# Chrome just flagged this site as malware for me **URL:** \ **Category:** About This Message Board\ **Created:** [May 13, 2014, 2:39pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352 "2014-05-13T14:39:19Z")\ **Posts on this page:** 20\ **Page:** 18
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [May 18, 2014, 7:37pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/341 "2014-05-18T19:37:10Z")
> [@Crazyhorse](#): > > Mine begins with access to the internet via proxy, a modified hosts file updated daily to block any connections to or from any sites I don’t explicitly allow, an anonymized version of firefox (TOR Browser), a hardware firewall, a modicum of intelligence with regards to what sites I visit and what information I make available to them, and, finally, despite not really needing them at this point, local software solutions such as anti-virus and a software firewall. Without going into your personal situation, what additional protection do the internet via proxy and TOR network give the user (you use both?!?!?!)? Is the proxy related to internet cafes and laptops? Is the TOR browser related to issues other than malware? Or are you using the TOR browser outside of the TOR network? ---
**Author:** ![Clothahump](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@Clothahump](https://boards.straightdope.com/u/Clothahump)\ **Post date:** [May 18, 2014, 8:21pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/342 "2014-05-18T20:21:57Z")
For Chrome users: Click the Chrome menu Chrome menu on the browser toolbar. Select Settings. Click Show advanced settings and find the “Privacy” section. Uncheck the box next to “Enable phishing and malware protection.” Note: When you turn off these warnings you also turn off other malware and uncommon download warnings. ---
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [May 18, 2014, 8:24pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/343 "2014-05-18T20:24:41Z")
> [@Measure\_for\_Measure](#): > > Without going into your personal situation, what additional protection do the internet via proxy and TOR network give the user (you use both?!?!?!)? Is the proxy related to internet cafes and laptops? Is the TOR browser related to issues other than malware? Or are you using the TOR browser outside of the TOR network? My proxy is literally my ISP. I’m in an area with a fairly underdeveloped technology infrastructure so due to their low budget setup, and not any deliberate effort on my part, all of their customers share one common IP address to the outside world. The TOR Browser and network prevents even my ISP from seeing what sites I visit. Not that I am engaging in crime or anything else that I would really care if they did know, but as a matter of principle I would prefer that they don’t if I have a choice about it without inconveniencing myself too much. Monitoring and recording individual internet usage by means of tracking cookies, search logs, webserver logs and such isn’t as overtly evil as installing malware but I still don’t like it happening to me. It is frightening to consider the dossier of information that Google and others have about each internet user, the ways they use it currently, and the ways it might be used or misused in the future. So I do what I can to leave no paper trail. A silent protest of how common and acceptable it has become for companies and governments to track individual’s internet use. From the Tor website: > [@](#): > > ``` > Using Tor protects you against a common form of Internet surveillance known as "traffic analysis." Traffic analysis can be used to infer who is talking to whom over a public network. Knowing the source and destination of your Internet traffic allows others to track your behavior and interests. This can impact your checkbook if, for example, an e-commerce site uses price discrimination based on your country or institution of origin. It can even threaten your job and physical safety by revealing who and where you are. For example, if you're travelling abroad and you connect to your employer's computers to check or send mail, you can inadvertently reveal your national origin and professional affiliation to anyone observing the network, even if the connection is encrypted. > > How does traffic analysis work? Internet data packets have two parts: a data payload and a header used for routing. The data payload is whatever is being sent, whether that's an email message, a web page, or an audio file. Even if you encrypt the data payload of your communications, traffic analysis still reveals a great deal about what you're doing and, possibly, what you're saying. That's because it focuses on the header, which discloses source, destination, size, timing, and so on. > A basic problem for the privacy minded is that the recipient of your communications can see that you sent it by looking at headers. So can authorized intermediaries like Internet service providers, and sometimes unauthorized intermediaries as well. A very simple form of traffic analysis might involve sitting somewhere between sender and recipient on the network, looking at headers. > > But there are also more powerful kinds of traffic analysis. Some attackers spy on multiple parts of the Internet and use sophisticated statistical techniques to track the communications patterns of many different organizations and individuals. Encryption does not help against these attackers, since it only hides the content of Internet traffic, not the headers. > > ``` From the [Startpage.com](http://Startpage.com) website: > [@](#): > > Your privacy is under attack! > Every time you use a regular search engine, your search data is recorded. Major search engines capture your IP address and use tracking cookies to make a record of your search terms, the time of your visit, and the links you choose - then they store that information in a giant database. > > Those searches reveal a shocking amount of personal information about you, such as your interests, family circumstances, political leanings, medical conditions, and more. This information is modern-day gold for marketers, government officials, black-hat hackers and criminals - all of whom would love to get their hands on your private search data. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [May 18, 2014, 9:46pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/344 "2014-05-18T21:46:35Z")
