Slashdot Mirror
Opera to Start Phoning Home?
An anonymous reader writes "Near the end of a story about Opera's determination to stay in the game: 'Earlier this week, Opera announced an addition that will keep it in step with its rivals. Johan Borg, a developer working on the browser, said Tuesday in a blog that the next edition, Opera 9.1, will include beefed up anti-phishing and anti-fraud features. Rather than simply indicate that a site is secure with a notation in the address bar, Opera 9.1 will also query Opera-owned servers for information on any site visited. Those that Opera has identifies as fraudulent will be automatically blocked by the browser.'"
Those that Opera has identifies as fraudulent will be automatically blocked by the browser.'"
Seems to recall this can lead Opera to trouble, like what happened with Spamhaus.
A feeling of having made the same mistake before: Deja Foobar
I relay like this idea, so long as it can be turned off. Based on my experiance with Opera so far I'd say that not only will it be able to be turned off, but that you can disable it on a server by server baises.
There's a reason I was willing to pay for Opera when it was still a commercial product. Now if only they would make a Symbian native version, the Java version has a hard time in landscape mode on my Nokia N93.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Doesn't this mean that Opera.com will have a log of everywebsite visited by every Opera browser?
Presumably, one subpeonable, or whatever that word is.
Well the fact that opera will check EVERY site someone goes to against their own server might work in theory...but does anyone really want all their web use data to be tracked by a server?
In a world of acronyms, the words are the real victims.
the Opera users among us will have some interesting things to say about this. Both of them!
I left my wallet in El Sigundo!
As long as I can turn it off, or turn it off for certain types of sites, that's fine. I'm not sure what this does for me that, say, Netcraft Toolbar doesn't. Is the data stream encrypted back to Opera? Can others intercept that and use it as a spam-target tool somehow? All questions I'd want answered before I'd use it.
Wow, talk about a difference in spin between the headline and the description.
I'd like it even better if they shipped with it turned off, and you could turn it on if you wanted it.
Where were you when the voynix came?
As a devout Opera user, I'm fine with this as long as it's possible to turn the feature off.
sudo killall humans
Well, with a name like Borg, I can't think of a reason why I wouldn't trust what he has to say...
Tell me what they send to their server is actually a hash of the URL with a huge salt.
\u262D = \u5350
This seems like one of those features that looked great on paper but will result in lots of bitching and moaning. I use opera but seriously if every site I visit starts getting sent to them I will have to switch back to firefox.
Dooom
I know IE7 phones home, and fireefox 2 does too for anti-phishing. They both can also be disabled by the user.
I don't see how this is any different than what MS or mozilla is doing. As long as it can be disabled by the user it should be ok.
In Soviet Russia, Trojan exploits YOU!
Johan Borg??? Oh, the irony. The diversity of your websites will be added to our own. Resistance is futile.
:-P
What an unfortunate surname to be working in the tech field.
Lost at C:>. Found at C.
Heh. Not bad.
It will be just matter of time for government demanding take a look to these logs files in the name of Freedom.
I would think it would obviously benefit all authors of browser software to collaborate on a single set of servers for querying for phising sites. Of course, there's probably caveats I haven't thought of, but hey, I just figured it'd be in everybody's best interest, competitor or not.
Sounds like the fat lady has sung to me.
Why would I want to through my privacy away like that?
First, we must trust they will not leak the data of "who surfs what".
Second, we must trust they will not get hacked and this information stolen.
Third, we must trust them to be the judge of "good and bad".
Fourth, we must trust they won't get hacked and their list either modified by adding or removing site.
Don't fall into the trap of "Oh it's Opera, of course we trust them". Let me put it this way. If Microsoft announced this, what would your reaction be?
Firefox 2 currently has a similar feature but its just a list of sites.h ing/
http://www.mozilla.org/projects/bonecho/anti-phis
Much like what spywareblaster and spybot uses to "immunize" your system.
I can't see why Opera doesn't go that route.
Having Opera check Opera's site for every website will kill their server, no doubt. And seeing as Opera is now free, without any banner advertising (free since version 8.5), I can't see them recouping that cost very well.
If it does check every site I visit (without any way to turn it off), I -will- stop using Opera.
I'm not sure if this will get modded down (lord knows it won't go up), but I'd like to extend my very sincere "Thanks!!!" to all the people working for Opera.
:)
I've been using Opera now for a LOT of years... I'm not sure... 6? 7? 8?
Whatever...
Best. Browser. Ever.
Between their support, the great piece of code they provide, the Widgets, F4 and its tools, the mouse gestures (GENIOUS!), etc... Opera is, IMHO, the best browser available.
Yes, yes... FireFox is all the rage... Yes, yes... I know that FireFox saves people from drowning in the coasts of California and that little Fox on fire thinks about the Children... I know.
