Slashdot Mirror
Opera to Start Phoning Home?
An anonymous reader writes "Near the end of a story about Opera's determination to stay in the game: 'Earlier this week, Opera announced an addition that will keep it in step with its rivals. Johan Borg, a developer working on the browser, said Tuesday in a blog that the next edition, Opera 9.1, will include beefed up anti-phishing and anti-fraud features. Rather than simply indicate that a site is secure with a notation in the address bar, Opera 9.1 will also query Opera-owned servers for information on any site visited. Those that Opera has identifies as fraudulent will be automatically blocked by the browser.'"
Those that Opera has identifies as fraudulent will be automatically blocked by the browser.'"
Seems to recall this can lead Opera to trouble, like what happened with Spamhaus.
A feeling of having made the same mistake before: Deja Foobar
I relay like this idea, so long as it can be turned off. Based on my experiance with Opera so far I'd say that not only will it be able to be turned off, but that you can disable it on a server by server baises.
There's a reason I was willing to pay for Opera when it was still a commercial product. Now if only they would make a Symbian native version, the Java version has a hard time in landscape mode on my Nokia N93.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Well the fact that opera will check EVERY site someone goes to against their own server might work in theory...but does anyone really want all their web use data to be tracked by a server?
In a world of acronyms, the words are the real victims.
the Opera users among us will have some interesting things to say about this. Both of them!
I left my wallet in El Sigundo!
As long as I can turn it off, or turn it off for certain types of sites, that's fine. I'm not sure what this does for me that, say, Netcraft Toolbar doesn't. Is the data stream encrypted back to Opera? Can others intercept that and use it as a spam-target tool somehow? All questions I'd want answered before I'd use it.
Well, with a name like Borg, I can't think of a reason why I wouldn't trust what he has to say...
Tell me what they send to their server is actually a hash of the URL with a huge salt.
If they did this then one of two things would happen.
1) Collisions where non-Phishing sites would be blocked as Phishing sites.
2) They would be able to figure out what the original site was anyway as they are the ones who created the hashes. Otherwise, they wouldn't be able to look for duplicate entries or not and the hashes wouldn't mean jack.
Everythings going to be in the clear. The only thing is to make sure that the feature is optional.
Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
When you browse to a site you have not visited before, the browser sends a request for site information to our server. The requests contains the domain name of the site and a hash value of the URL. We don't send the full URL, but we need a fingerprint of the full URL in case you visit a dangerous page on a site that is otherwise harmless.
Presumably, it's because of the following:
The requests go over HTTP, but the replies will be signed by the server to make sure they are genuine. We prefer to send information between the browser and ourselves in plain text, so our users can inspect the data we send "home".
I know IE7 phones home, and fireefox 2 does too for anti-phishing. They both can also be disabled by the user.
I don't see how this is any different than what MS or mozilla is doing. As long as it can be disabled by the user it should be ok.
In Soviet Russia, Trojan exploits YOU!
Johan Borg??? Oh, the irony. The diversity of your websites will be added to our own. Resistance is futile.
:-P
What an unfortunate surname to be working in the tech field.
Lost at C:>. Found at C.
First, we must trust they will not leak the data of "who surfs what".
Second, we must trust they will not get hacked and this information stolen.
Third, we must trust them to be the judge of "good and bad".
Fourth, we must trust they won't get hacked and their list either modified by adding or removing site.
Don't fall into the trap of "Oh it's Opera, of course we trust them". Let me put it this way. If Microsoft announced this, what would your reaction be?
Your ISP can track everything you do. That must mean that they are abusing their position. Why get Opera to track your surfing when your ISP could do so much more efficiently?
Clever signature text goes here.
That's if they log the requests - given that they're a Norwegian company, they have some pretty tough privacy laws to content with.
I expect that it will depend on the terms and conditions in the end, and that they will say 'we will not log or use your data in a user-specific manner (not even AOL style 'user == number' obfuscation, hehe), however we may use it to compile statistics on accesses to phishing sites', which could prove quite useful in anti-phisher court trials.
It's no different to IE7 or the next version of Safari. The best way to check a website is authentic is to check the URL against a blacklist and then tell the user in big red text in a way they'd be retarded to ignore about the threat. I do think it would be better to download the blacklist to the client and resync it often however.
How do the Firefox add-ins, IE7 and Safari 3 handle anti-phishing?
1) very unlikely with a good hash or combined hashes 2) no they wouldn't, they'd try to hash every phishing site with every salt to see if it matches your hash... sure they could see if you watch specific sites, but it certainly mitigates the amount of information they can get about you, they can't know exactly all the sites you look at. If their entry are user submitted, the user submission can be done in clear text, no problem.
\u262D = \u5350
Does anyone bother reading before commenting anymore? The feature will be able to be switched off at will, even on a site-by-site basis, and they will toss out source IPs at Opera if you choose to use it. The main reason they do it this way instead of downloading lists like mozilla and IE is that lists can be obsolete and phishers can be onto promoting their next scam by the time the lists are updated on clients. Besides, Opera is in Norway and outside Department of Justice jurisdiction for spying requests. If you don't like it or are sophisticated enough that you don't need it, turn it off.
-Those who would give up essential liberty to purchase temporary safety deserve neither. -Ben Franklin
Isn't this against everything we say when it comes to Microsoft? We're meant to be protecting Joe Six-Pack. Various features should ship with the default to 'on', so that those in the know are free to turn it off, but it still protects those who it would most likely benefit?
"Why not have users download a list every so often?" ...because "every so often" is "not often enough" when it comes to phishing.
(according to Opera)
Why the hell would a Norwegian company hand anything over to the US DOJ? America can't really tell the rest of the world what to do you know, Bush just wants you to think that!
Your ISP is as much of a "random company" as Opera Software is. Opera Software is located in Norway, which apparently has extremely strict privacy laws. You also need to consider a company's track record. Opera Software also has the mobile browser Opera Mini which always goes through Opera's servers which do the rendering for the Mini client, and no one has cried foul so far.
Clever signature text goes here.
One problem with your argument:
Joe Sixpack will not use Opera; he'll use IE. That's why we harp on MS for being so lax in security. They're targeting the lowest common denominator.
The request Opera sends is a hash of the URL instead of the URL itself.
Would the second Opera user like to comment?
Send email from the afterlife! Write your e-will at Dead Man's Switch.
Which government? Norway isn't (yet) subject to the U.S. government.
I'm using the weekly build. So far, nobody has knocked on my door.
Works great- slashdot is trusted by geotrust evidently.
There's a checkbox to "enable fraud protection." When this button is disabled you can still manually check the site via the same interface, but the check isn't automatic.
It's not phoning home. There's been a lot of idiocy about that statement lately and the phrase is starting to suffer the fate of the apostrophe: people are just using it whenever they think it might apply.
Phoning home means sending personal, identifying information back to the author of a program, usually with nefarious intent. This is a feature that uses an Opera server in a non-identifying way to determine if the site you're going to is fraudulent. Huge difference.
And you can probably turn it off. Yet another thing that you cannot do with software that is "phoning home" in the traditional definition.
Come on, folks. There's privacy and there's paranoia. I know a lot of you haven't left home in a few weeks, but try to stay in touch with reality, okay? The foil hats do nothing...