Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×

Google Warns Users About "Unsafe Sites" 163

Posted by timothy from the good-citizenry dept.
Dynamoo writes "The BBC is reporting that Google will start to warn users about unsafe websites, in particular those that host spyware or have privacy implications. The technology to do this has been developed in partnership with StopBadware, and appears to be an alternative to the popular McAfee SiteAdvisor application. Perhaps this will help curtail slimeware ridden sites from peddling their wares. But it will be interesting to see how Google rates some of its own products, including the potentially risky Google Desktop."
This discussion has been archived. No new comments can be posted.

Google Warns Users About "Unsafe Sites" More

Google Warns Users About "Unsafe Sites"

Comments Filter:

  • Here's the Link (Score:5, Funny)

    by ThisIsForReal ( 897233 ) on Monday August 07, 2006 @01:30PM (#15859943) Homepage
    If you don't want to RTFA, you can follow the link to Google's policy here:

    www.goatse.ru

  • This will invite more unjust lawsuits (Score:5, Insightful)

    by etymxris ( 121288 ) on Monday August 07, 2006 @01:32PM (#15859955)
    If you thought Google had a lot of lawsuits when altering pageranks of linkfarms, wait until limewire et al start suing Google for "defamation".
    • It would be a brief lawsuit.

      The most important defense to an action for defamation is "truth", which is an absolute defense to an action for defamation. - Defamation: Libel and Slander Law [expertlaw.com] at ExpertLaw

      To win this lawsuit, the malware providers are going to have to prove that they don't do exactly what Google says they do, which is going to be challenging.

      Some borderline cases might slip through; I seem to recall Gatorsoft (maybe as Claria?) getting an exemption from some anti-spyware software/lists by claim

    • That's a good point, there are probably some things that Google can do to limit their liability though. Capturing a snapshot of the malware in question is probably a good start. The only problem then is bickering over the definition of what types of content actually are malware and the issue content from 3rd(4th?) party advertisers could also make things sticky.
      • I think a big part of the problem lies in the precise definition of malware. What attributes, exactly, define malware? Some people suggest that malware is anything and everything that can't be 100% uninstalled. But many of Microsoft's OS packages fit that description (as does the "Windows Genuine Advantage" program.)

        Is it software that reports individually identifiable tracking information? Any web page using Google Analytics, IMR Worldwide, Tacoda, or Overture is already doing that (as is the "Window

        • I imagine that Google will take a fairly conservative line. If it is questionable whether it really is malware, then they won't mark it as such. "I know it when I see it" is actually a much under-rated classification system (unless you make your living from arguing definitions).

        • What attributes, exactly, define malware? Some people suggest that malware is anything and everything that can't be 100% uninstalled. But many of Microsoft's OS packages fit that description (as does the "Windows Genuine Advantage" program.)

          This is not a coincidence.

    • Limewire not only eliminated all spyware from their product a long time ago, they have opensourced Limewire, so chances are they wouldn't include spyware in a product where suspecting users could go and look at the source code. There is also Frostwire, which is a fork of Limewire, and has no spyware.

  • Why not just stick them at the end of the search (Score:4, Insightful)

    by Snarfangel ( 203258 ) on Monday August 07, 2006 @01:32PM (#15859957) Homepage
    A "screensaver" site isn't going to get much traffic on page 1000.

    • Re:Why not just stick them at the end of the searc (Score:4, Insightful)

      by bkgood ( 986474 ) on Monday August 07, 2006 @01:53PM (#15860114)
      Because google [claims it] doesn't alter search results. Flagging them doesn't technically alter them (it just displays a bit more information), but moving them to the bottom of the pile, so to speak, is.

      But what if your site was somehow rated as "spyware-filled", when, in fact, it wasn't? Would you rather be flagged as dangerous, or would you rather be sent to the bottom? At least the flag can be ignored.
      • But what if your site was somehow rated as "spyware-filled", when, in fact, it wasn't? Would you rather be flagged as dangerous, or would you rather be sent to the bottom? At least the flag can be ignored.

        If Google reported my site as "spyware-filled" and it wasn't, I'd want Google to fix it. As long as they have a straightforward and reasonably quick process for dealing with false positives, I'd be glad if they moved spyware-filled sites to the bottom of the list, if not off the list altogether (perhaps by
      • IMHO Google could very well offer a choice in that matter; vis a vis seeing the site as flagged or relegated to the bottom. Just a check box in one's preferences. Google is under no obligation to anyone other than their stockholders to do squat; they are not a public utility nor a monopoly so they can bloody well use any method to rate sites they want and Devil take the hindmost; no one is obligated to use them.
        • they are not a public utility nor a monopoly so they can bloody well use any method to rate sites they want and Devil take the hindmost; no one is obligated to use them.