But people... Opera. Kick-ass.
Regarding the servers "phone home"... fine by me.
Opera is a company/group-of-people that I've come to trust. Not once have they let me down.
Thanks!!!
Best to you,
-Opera User
((Posted Anon... Although I know my name... and I ain't no coward... I don't want to Karma-whore))
Your ISP can track everything you do. That must mean that they are abusing their position. Why get Opera to track your surfing when your ISP could do so much more efficiently?
Clever signature text goes here.
That's if they log the requests - given that they're a Norwegian company, they have some pretty tough privacy laws to content with.
I expect that it will depend on the terms and conditions in the end, and that they will say 'we will not log or use your data in a user-specific manner (not even AOL style 'user == number' obfuscation, hehe), however we may use it to compile statistics on accesses to phishing sites', which could prove quite useful in anti-phisher court trials.
It's no different to IE7 or the next version of Safari. The best way to check a website is authentic is to check the URL against a blacklist and then tell the user in big red text in a way they'd be retarded to ignore about the threat. I do think it would be better to download the blacklist to the client and resync it often however.
How do the Firefox add-ins, IE7 and Safari 3 handle anti-phishing?
Does anyone bother reading before commenting anymore? The feature will be able to be switched off at will, even on a site-by-site basis, and they will toss out source IPs at Opera if you choose to use it. The main reason they do it this way instead of downloading lists like mozilla and IE is that lists can be obsolete and phishers can be onto promoting their next scam by the time the lists are updated on clients. Besides, Opera is in Norway and outside Department of Justice jurisdiction for spying requests. If you don't like it or are sophisticated enough that you don't need it, turn it off.
-Those who would give up essential liberty to purchase temporary safety deserve neither. -Ben Franklin
Sounds neat, so long as it defaults to off. I doubt the Opera user demographic is particularly succeptible to phishing, though it would be useful if you're installing it for grandma.
ON DELETE CASCADE
http://www.tuaw.com/2006/10/19/screenshots-from-th e-latest-leopard-build/
It looks like the next release of Apple's Safari browser will "phone home" to Google for its anti-phishing measures.
Just at the time IE7 is out and is stil fighting with vulnerabilities, Opera is thinking of revamping itself
Follow the adventures of the new wandering jews
Why the hell would a Norwegian company hand anything over to the US DOJ? America can't really tell the rest of the world what to do you know, Bush just wants you to think that!
Sounds Swedish...
I don't what else it does, I just want Opera for the DS. It's been out in Japan for awhile but I heard any more news about it in months.
01/20/09
well I'll be damned if I use this software on a computer with a network connection then!
The request Opera sends is a hash of the URL instead of the URL itself.
Would the second Opera user like to comment?
Send email from the afterlife! Write your e-will at Dead Man's Switch.
The data is not encrypted. They wanted you to be able to see what your PC is sending. Plus I doubt they'll be useful to anyone else.
Send email from the afterlife! Write your e-will at Dead Man's Switch.
From Opera's RSS feed:
When you browse to a site you have not visited before, the browser sends a request for site information to our server. The requests contains the domain name of the site and a hash value of the URL. We don't send the full URL, but we need a fingerprint of the full URL in case you visit a dangerous page on a site that is otherwise harmless.
So yeah.
Send email from the afterlife! Write your e-will at Dead Man's Switch.
As a web developer and maintainer of a few online shops, I feel somewhat threatened by these "phishing lists" that are cropping up.
... No. I didn't RTFA.
What if, some how, my site[s] were to make it onto the a/all major phishing list[s]? I know it may be unlikely, but it could happen... do the users report these lists? If so, this will be abused a lot!
Is there a way to opt out? If so, is it plainful or painless?
If there is a store in my neighborhood that is known to pickpocket customers, the police come and arrest the pickpocketers. They don't hand-out a blacklist of those stores.
It is unfortunate that the same thing can't happen to the web. I would rather the sites be taken down than blacklisted. Too bad Blue Security is gone...
But what about favicons then? As long as I can remember my bookmarks have picked up the wrong favicon in the repository. It's not a critical problem but really annoying and it shouldn't be too hard to correct, right?
Zere vere zwei peanuts valking down der Straße, and von vas assaulted...peanut
I'm using the weekly build. So far, nobody has knocked on my door.
Works great- slashdot is trusted by geotrust evidently.
There's a checkbox to "enable fraud protection." When this button is disabled you can still manually check the site via the same interface, but the check isn't automatic.
[mac] http://snapshot.opera.com/mac/o910w_3539.dmg [unix] http://snapshot.opera.com/unix/Weekly-466/ [win] http://snapshot.opera.com/windows/o910w_8629m.exe
I don't want a signature.