The content of ads is hosted on the ad provider’s servers, not on ours, right? And when a browser opens the SDMB, it gets some code from here that causes it to query that ad provider to get the code for the ad itself, right? Shouldn’t a browser therefore block the ad provider’s servers, not ours? I guarantee you that the ad providers would clean up their own act if the major browsers started blocking them out (while still showing the content on the sites with advertising like the SDMB). ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [May 18, 2014, 9:52pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/345 "2014-05-18T21:52:22Z")
> [@Chronos](#): > > … Shouldn’t a browser therefore block the ad provider’s servers,… (while still showing the content on the sites with advertising like the SDMB). Blocking the ad provider’s servers would also block the ad content shown on SDMB. That’s where the ads come from. I don’t understand why you think these are different. ---
**Author:** ![rsa](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rsa](https://boards.straightdope.com/u/rsa)\ **Post date:** [May 18, 2014, 9:59pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/346 "2014-05-18T21:59:27Z")
> [@Musicat](#): > > Blocking the ad provider’s servers would also block the ad content shown on SDMB. That’s where the ads come from. I don’t understand why you think these are different. I don’t think all the ads come from a single source. Block the “bad” ad servers but not the good guys. I don’t think it has to be all ads or none. I could be wrong, but didn’t the malware diagnostics mention at least three domains? ETA: from diagnostics page: Malicious software is hosted on 8 domain(s) ---
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [May 18, 2014, 10:10pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/347 "2014-05-18T22:10:52Z")
> [@kayaker](#): > > Google may not know my personal situation, but how dare you say they don’t care. Google loves me, this I know. But I care. Isn’t that what’s really important. ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [May 18, 2014, 10:15pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/348 "2014-05-18T22:15:18Z")
Having turned off the warning yesterday, it is back today. If I am reading it right, it says they did find some malware on the 16th. ---
**Author:** ![levdrakon](https://avatars.discourse-cdn.com/v4/letter/l/49beb7/32.png) [@levdrakon](https://boards.straightdope.com/u/levdrakon)\ **Post date:** [May 18, 2014, 10:19pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/349 "2014-05-18T22:19:04Z")
How is it that Google can hit the site 100,000 times but we have to wait two minutes between searches, and four if it hangs and you click twice? ---
**Author:** ![scabpicker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scabpicker/32/8268_2.png) [@scabpicker](https://boards.straightdope.com/u/scabpicker)\ **Post date:** [May 18, 2014, 10:41pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/350 "2014-05-18T22:41:55Z")
> [@Chronos](#): > > The content of ads is hosted on the ad provider’s servers, not on ours, right? And when a browser opens the SDMB, it gets some code from here that causes it to query that ad provider to get the code for the ad itself, right? Shouldn’t a browser therefore block the ad provider’s servers, not ours? I guarantee you that the ad providers would clean up their own act if the major browsers started blocking them out (while still showing the content on the sites with advertising like the SDMB). Yeah, that’s my problem with Google’s list. I think it should probably block the domains/ips the malware actually originates from. They’re the actual offenders, after all. > [@levdrakon](#): > > How is it that Google can hit the site 100,000 times but we have to wait two minutes between searches, and four if it hangs and you click twice? Sometimes, Google, Baidu and Bing are exactly why a site is slow. I’ll get customers calling in and complaining about their server, and a quick look reveals one of the big search engine’s spiders is beating one of their domains to death while indexing it. ---
**Author:** ![Mithras](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@Mithras](https://boards.straightdope.com/u/Mithras)\ **Post date:** [May 18, 2014, 11:45pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/351 "2014-05-18T23:45:27Z")
> [@scabpicker](#): > > Yeah, that’s my problem with Google’s list. I think it should probably block the domains/ips the malware actually originates from. They’re the actual offenders, after all. The only way Google could know which ad domains served malicious ads would be to receive every ad that’s displayed on a site (or on the entire internet, I guess). As ads can be moved in and out of rotation on a minute by minute basis, that’s not feasible. And really an instance where Google flagged a site that it’s detected malicious software going on 200 times from ads served from more than half a dozen different domains over three months isn’t one where I’d be pointing a finger at Google. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [May 18, 2014, 11:55pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/352 "2014-05-18T23:55:28Z")