          But they have a reputation to keep if they're going to keep vistors and ad-impressions. Showing integrity is one way to do that.

  • Google Desktop (Score:5, Insightful)

    by corychristison ( 951993 ) on Monday August 07, 2006 @01:33PM (#15859967)
    But it will be interesting to see how Google rates some of its own products, including the potentially risky Google Desktop.
    I still don't really see how potential problems are real problems unless they have already been exploited and proven.

    In my opinion it's like saying I am a risk because I have arms. Potentially I could strangle someone with them. :-P

    • Re:Google Desktop (Score:5, Funny)

      by VJ42 ( 860241 ) on Monday August 07, 2006 @01:37PM (#15860002)
      In my opinion it's like saying I am a risk because I have arms. Potentially I could strangle someone with them. :-P


      Yeah, as a Brit I always wondered why the US constitution had to explicitly give the right to wear T-shirts; over here we take that as a given. ;-)
      • Especially considering the T-shirt was invented during World War II.


        I agree with GP. If something is a real risk to computer security, it is generally hacked within the first six months of popularity. I think that the mention of GDS in the writeup was a needless shot.

        • I agree with GP. If something is a real risk to computer security, it is generally hacked within the first six months of popularity.

          True, but this isn't actually the worst problem. :-) Things which are real risks to computer security not only get hacked once when they first become popular, they continue to be hacked over the years as new vulnerabilities are found.

    • Re:Google Desktop (Score:5, Funny)

      by Gryle ( 933382 ) on Monday August 07, 2006 @02:13PM (#15860235)
      The Department of Homeland Security has noted your concerns. Steps will be taken to ensure proper and supervised use of arms to prevents arms from being used by potential terrorists.

      Sincerely,
      The Goverment.
    • it's like saying I am a risk because I have arms. Potentially I could strangle someone with them.

      Well if like a computer program your arms were only capable of doing what they were pre-programed to do then all your arms would do is strangle people, wouldn't they?

      Crapware doesn't help you because its not programed to do that.
       
  • their WWW browser and/or OS is unsafe in various ways. We know that IE and Windows is not the safest combination,
    but looking at the recent string of security holes in Firefox/Thunderbird shows that this is not particulary
    safe either.

    Why not fix the software and/or its default configuration so that it is safe to use?

    • Re:Many web sites are "unsafe" because (Score:5, Insightful)

      by ScentCone ( 795499 ) on Monday August 07, 2006 @01:43PM (#15860039)
      Why not fix the software and/or its default configuration so that it is safe to use?

      That doesn't address sites that deliberately link people to executables that they delibrately download and run because they think they're about to see a 3D holographic movie of unicorns actually producing rainbows in the shape of guardian angel puppies protecting endangered species that are making jokes about the president.

      The point is that if Google finds sites polluted by such malware - not just some plugin-abusing bit of blinking nonsense - then they're going to give you the heads up on the link. I think it's great - but it will just make the bad guys get involved in another hide-the-malware arms race.
    • It's simply a case of attacking a problem from multiple directions. Of course what you suggest is necessary, but Google(or anyone else) can't just reach into someone's computer to fix things up.
    • I'm really getting sick of smartass comments like this.

      Why not require users to pass a course on safe computing before they have a license to use the internet?
      Why not format the hard drive of every user who picks up a virus from a website, to teach them a lesson?
      etc...

      How about: Why not stop spouting rhetoric and attempt to deal with the malware/trojan situation (which will NEVER fully be solved by OS/browser security) in a realistic manner without the high-and-mighty attitude?

  • Google Dekstop isn't unsafe (Score:5, Insightful)

    by man_ls ( 248470 ) on Monday August 07, 2006 @01:35PM (#15859988)
    Google Desktop isn't unsafe in any way. Google fully discloses the fact that they'll be rooting around in your hard drive and mixing data from there, with data from their servers, for the purposes of providing a local Google search to you on your own machine.

    There's nothing wrong with people who are willing to voluntarily give up some measure of their own privacy in exchange for a service provided on that data -- I use Gmail for all of my e-mail, even to the point of forwarding multiple accounts into my gmail inbox, and don't think twice about the fact that somewhere, Google is reading and storing it.

