1337549 - Eliminate Reliance on Google's Safe Browsing Protocol

Status: RESOLVED WONTFIX

(Toolkit :: Safe Browsing, defect, P5)

Description

[David E. Ross]

Windows 7 Ultimate
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 SeaMonkey/2.46

A Google search for "Lowes" returns results with a paid as the first entry.  Selecting the link in that entry leads to a phishing attempt.  

In my first try, AVG Antivirus Free blocked the Web page as malware.  

When I disabled AVG's LinkScanner Surf-Shield, Mozilla's Safe Browsing capability -- as implemented in SeaMonkey -- failed to block the site on my second try to view the page.  I got a logon popup dialogue for a user ID and password.  The dialogue could not be dismiss the dialogue; whenever I selected the Cancel button, the dialogue would immediately reappear.  I could not terminate SeaMonkey except via Windows' Task Manager.  

This strongly brings into question the validity of Google's protocol and database, which is used by Mozilla's Safe Browsing.  It appears that paying Google for an ad for a malware site gets a pass, but a innocent Web site can get a false block (see bug #1328191).  The fact that a Google search actually results in displaying a link to a phishing Web site should be further evidence that Google is not a reliable source.

Comment 1

[François Marier [:francois]]

These should be reported to Google using this form: https://safebrowsing.google.com/safebrowsing/report_phish/?tpl=mozilla

> The fact that a Google search actually results in displaying a link to a phishing Web site should be further evidence that Google is not a reliable source.

We are aware that no anti-phishing protection is perfect and are working with Google on new mechanisms to protect users against these threats.

Comment 2

[David E. Ross]

Google has proven to be unreliable in blocking malware and phishing.  I assert that Mozilla should rethink its progression towards making Firefox more like Chrome.  Note that AVG Free 2016 detected that the so-called Lowe's ad was a phishing attempt and blocked SeaMonkey from accessing the Web page.  Thus, Google has a serious problem that has been solved elsewhere.  

I did report the phishing ad to Google via Google's feedback capability.  I did that before submitting this bug report.  Later, the ad was removed from Google's search results on the term "lowes".  This does not mitigate the overall problem in Google's malware detection, a problem being propagated by Mozilla into its products and into derivative products.

Comment 3

[Mike Hoye [:mhoye]]

While Google's phishing prevention is, like all security measures, imperfect, it is nevertheless excellent and have no plans to reconsider this position on any roadmap that I am aware of. Francois' decision stands. Again, while you may disagree with them our engineers decisions are not negotiable, and reopening bugs is not an effective way of voicing that disagreement. If you have questions or concerns about that, feel free to email me directly.