597920 - Use of Phishtank V.S. Google's Database

Status: RESOLVED WONTFIX

(Toolkit :: Safe Browsing, enhancement)

Description

[rtrappman]

User-Agent:       Mozilla/5.0 (Windows NT 6.0; rv:2.0b6) Gecko/20100101 Firefox/4.0b6
Build Identifier: Mozilla/5.0 (Windows NT 6.0; rv:2.0b6) Gecko/20100101 Firefox/4.0b6

I noticed that Firefox uses Google's Web Forgery Database. 
I feel that it is not as updated or as accurate as Phishtank.org's database.

I would like you to consider switching to this free service of OpenDNS.

Reproducible: Always

Steps to Reproduce:
1. Show's Google's Web Forgery reporting form when reporting a suspected phishing site.
Actual Results:  
Google Web Forgery Service

Expected Results:  
Phishtank.org's API lookups

Please see the URL for more information and tips on how to intergrate the API into Firefox.

Comment 1

[David Dahl :ddahl]

(In reply to comment #0)
> Expected Results:  
> Phishtank.org's API lookups
> 
> Please see the URL for more information and tips on how to intergrate the API
> into Firefox.

I have floated this idea in the past and the issue may be phishtank's ability to deal with potentially 400 million new users.

Comment 2

[Johnathan Nightingale [:johnath]]

Yeah, we can't just start consuming that data, it would need to be a coordinated spin up with phishtank.org, and I really have no idea if they could support our traffic load.

Comment 3

[rtrappman]

After your comments, I've decided that it's probably not worth the trouble to push this idea.

Comment 4

[monperrus]

This would give a third good alternative between being tracked with the Google cookie (bad) and being unprotected against phishing (bad).

Compared to 7 years ago, the new thing is that now we have shavar.services.mozilla.com. 

This changes the game:

1) The Phishtank list can be served by shavar.services.mozilla.com

2) The configuration will be very simple:
user_pref("browser.safebrowsing.provider.mozilla.lists", "...,phishtank-phish-shavar");
user_pref("urlclassifier.phishTable", "phishtank-phish-shavar");
 

What about serving the Phishtank list with shavar.services.mozilla.com?

Comment 5

[monperrus]

Interesting reading on this topic
"A privacy analysis of google and yandex safe browsing"
https://hal.inria.fr/hal-01120186/document