    The problem arises when people aren't informed their privacy is being tampered with...malicious web toolbars and cursor packages, Gator, etc. No anti-spyware application I've seen to date has detected Google Desktop (granted, I've only seen 3 machines that actually used GD) but that says something to me.
    • Nothing wrong with people installing Claria or spyware either, as long as they understand they're giving up their privacy. The difference is just in how much their privacy is worth to them. Some people's privacy is worth the ability to quickly search all their documents, other people's is worth a couple pretty screensavers. In that sense, it's good that Google will at least make people aware of any possible privacy/security issues.

      • Re:Google Dekstop isn't unsafe (Score:5, Insightful)

        by Tweekster ( 949766 ) on Monday August 07, 2006 @02:06PM (#15860195)
        Google Desktop is a product in and of itself. No one WANTS claria. No one seeks out claria to install. People actively go get Google Desktop because they want Google Desktop for the features it provides. Find me one person that said "damn computer, I need that claria product to make it useful"

        It piggy backs on other thigs that are useful..that is a significant difference
        • Find me one person that said "damn computer, I need that claria product to make it useful"

          If so motivated I could find you at least 100 people that I know that would agree with that statement. They are not the smartest people not the kind that know what slashdot is, but they exist. They download whatever looks like it might make using the computer more fun, then they get confused when strange things start happening to their comptuer and they call me to fix it. I do, remove all fothe crap explain to them
          • They downloaded a screensave that had claria in it. They did not choose claria.
            There is a fundamental difference between being sought out and piggy backing upon other "useful" software (someone wanted that screensaver etc)
            • I've dealt with users who knowingly installed Gator so they didn't have to type their passwords, as if their browser didn't have the feature built in... Anyway, I found that out after they gave to me to fix and them complained when I gave it back to them with it removed (and actually feeling responsive again).

              • That is exactly why I charge $100 to anyone wanting me to fix their computer. I clean it the first time for free. Hide some icons, toss firefox on their ,tell them to use it, etc. Show them what they need to do. Most of the time that fixes the problem. The others that come back because "firefox was too hard" or whatever bullshit excuse they had, they have to pay $100, i spend 2 hours on it max, if it is fixed, fine if not it isnt my problem.

                My time is valuable,. i dont mind helping out, but I dont go a
    • Disclaimer: I am not expressing an opinion on Google Desktop. I have never used it, nor have I seen anyone else use it.

      Google Desktop isn't unsafe in any way. Google fully discloses the fact that they'll be rooting around in your hard drive and mixing data from there, with data from their servers, for the purposes of providing a local Google search to you on your own machine.

      I am now fully disclosing that I'm going to shoot you with a handgun. Don't worry, you'll be perfectly safe.

      *BANG*

      No anti-spyware a

    • There's nothing wrong with people who are willing to voluntarily give up some measure of their own privacy in exchange for a service provided on that data

      I'm only going to partially agree with you on that one.

      When deciding to give up their privacy, people are going to weigh the benefit gained against the harm done (in theory). The question is, when your choices are limited and all of them require you to give up your privacy, what are you going to do?

      Privacy (IMO) needs to be actively protected. We've

      • I do agree with you there -- the Federal government and their never ending intrusions into more and more aspects of every private citizen's lives come to mind.

        Given the choice between, say, sharing nothing with the Feds except the bare-minimum legally required data (bank statements and travel records, for instance) and sharing more detailed information (phone records, credit card purchases, etc) I would likely voluntarily share more information than absolutely necessary, just because I'm a helpful guy like
        • That I'll agree with, except the voluntarily 'helping out' by giving more info. My (domestic) travel records are no concern of theirs... though international is a different story, I suppose.
        • The trouble is, there are too many people (members of my family, in fact) who really believe that Americans should reasonably expect to have no privacy in any aspect of their lives at all, post-9/11, if it can keep a handful of people dying. The only alternative to this position, is that individual privacy is worth American lives.

          That is very much a false dicotomy. Giving up privacy may well make no difference to real risks. Indeed given some of the questionable entities the US Government unconditionally
    • Well Dell distributes Google Desktop now, and knowing Dell, we can all assume it is spyware.

  • Poop (Score:3, Insightful)

    by Known Nutter ( 988758 ) on Monday August 07, 2006 @01:36PM (#15859994)
    Google Desktop and crap-ware ridden screensavers have nothing to do with one another. Summary is a google-bashing troll, at best.
    • It still amazes me that screen savers are not run in virtual machines. They are a well known malware vector. They only kick in when you are not actively using the machine, so the overhead is largely irrelevent. There are very few reasons for a screen saver to access any resources that are not internal to the screen saver package. If you had to specifically allow access to shares via the OS for things like picture slide shows, the only damage a screen saver could do would be to eat too many cpu cycles.