How much will it cost Opera in terms of bandwidth? Some network equipment manufacturers offer a similar service for their firewalls but you always have to pay monthly fees once the few months of trial are over. Having users of your software constantly transferring data with you can't be cheap.
Why does Opera have to own the servers? Why can't it include several defaults, like its own servers, for "trust ratings", factoring in webserver certificate status (exists, expired, corrupt, etc)? And let users choose which "trust servers" they want to use to validate trust. Even better would be another layer which reviews trust servers for trustworthiness, to which users can subscribe to decide how much to trust which webservers.
If Opera also integrated structured personal info into trust levels, completing the circle for users, it would become much more popular among people who want convenient trust. We all finally need to be able to look at a page requesting personal info, and know who says which info is safe to deliver, by just agreeing to send "disposable email address", or "existing email address", or "name, email and phone#", or "postal address info", or "creditcard validation info", as requested, packaged, and vouched by trusted parties.
If Opera owns the infrastructure, eventually conflicts of interest and scales of operation will take it down, leaving people relying on it with none. Instead, a Firefox plugin, that manages all that personal info and trust by pointing to remote servers with intelligible user interface terms, will win the day.
--
make install -not war
Why doesn't Opera just push out a current list of badly behaving links, rather than having users ping their site each time? Seems like browser-local cache is better in every regard except for the staleness problem. Unless you have ulterior motives...
I swear to God...I swear to God! That is NOT how you treat your human!
opera sux
firefox rulez
LiNuX is teh shiznit
Micro$oft is teh evil
Hopefully they will give users away to override blocks in the event of false positives, otherwise it could become more a means of censorship that protection, like SmartFilter, a company that has blocks sites for political reasons. The point is final say should be the user's.
Opera already makes a call to its servers - to check for updated software. But this, much like almost everything else in Opera, can be disabled
Borg means castle in Norwegian, so hes all about security and keeping threats outside the walls ;)
He is Norwegian/A.
Borg is a really good surname if you consider it means "castle" in his native Norway. He is obviously all about secure walls and keeping enemies out ;)
As several others have pointed out, Opera will be taking some pains to avoid doing anything that would even make it possible for them to track users. Not to go all Opera-fan-boy on you, but Opera has been relatively privacy-concious for longer than the other browser organizations. If you can formulate a serious privacy threat scenario, I bet they'd like to hear about it.
Checking only visited sites does two things: it provides the opportunity, at least, to respond very quickly to new phishing schemes, and it saves bandwidth, which is pretty much always a good thing. It's easy for many of us to become complacent about having broadband, but many people still use dialup. In fact, Opera Desktop includes some features that can make it an especially attractive choice for dial-up users; I wouldn't be surprised if Opera's market share is actually higher among the dial-up crowd.
This stuff is not trivial.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Why don't you stop talking out of your fucking ass, and just read my post which makes clear how my system makes it totally easy for the user?
I said the trust servers, and vouchers for those servers, would ship with defaults. All a casual user would do would see whether a given page is trusted, as a function of those two layers they'd never see. More sophisticated users could set their "vouch servers", probably by their organizations tech support. Even more sophisticated users could pick their own trust servers. Or make their own trust servers, or their own vouch servers. An open system with defaults that "just work" for everyone, unless they're inclined to tinker. With a simple mechanism for delegating the decisions of who to trust.
My privacy scope keyed to trust, automating form completion, makes it even easier for the casual user to decide what to do (or not), once trust levels are established. It becomes a matter of seeing a page asking for info, and just saying "OK/"Cancel" when the browser just says "This page is asking for your creditcard info, but YOUR_FINANCE_MAGAZINE says you shouldn't trust it. Do you want to do it anyway, or get more info before you give it to them?" Also with open configs, so for casual users it "just works", but more support/sophistication can use others' input into the trust web.
Distributed trust is complex. My system, drawing on decades of people working out how people trust and what's easy to understand, makes it easy for the 99.9999% who want to trust, and blame the people who vouched when it goes wrong. While accommodating the few, including me, who understand how to tailor trust even better.
You are clearly part of the "six nines" who need it totally dumbed down, or you get scared into confusion. Just step away from the keyboard while pros do the hard work, and you'll get your simple, trustworthy interface. Getting in the way of the machinery can be dangerous for mere normals like you.
--
make install -not war
I did a little writeup on this kind of thing a while back. Since all of the major browsers support a "proxy autoconfiguration" file, you simply a flat file on some server that returns a non-existent proxy address for URLs that you want to "block". So you don't need to use Opera's, just have someone run such a service and point your autoconfig there. A general "URL/IP Blacklist" could easily be built into browsers (as I'm sure there's a Firefox extension around for it).