> [@](#): > > Quoth **Musicat** : > > Blocking the ad provider’s servers would also block the ad content shown on SDMB. That’s where the ads come from. I don’t understand why you think these are different. I don’t think they’re different, and I’m not sure how I gave that impression. If an ad provider provides malware ads, then that ad provider ought to be blocked, resulting in no ads from that provider being visible. Which would hurt that provider’s bottom line, which would as I said provide them with an incentive to clean up their own act. ---
**Author:** ![Try2B\_Comprehensive](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/try2b_comprehensive/32/65_2.png) [@Try2B\_Comprehensive](https://boards.straightdope.com/u/Try2B_Comprehensive)\ **Post date:** [May 18, 2014, 11:59pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/353 "2014-05-18T23:59:33Z")
I got the same warning others have posted. I’ve stayed away for a few days as a result, but since the last ‘incident’ in the report was 5-16, I decided to risk it. If I don’t foist my opinions on you all, who will? ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [May 19, 2014, 12:21am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/354 "2014-05-19T00:21:58Z")
> [@Chronos](#): > > I don’t think they’re different, and I’m not sure how I gave that impression. Here’s how: > [@Chronos](#): > > The content of ads is hosted on the ad provider’s servers…Shouldn’t a browser therefore block the ad provider’s servers…while still showing the content on the sites with advertising like the SDMB). You can’t block the ad servers and still show the ad content from the ad servers. If that’s not what you intended to say, you need to make it more clear. ---
**Author:** ![IvoryTowerDenizen](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ivorytowerdenizen/32/17937_2.png) [@IvoryTowerDenizen](https://boards.straightdope.com/u/IvoryTowerDenizen)\ **Post date:** [May 19, 2014, 12:24am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/355 "2014-05-19T00:24:29Z")
I think the content Chronos is referring to is the site content, threads etc, not the advertising content. Block the ads but let the site content remain visible, rather than blocking the whole site. ---
**Author:** ![simster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/simster/32/1047_2.png) [@simster](https://boards.straightdope.com/u/simster)\ **Post date:** [May 19, 2014, 12:45am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/356 "2014-05-19T00:45:45Z")
> [@IvoryTowerDenizen](#): > > I think the content Chronos is referring to is the site content, threads etc, not the advertising content. Block the ads but let the site content remain visible, rather than blocking the whole site. Right - it seems the technology google is using knows that its “domain.bad” that is providing the malware that is “on” SDMB pages - seems it should be able to block “domain.bad” instead. Similar to the way adblock does it - you simply filter the results and not allow content from “domain.bad” to load in the browsers - in the old days, we used hostfiles and a list of known bad hosts to prevent. Google’s service doesnt differentiate between the page the content is on (SDMB) and who is providing the actual malware (domain.bad) - and that also makes sense (in a way) since its impossible from a code standpoint to infer intent on the part of the SDMB. It also may be part of the strategy - Google (and other blacklisters) - blacklist the SDMB in order to force SDMB to be more concientious in the add providors - something, of course, that Google also offers\*. ---
**Author:** ![Fenris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fenris/32/498_2.png) [@Fenris](https://boards.straightdope.com/u/Fenris)\ **Post date:** [May 19, 2014, 12:51am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/357 "2014-05-19T00:51:35Z")
> [@Chronos](#): > > I don’t think they’re different, and I’m not sure how I gave that impression. If an ad provider provides malware ads, then that ad provider ought to be blocked, resulting in no ads from that provider being visible. Which would hurt that provider’s bottom line, which would as I said provide them with an incentive to clean up their own act. Why should Google do that? If a site is willingly serving up sketchy, malware-laden ads, why should Google give it any consideration? It’s like going to a restaurant that serves up spoiled food that they get from a bad distributor: a food-critic (or a patron) is only going going to care about the fact that the restaurant is allowing bad food to go out–the distribution problems aren’t remotely the customer’s problem. Go after the distributor, sure, but also go after the people willingly taking money to pass it on. And after the customers have been complaining for literally years that they’re getting sick from the food (and the owners telling the customers “It’s not our fault, everyone else is just the same, and you didn’t get sick from us anyway”), it’s pretty silly to complain that the health department FINALLY comes in and puts up a “Not fit for human consumption” notice. And if you stretch the metaphor a bit further, what about the owners, who beg the health department to take down the notice and when given a second chance, use it to _immediately_ start serving tainted food again just to see what happens, regardless of what it does to the customers? Google is right to block the sites serving up malware. ---
