Prevention of spam, phishing, malware, and unwanted software pages in Physical Web

[cqueern]

Has the topic of how to keep spam, phishing, malware, and unwanted software pages out of the Physical Web been discussed anywhere in depth? If not, is this an appropriate place for such a discussion?

[dermike]

Some attack vectors mentioned in this article from the other day: http://makezine.com/2015/08/04/beware-hackable-google-beacons-made-by-estimote/

[scottjenson]

We could create a central authority and only show URLs that have registered but that is very much against the decentralized spirit of the web.

Instead we use and open source PWS (Physical Web Service) to act as a filter for the client on the phone. It not only fetches the meta-data on the users behalf (so they can't be fingerprinted) but it also acts as a filter to examine and remove hostile sites. In addition, we will be using the Google Safe Search/Spam API to filter bad actors. Eventually, we are also going to do ranking, boosting good sites higher. To be fair, you could say that the PWS is a central authority but keep in mind it is only for our client. This is why we are open sourcing our client and PWS, to encourage other clients to be written.

In addition to the PWS, interacting with the device in front of you (like in our parking meter and happy meal toy videos) is a form of authentication: the device you are in front of will light up/show your name/etc so you can be sure you are interacting with the device in front of you.

As a last line of defense, keep in mind that we are built on top of the browser, which also has a range of tools/checks/and a sandbox to protect the user.

I'm sure there is more that we can do and if you have any additional suggestions, we're happy to discuss them. However, we hope these solutions are a good start.

[cqueern]

Thanks @scottjenson, a very helpful and reassuring response.

...we will be using the Google Safe Search/Spam API to filter bad actors. Eventually, we are also going to do ranking, boosting good sites higher.

Couple quick questions:

1. By "Google Safe Search/Spam API", you're referring to Google Safe Browsing, right?
2. Any estimates on how soon such filtering and, later, the ranking might be in prod?

[scottjenson]

1. I believe you're correct, yes thank you.
2. We're working on it now, hope to have it out shortly

[cqueern]

Hi @scottjenson,

If I understand correctly, the current plan is for PWS to ping Google Safe Browsing to check the safety of links presented by beacons, and cache those results for performance reasons.

Do you know if Google Safe Browsing is fed by VirusTotal? The reason I ask is that if not, an enterprising community member wishing to write their own proxy could screen URLs using the APIs of both Safe Browsing and VirusTotal.

[mmocny]

@cqueern I've not heard of VirusTotal -- but if using it helps users, then we totally invite enterprising community members to leverage it! I think that falls squarely into the bucket of constructive competition.

Our thinking here is that all clients should scan for URL beacons using a common open format (Eddystone). However, once they have these urls, clients can filter them according their own prefered policy.

The Physical Web app as it exists today uses the PWS which is also in this github repo, and which we hope to improve as much as possible. E.g. we plan to take advantage of various spam and abuse filters available via various Google services/apis.

It's possible that not everyone in the community will agree with all our choices, which is why this is an optionally piece of the puzzle which can easily be replaced with whatever you prefer. But we will do what we consider best, and make it easy for you to leverage that effort as well.

[scottjenson]

Closing this issue as it seems to have gone quiet. Please feel free to reopen if necessary.