On the other hand, I think it's nice that banks that I've never even heard of are nice enough to find me and let me know that my account needs to be reset. Now I'll have a place to put the $50M that I'm getting for helping the Prince of Nigeria!
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Every time some single internet entity tries something to stop spam, banners, or viruses, the dark forces they are trying to stop collaborate against them and next thing you know your server is a smouldering pile od slag attached to what's left of the stain on the table that was your router.
What makes them think they are flood-proof, against people that have thousands of zombies at their command?
I work for the Department of Redundancy Department.
It's not phoning home. There's been a lot of idiocy about that statement lately and the phrase is starting to suffer the fate of the apostrophe: people are just using it whenever they think it might apply.
Phoning home means sending personal, identifying information back to the author of a program, usually with nefarious intent. This is a feature that uses an Opera server in a non-identifying way to determine if the site you're going to is fraudulent. Huge difference.
And you can probably turn it off. Yet another thing that you cannot do with software that is "phoning home" in the traditional definition.
Come on, folks. There's privacy and there's paranoia. I know a lot of you haven't left home in a few weeks, but try to stay in touch with reality, okay? The foil hats do nothing...
A better idea would be to offer a plugin (which might be included by default but turned off by the user at installation time) that periodically syncronizes with a remote database of "bad" sites. This is basically what AdBlock + FilterSet.g plugin does for firefox, only it deals with ad blocking instead of phishing sites....
"I will beat you 6-0 6-0 6-0."
FRA: STFU GTFO
Blacklists are bad and unethical, regardless what particular purpose they serve. They're analogous to eugenics and Adolf Hitler: do you REALLY want someone(s) else quietly determining for you what is ham or spam, fishing or phishing, without you having any final veto at all?
Just say NO to blacklists, of any form.
Actually, no. If you open a SSL connection (you know, the https thing), the URLs you request from the server are encrypted (so your ISP donesn't know what files or documents you download from the server).
And if you connect to a proxy via SSL, you can browse any sites without your ISP knowing. The ISP will only know you connected to a proxy in China (or wherever) and that's it. No URLs, no domains, just strongly encrypted packets.
I've enjoyed the cutting edge technology that somehow seems to work despite its being cutting edge for years. I've taken it along with me when I went from Windows to Linux. I've encouraged people to try it out both as a user and a technology writer for the last several years.
If I can't turn these features off, I'll stay in v9.0 until something better than Opera comes along or it can't be used with whichever Linux distro I'm going to be using.
I make the decisions about what my web browser downloads and who it phones home to.
If I wanted a browser to play "Big Brother", I would have stayed in Windows, be using IE, and be planning a hardware upgrade to Vista.
Tech Public Policy stuff
I love how people suggest this without thinking that when your ISP 'monitors everything you do' and finds that you don't do anything except via a secure proxy, that they might just be even more suspicious.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Why via proxy and via SSL? Because why would a nerdy admin working for your ISP should be allowed to read everything I read, download and upload, and why should he know the URLs where I do?
You missed the point. It was to prove that ISP doesn't have to know everything you do.
Now the admins of the proxy server would know your surfing habits instead. Besides, setting up a secure proxy is a hell of a lot more work than simply disabling the anti-phishing feature in Opera.
Clever signature text goes here.
Yes, and do you expect a proxy admin in North Korea to disclose your searching habits to someone from the US?
> Besides, setting up a secure proxy is a hell of a lot more work than simply disabling the anti-phishing feature in Opera.
In case you missed it, I didn't talk in regard to Opera. I responded to the statement that your ISP knows everything anyway. The point was that if you want, your ISP doesn't have to know everything.
"Phoning home means sending personal, identifying information...."
You are confusing the instance of phoning home (which is clearly happening here) with what is said during the instance of phoning home. Which is quite debatable.
"And you can probably turn it off."
Problem solved if it asked you once, during the installation, if you wanted it turned on in the first place (default answer = No). Then you aren't tricked into turning it on.
"Come on, folks. There's privacy and there's paranoia.
And then there is proper browser behavior. Browsers have no business connecting to pages you don't tell them to or to material not specifically linked into the pages you go to, unless you actually tell the browser to do so.
Where were you when the voynix came?
The point is, someone will know.
Clever signature text goes here.
What a red-herring comment. The actual point is that your US/EU ISP doesn't have to know everything.
No, the actual point is that if you are that paranoid, you should know that someone will be able to track you.
Clever signature text goes here.
First, I'm not paranoid and I don't use proxies at all. Second, I was helping that poster to understand that there ARE WAYS TO PREVENT HIS ISP FROM KNOWING EVERYTHING HE DOES. GOT IT?
Where did your other "points" and "counter-points" came from is truly beyond me.