**Author:** ![scabpicker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scabpicker/32/8268_2.png) [@scabpicker](https://boards.straightdope.com/u/scabpicker)\ **Post date:** [May 19, 2014, 12:52am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/358 "2014-05-19T00:52:20Z")
> [@Mithras](#): > > The only way Google could know which ad domains served malicious ads would be to receive every ad that’s displayed on a site (or on the entire internet, I guess). As ads can be moved in and out of rotation on a minute by minute basis, that’s not feasible. And really an instance where Google flagged a site that it’s detected malicious software going on 200 times from ads served from more than half a dozen different domains over three months isn’t one where I’d be pointing a finger at Google. Well, they are listing the offending domains in the details of the warning. So they know the domains in question, and the IP addresses they resolve to. So they’re pretty much already combing the sites in question. Their aim is to index the available internet, so I’m not sure what you’re getting at by saying it’s out of their scope. Google slurps down incredible amounts of data. They’re already saying they’re pulling down a large enough percentage to start blocking the SDMB based on the number of malware ads it has served indirectly, and name the domains which sent them. On the other hand, I’ve done work with SEO folks, and they do indeed spend a lot of money to switch out domains and IP addresses in an attempt to fool the search engines, and the search engines spend a lot of money figuring out how to filter them out. I’d assume that the malware distributors would have the resources to do the same thing, if they are actually running the ad services. If they’re not running the ad service, then blocking the ad service’s IPs/domains until they scanned without an issue would probably be at least as effective as blocking the SDMB. I wouldn’t say I’m pointing the finger at Google, other than to say they’re blocking the wrong site. It’s their free service, they can do what they want with it. I’m just not participating any more. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [May 19, 2014, 1:09am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/359 "2014-05-19T01:09:07Z")
> [@](#): > > Quoth **IvoryTowerDenizen** : > > I think the content Chronos is referring to is the site content, threads etc, not the advertising content. Block the ads but let the site content remain visible, rather than blocking the whole site. Right. The “site with the ads” is the SDMB, and the content on that site is the threads. The threads are clean, the ads are dirty, so let the threads through and block the ads. ---
**Author:** ![Mithras](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@Mithras](https://boards.straightdope.com/u/Mithras)\ **Post date:** [May 19, 2014, 1:29am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/360 "2014-05-19T01:29:30Z")
> [@scabpicker](#): > > Well, they are listing the offending domains in the details of the warning. So they know the domains in question, and the IP addresses they resolve to. So they’re pretty much already combing the sites in question. Their aim is to index the available internet, so I’m not sure what you’re getting at by saying it’s out of their scope. Google slurps down incredible amounts of data. They’re already saying they’re pulling down a large enough percentage to start blocking the SDMB based on the number of malware ads it has served indirectly, and name the domains which sent them. There’s a difference between trying to index every site on the internet and reloading a single site over and over until you’re pretty sure you’ve seen every ad that comes up on that site. If you’re really persistent doing the latter, you can get the IP address for every server that’s hosting malicious ads that are shown on a site at a given time. But maybe between the last time you’ve checked the site and the next, a new malicious ad from a new server shows up. In the time before you’ve discovered the new server serving the malicious ad, thousands of regular users have viewed it. Meanwhile, you’ve known the site has been serving malicious ads from multiple sources the whole time. If you’re maintaining a list of bad sites, I think the responsible thing to do at that point is add the site to it until they get their act together and stop serving garbage. > [@](#): > > On the other hand, I’ve done work with SEO folks, and they do indeed spend a lot of money to switch out domains and IP addresses in an attempt to fool the search engines, and the search engines spend a lot of money figuring out how to filter them out. I’d assume that the malware distributors would have the resources to do the same thing, if they are actually running the ad services. If they’re not running the ad service, then blocking the ad service’s IPs/domains until they scanned without an issue would probably be at least as effective as blocking the SDMB. I assume that there’s so much delegation between the ad service a website would contract with and the people who create the ads that the list of IPs serving malicious ads is constantly changing. I don’t have much experience with that, though. > [@](#): > > I wouldn’t say I’m pointing the finger at Google, other than to say they’re blocking the wrong site. It’s their free service, they can do what they want with it. I’m just not participating any more. I think it’s very reasonable for Google to reach a point where they’ve detected so much malware coming from a site that they flag the whole thing as suspicious. You can’t be sure that you’re able to detect every attempt at an exploit but you can be sure that whoever’s running the site hasn’t shown themselves to be competent when it comes to deciding what’s safe for its users. Now, I don’t believe Google is totally benevolent in doing this. I’d guess that at least one Google employee has said to another, “…and all this will make people more likely to use our ad service.” [Previous page](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352.md?page=17) [Next page](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352.md?page=19)