  • About Time (Score:5, Insightful)

    by Nom du Keyboard ( 633989 ) on Monday August 07, 2006 @01:36PM (#15859998)
    It's about time. I've been saying this to them, and about them, for a very long time. I can't think of a better value-added service that any search engine can provide in these days of dodgy web-sites. Would be nice if, like their Adult Content filter for images, you could simply set your Google to not even ask you if you wanted to continue, but block out these sites entirely (remember other people use your computer too).

    Or even better still, read the Google cache of the site with all the bad stuff removed. That would be trick!

    I'm sure my letter of commendation, along with Google stock options grant, is arriving any moment now.

    • Re:About Time (Score:3, Insightful)

      by Bryansix ( 761547 )
      I agree that I love the service but I don't think they should block any sites entirely. If people want to ignore the warnings then they should be able to. The reason why is that it only takes one false-positive to make Google look dumb and get a bunch of bad PR for "censorship".
      • He didn't say anything about forcing it. He said make it an option, and it's an excellent idea.
      • If you would kindly re-read his comment, you would see that he said "Would be nice if, like their Adult Content filter for images, you could simply set your Google to not even ask you if you wanted to continue, but block out these sites entirely (remember other people use your computer too)".

        So as you can see, he is saying it should be an option that you have to manually turn on.
    • It's not enough unless they put these warnings in their adwords/adsense links as well. Otherwise, it just means more money for Google as the badware providers rely more heavily on AdSense to pump their crap.

      The real solution would be to completely remove these sites from the search results and sponsored links. They already remove plenty of sites they think are "spamming" the results, but they won't remove their bread and butter crapware from their sponsored links.

  • So long, and thanks for the FUD. (Score:3)

    by Civil_Disobedient ( 261825 ) on Monday August 07, 2006 @01:37PM (#15860001)
    But it will be interesting to see how Google rates some of its own products, including the potentially risky Google Desktop."

    From the article:

    Google confirmed to ZDNet UK that data was temporarily transported outside of businesses when the Search Across Computers feature was used, and that this represented "as much of a security risk as e-mail does."

    And also...

    Gartner has recommended that businesses use Google Desktop for Enterprise, as this allows systems administrators to centrally turn off the Search Across Computers feature, which it said should be "immediately disabled."

    In other words, mostly harmless.

  • Conflict of interest? (Score:4, Insightful)

    by tnk1 ( 899206 ) on Monday August 07, 2006 @01:41PM (#15860027)
    Like Financial Services companies that used to advise their clients to buy their company's own investments, I can easily see how Google getting involved in this could be a quagmire. As the summary example pointed out, what happens when Google's own software is dangerous? Do they have to face down their own rating service to get it out there? Chances are... they won't. They will assume that all Google software is "Good" software.

    Fair enough, since I guess you can assume that Google wouldn't be actually creating malware on purpose. If you just single out those sites with the 1000 porn banners that try and install virii and spyware on your computer, Google won't have a problem. However, I think, the real problem for most users is not sites like that which are obviously dodgy, its the sites that look clean and professional that seem to have a legitimate purpose for their software, and often those proprietors are quick to try and play up their legitimacy. When Google marks them as "bad", you can expect lawsuits.

    While I find that this may be a big plus for a search engine that can be percieved as impartial to software makers, as Google becomes a notable software maker itself, it may be an issue. It certainly could leave them vulnerable to the charge of conflict of interest as time goes on.

  • While they're at it ... (Score:4, Insightful)

    by cybermage ( 112274 ) on Monday August 07, 2006 @01:49PM (#15860084) Homepage Journal
    Why not give users feedback about their browser or the browser compatibility of sites? I think it would be nice if Google would tell IE users with Active X on that a site they're about to visit contains Active X and may be a threat to their system.

    Better yet, consider standards compliance and accessibility when ranking pages.

    If Google wants to use their position to police the Internet, why stop with Spyware. Test whether people have a secure browser and tell them when they don't:

    "FYI, your version of IE is 3 years out of date. Please go here [microsoft.com] to upgrade it, or go here [mozilla.com] to replace it."

    They could fix a lot of the problem right there.

  • An Example (Score:2, Interesting)

    by jimmichie ( 993747 )
    The first result in a search for "Serial Box" Serial Box [google.com] gives an example of the new behaviour. A page headed "Malware Warning" appears and warns you the page you are about to visit may harm your computer.
    • The first result in a search for "Serial Box" Serial Box gives an example of the new behaviour. A page headed "Malware Warning" appears and warns you the page you are about to visit may harm your computer.
      I do not see this mythological warning you speak of. - perhaps I need to upgrade to Google 1.0
    • The first result in a search for "Serial Box" Serial Box gives an example of the new behaviour. A page headed "Malware Warning" appears and warns you the page you are about to visit may harm your computer.

