http://garrettgee.com/2007/01/14/googles-safe-browsing-built-into-firefox-2/ Confessions of an Information Addict Wed, 07 Jan 2009 06:47:02 +0000 http://wordpress.org/?v=2.3.3 http://garrettgee.com/2007/01/14/googles-safe-browsing-built-into-firefox-2/#comment-7 Google’s Anti-Phishing Blacklist Leaked Passwords at Garrett Gee Mon, 29 Jan 2007 01:13:54 +0000 http://garrettgee.com/2007/01/14/googles-safe-browsing-built-into-firefox-2/#comment-7 [...] But what is this blacklist and how did the data get there? The blacklist is a list of url’s that Google classified as a phishing site, which would help end users avoid fraud. So how does google determine this, and how is that data getting transfered? Nitesh Dhanjani has a pretty good writeup about this over at Oreilly. We know that information is getting transfered to google via the safe-browsing extension, but which version is vulnerable to this? The downloadable Google Toolbar has one version, the Firefox extension has another version, and Firefox 2 has a built in version. And as to how the data got there, that was due to poor design from the website(s). The username and password were in the url, and since the extension sends whole urls, that data ended up on Google’s blacklist. I didn’t even think people coded sites in this way anymore! [...] […] But what is this blacklist and how did the data get there? The blacklist is a list of url’s that Google classified as a phishing site, which would help end users avoid fraud. So how does google determine this, and how is that data getting transfered? Nitesh Dhanjani has a pretty good writeup about this over at Oreilly. We know that information is getting transfered to google via the safe-browsing extension, but which version is vulnerable to this? The downloadable Google Toolbar has one version, the Firefox extension has another version, and Firefox 2 has a built in version. And as to how the data got there, that was due to poor design from the website(s). The username and password were in the url, and since the extension sends whole urls, that data ended up on Google’s blacklist. I didn’t even think people coded sites in this way anymore! […]

]]>