[AlexanderTheGr8]

hypothetically, what happens if a domain is catalogued by malicious? Also who catalogues it? If you haven't bought the domain from Google, the only thing that Google can do is not show the domain on google search results. Did I miss anything?

[dharmab]

Most major web browsers will display a scary red warning to visitors to your website. It can take days for a human at Google to fix the issue.

[tnorthcutt]

> If you haven't bought the domain from Google, the only thing that Google can do is not show the domain on google search results. Did I miss anything?

I would imagine they might also show warnings in Chrome.

[iotku]

Pretty much all major browsers check against Google's safe browsing list so it's pretty much a death sentence to be on it.

[tialaramex]

Indeed. Google basically gives this service away to browsers. It costs money if you want to build a commercial service using it, but if you give away browsers, no problem.

You can switch it off, but you probably shouldn't, even if you're sure you would spot a phishing scam, actually maybe even especially if you're sure you would spot the scam.

The service is capable of being quite nuanced since it works on (hashes of) HTTP path segments, so e.g. it can say OK this site https://some.example/ seems fine except the /cgi-bin/crapscript.php/fake-bank/ pages are clearly a fake bank, and so if your browser tries to visit those pages it gets flagged. But equally it can say OK, everything in bogus.example is bogus, fakebank.bogus.example, harrods.bogus.example, www.news.bogus.examples, it's all bogus, warn for all of it.

You can't get the actual list, because if you could of course that mostly helps bad guys. Your browser does a bunch of hash lookups, and it has a fancy tree structure, so it can rule out e.g. OK everything starting FE43 is fine, everything in FD9 is fine etc. If that tree can't rule out a hash it calls Google, who have much finer grained hash data that wouldn't fit in your browser. Also periodically the browser fetches delta updates to the tree from Google.

[charcircuit]

Google's safe browsing list has never caught a fishing site for me. Since it's public, phishers obviously check their site against it before sending it to you.

[account42]

> You can switch it off, but you probably shouldn't

You really should disable it because Google cannot be allowed to be the gatekeeper of the internet. The list contains tons of non-malicious URLs [0] and Google has absolutely no incentive to remove them. And even if you haunt them enough to do so the same broken process that added it in the first place will just add it again. Any browser that enables this list by default is actively making the web a worse place an engaging in mass-defamation.

[0] Example: dgVoodoo2 downloads from http://dege.freeweb.hu/dgVoodoo2/

> It does NOT contain any malware. Use a browser that is free of Google Shit Browsing security service crap (which is based on tons of noname antivirus "engines", look at VirusTotal if interested).