Recommend not using Fraudulent Website Warning (conditionally)

[ghost]

Description

Before visiting a website, Safari may send information calculated from the website address to Google Safe Browsing and Apple to check if the website is fraudulent. For users with China mainland set as their region in Settings > General > Language and Region, Safari may also use Tencent Safe Browsing to perform this check. The actual website address is never shared with the safe browsing provider. Google (and, for users with China mainland or Hong Kong set as their region, Tencent) may also log your IP address when information is sent to them. You can disable Fraudulent Website Warnings in Safari anytime by going to Settings > Safari, then tapping to turn off Fraudulent Website Warning.

This could be possibly left on if the search engine was not using Google, and the region is not set to China mainland or Hong Kong.

Source: https://www.apple.com/legal/privacy/data/en/safari/

URL of affected page: https://www.privacyguides.org/mobile-browsers/#safari

[ghost]

I'm happy to put a PR together for this one @mfwmyfacewhen, I just need to know the angle PG wants to go in on this one.

[ghost]

Yeah might be worth mentioning. But yeah there should be a warning letting people know it hurts security to disable it.

[ghost]

I think it should be more of a note than a recommendation in this instance, and should come down to threat modelling.

Something along the lines of it's recommended to have it enabled (which it is by default), however those who live in Hong Kong/Mainland China may want to consider disabling it based on their own threat modelling.

[ghost]

Definitely, feel free to whip up a PR and I'll look it over.

[dngray]

may also log your IP address when information is sent to them

Can we find out what information is sent? If this is simply getting a list of suspect websites and the IP is disclosed in the connection to the server to get the list then I don't think this is an issue.

In regard to disclosing the IP address, our only recommendation here is to either use VPN/Tor, and not try to attempt to block disclosure by "avoiding" certain companies.

[ghost]

Looking at this again, I don't really think this is a problem since the actual address isn't sent. Gonna close this.

[jonaharagon]

For future reference, what is sent to the provider is a hash prefix based on the beginning of the address, it works similarly to how HIBP's Pwned Passwords service works.

[quackerex]

I think apple also proxy the traffic. source: https://twitter.com/othermaciej/status/1359736220809531393