, and you disable it, it's sitting right there in your browser navigation bar. Don't agree with some block? Overriding it is a click away.

Meanwhile, safebrowsing doesn't announce itself anywhere except when it hits you in the face with a giant red screen, specifically designed to inspire a sense of fear/dread. Override buttons are intentionally not outright presented to the user, and the toggles to completely disable the feature are tucked deep into advanced features where no muggle may reach.

It may sound stupid but this simple difference in optics radically changes the effect such a "manual blacklisting" feature has on its users. That said I agree it'd be nice to have more control over the tracking protection feature in firefox, e.g. by allowing custom lists, like uBlock does.

This is a bit dangerous because of zero-days. If you do this in a throw-away isolated virtual machine, this is probably safe.

A digital running of the bulls!

You shouldn't, the links usually have unique data embedded and it will confirm your email as a valid target for future attacks. You are basically adding a "real mailbox with an active, gullible user" tag to your email in the spammers list.

Very effective at... what? I mean, they seem to not be able to tell the difference between a legit mastodon instance and a phishing site, so why would they suddenly be able to tell if it effectively blocked a site that was actually malicious?

Yes, blocking sites on a blocklist works very well. Whether those sites are legit or not doesnt matter at that point, to them, as they assume they all are malicious.

Do you see what I mean?

GPG is so criticised because of the web of trust concept.

Does it though? Mine says "Changing advanced configuration preferences can impact Firefox performance or security."

Here is a screenshot: https://i.imgur.com/RYPhiSe.png

This is Firefox 111.0.1 on Kubuntu.

I think it was meant as a joke.

Yes and no, the public crowdsourcing is only a part.

The biggest influence are trusted security groups, where security teams of influential websites who trust each other can push or remove websites from these lists without any vetting from anyone.

This is also from there that you can download and share lists of unhashed passwords with e-mails (you know this warning "This password has likely been compromised", they need to source it from somewhere).

If the owner of a website complains, he is never going to win the appeal against a member of the special group.

So it's a very (useful and important) political game once your website becomes large.

This is also where you can informally directly communicate with agencies like FBI.

> A complete free-for-all doesn't work because malicious actors be malicious and a majority of users aren't competent to protect themselves against such threats.

It does work. You claim it doesn't because you think the resultant state of affairs is intolerable, but to subsequently claim it "doesn't work" because you don't like the outcome is simply wrong. You might as well claim that allowing people to buy pointy kitchen knives "doesn't work" because sometimes people stab each other and you think murders are simply intolerable. But the reality is that allowing people to have pointy knives even though some people get hurt does work, even though it doesn't produce an outcome the hypothetical you are happy with.

The problem with "think of the children" style arguments is they are always unbounded, and there is always something more controlling than what we're doing presently that could obstensibly make children even safer. Why not have browsers ship a whitelist of trusted websites, and forbid all others? That would be even safer, and if you oppose this then you're not thinking of the children. In fact I find the present state of affairs with bad websites being blacklisted simply intolerable, new malicious websites are permitted by default and that just doesn't work!

there's an enormous difference between people not being able to find a site they don't know about and breaking bookmarks and existing links

yes, it's true that google has a lot of power

On this topic: I've encountered multiple small business websites that have a spam JavaScript redirect that on a referral from google.com -- if you go directly to the website (as the business owner or the GoogleBot might), everything is fine, if you click out from Google you get served either a small page with nothing both the JavaScript redirect, or the page with the JavaScript redirect prepended.

Some variants of this use cookies to only serve the redirect on the first click from Google, so if you're like "weird" and try again, everything looks fine the second time.

You can see the problem if you curl such a URL with Google as the referrer.

In either case, a clear citation of the alleged "phishing" content would help to avoid ambiguity.

>Maybe I would feel better if there had been more transparency in the process. I was left to guess what Google thought was deceptive about my site.

If a website looks suspicious, Chrome sends a subset of likely phishing and social engineering terms found on the page to Google, in order to determine whether the website should be considered malicious. These client-side checks also include comparisons of the visual appearance of the page to a list of images of login pages. If a website appears similar to a page on this list, Chrome will send the URL and the matched entry on the list to Google to determine whether the page is a likely phishing attempt. Chrome can also help protect you from phishing if you type one of your previously saved passwords into an uncommon site. In this case Chrome sends the URL and referrers of the page to Google to see if the page might be trying to steal your password.

https://www.google.com/chrome/privacy/whitepaper.html#malwar...

There's also a handful of other things they will send in the name of safe browsing, should they be enabled (I don't know if any are defaults): https://www.google.com/chrome/privacy/

Mastodon, perhaps unwisely, replicates all media it encounters.