      Yet they *still* rank it in first place. As usual - Google's left hand doesn't know what its right is doing.
      • Safety and popularity can be mutually exclusive. Look at those chicks who date abusive men.
        Also, prostitutes.
        Also, Also, Drugs.
      • There is a reason for this.

        Google's toolbar has click tracking functionality that you may activate. They use this click-through data to help determine the value of a page's popularity. If the warning showed on the actual results page, there would be an artificial change to the rankings based on an action they took.

        Separating the "malware" message from the results still allows an accurate sampling from the initial clicks in the organic results. Also, as another poster pointed out earlier, if there is no soli
  • DANGEROUS KEYWORDS
    Free screensavers
    Bearshare
    Screensavers
    Winmx
    Limewire
    Lime wire
    Free ringtones
    Where is 'advertisment?'

  • "Unsafe Sites" (Score:3, Funny)

    by kopo ( 890010 ) on Monday August 07, 2006 @01:57PM (#15860143)
    ... like AOL [arstechnica.com].

  • Questions that need answers (Score:5, Interesting)

    by Bender0x7D1 ( 536254 ) on Monday August 07, 2006 @02:11PM (#15860225)
    How do you handle sites where the bad pages are hidden behind a robots file? The front page may be crawlable, but the page with the malware isn't.

    How do they handle redirects? If I have a site that redirects a user to bad content, is the original page flagged as bad? Combined with a page that isn't crawled, how would they know to flag it?

    How are they going to handle any obfuscation that takes place? Or handle new malware? This might not be a show-stopper, but I think it is a techinical issue that should be addressed.

    How are they going to handle the lag between crawling and new content? My server gets crawled about once a week. So I would have ~6 days to host bad content before switching it back to look legit for my next Google crawl.

    What system are they going to have to handle complaints or appeals? If my site is flagged incorrectly, Google is taking a risk of liability by flagging it that way. It seems that if they take due diligence to keep the false positives low, there will be an increase in false negatives.

    These are just off the top of my head and I am sure there are a lot more issues that I haven't thought of.
  • The only true way to surf the web is to not log on at all.

    But for those who just can't go cold turkey. Best way to stay safe is use hardware firewall and/or new wired router, software firewall, and VMWare's Browsing Appliance with ubuntu.
  • Grease Monkey scripts that saves you a mouse click: http://johnbokma.com/firefox/greasemonkey/google-u nsafe-sites.html [johnbokma.com]

  • This Will Only Provide a False Sense of Security (Score:4, Insightful)

    by Jherek Carnelian ( 831679 ) on Monday August 07, 2006 @03:20PM (#15860733)
    This is one of those ideas that sounds good in theory, but isn't likely to help much in the long run.

    The reason it won't work very well is that all the malware sites have to do is present a non-malware version of their pages to google's spiders. If they don't see the malware, they can't know it is there for everybody else.

    So, at first we will see Google correctly identify malware sites, and that will be effective for just long enough that people will come to expect that sites without a malware warning are safe. By then, someone will have come up with an automated systems for giving google a "clean" version of the website and serving malware to everyone else. This automation will spread rapidly and then google will no longer be effective - but now some number of people will have started to rely on google's warnings (or rather lack of warning), thus making them more vulnerable than before.

    I think another poster's idea is much better - include malware detection as part of the pagerank score. Don't advertise it, don't spell it out, just do it. Malware sites will sink to the end of the search results (where they belong anyway since they are rarely useful for anything but malware distribution). Eventually the malware distributors will figure it out and start feeding "good" pages to google's spyder - but at least no regular users will ever be lulled into a false sense of security by thinking that the lack of a warning is an indication of safety.
    • Google bans sites which return different results for normal user-agents and for the Google search-bot.
      • Google bans sites which return different results for normal user-agents and for the Google search-bot.

        Labelling it "malware" will have the same effect as banning anyway, so they will have nothing to lose. Google can only ban a site if they catch it.

        Plus, there are clearly exceptions - news sites that let google index content that normally requires a username/password. I used to regularly get into such sites simply by setting my user-agent to that of the google spider. That doesn't work so much anymore si

    • Shhhh (Score:2)

      by teasea ( 11940 )
      <sarcasm>Don't give the slimeware merchants ideas. It's treasonous! You're letting the terrorists win!</sarcasm>
  • If I would have been warned about goatse many years ago, my life would be much better. I don't know think it is malware, but it is definitely foulware.

Slashdot Top Deals

On the eighth day, God created FORTRAN.

Close