Safari Anti-Phishing- How does it work "Warn When visiting.." option

Question

Level 3

666 points

Safari Anti-Phishing- How does it work "Warn When visiting.." option

So, when you turn that feature on: Warn When Visiting A Fraudulent Website," exactly how does Safari know that? I know it was introduced way back in version 3.2, but does it use Goggles safe browsing website info still? I can't seem to find any documentation on it for Safari 5 in how it works.

Also, if it does use Googles Safe-Browsing database, what happens when you turn that feature off and THEN turn it back on? Does it start from sratch or continue building the database where it left off?

Message was edited by: powerbook1701

MBP 15-inch 2.66 GHz Intel Core i7 / 4GB SDRAM / AG Screen (Mid 2010), Mac OS X (10.6.6), iPhone 3GS (32GB), AEBS DB II (Late 2009), Apple Wired Keyboard/Mouse, ClamXav 2

Posted on Mar 18, 2011 8:23 PM

Reply

Answer 1

Best reply

Klaus1

Level 9

52,749 points

Mar 19, 2011 2:11 AM in response to powerbook1701

The blacklists from Google’s Safe Browsing Initiative (where Safari checks for 'fraudulent websites') are contained in a database cache file called SafeBrowsing.db - the file was created when you first launched Safari, and if you have the browser open, the file is modified approximately every 30 minutes.

In other words it is part of Safari's (version 3.2 onwards) anti-phishing security feature.

As an alternative to turning off 'Warn when visiting a fraudulent website', which will lose you that important security feature, you could delete that database file, (but first close Safari:

In Tiger:

Home/Library/Caches/com.apple.Safari (this is a folder)/SafeBrowsing.db

In Leopard*:

Private/Var/Folders/AF/AFONO9KnGpijQuAcxb6vf ++TI/Caches/com.apple.safari/Safari/SafeBrowsing.db

In Snow Leopard*:

Private/Var/folders/iI/iIaUOKJyFS0xmSIANVYiD ++TI/-Caches-/com.apple.Safari/SafeBrowsing.db

(*This location may vary depending on your OS. Also, the name of that weird sounding folder will be unique to each user.)

You can get to the Private/Var folder by using Go To in the Finder menu.

It will be recreated next time you open Safari, and will then start again collecting details of dodgy websites.

If you are interested:

How the Anti-Phishing feature of Safari 3.2 onwards works:

http://www.macworld.com/article/137094/2008/11/safarisafebrowsing.html

Reply

Answer 2

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 7:57 AM in response to Klaus1

I marked solved but have an additional question...

So, what happens if you turn it off in Safari and then turn it back on? When you turn it off, does that database get cleared? Or, when you turn it back on, does the db just start updating where it left off?

I guess this depends if it is a cumulative database (just adding each time it updates) or does it replace the file completely?

I wonder if there is anything built in to warrant against database corruption..

Thanks again.

Are you still updating that AV and Mac facts you do?

Reply

Answer 3

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 8:06 AM in response to powerbook1701

So, this is a test on google's website for safebrowsing:
http://www.google.com/url?sa=t&source=web&cd=4&ved=0CDAQFjAD&url=http%3A%2F%2Fww w.google.com%2Ftools%2Ffirefox%2Fsafebrowsing%2Fphish-o-rama.html&rct=j&q=safe%2 0browsing&ei=qsWETZKeOpSO0QG7gXhCA&usg=AFQjCNFAe5f7hNMpTQHPLlIYHKJfapLEA

It doens't trigger anything for me.
Safari must not work like Firefox and Chrome in this regards..

Reply

Answer 4

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 8:17 AM in response to powerbook1701

This database that Safari updates from only happens when Safari is open, right?

Again. THANK YOU for taking the time to help me understand.

Reply

Answer 5

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 8:24 AM in response to powerbook1701

I noticed that the link on this page to test Safe Browsing DID work, however

http://blog.chromium.org/2008/11/understanding-phishing-and-malware.html

Reply

Answer 6

MadMacs0

Level 5

5,221 points

Mar 19, 2011 3:30 PM in response to powerbook1701

powerbook1701 wrote:
I noticed that the link on this page to test Safe Browsing DID work, however

http://blog.chromium.org/2008/11/understanding-phishing-and-malware.html

Are you sure of that? All I get is a DNS window saying that the site doesn't exist. I think that's another old test site.

Reply

Answer 7

Klaus1

Level 9

52,749 points

Mar 19, 2011 4:13 PM in response to powerbook1701

When you turn it off, does that database get cleared? Or, when you turn it back on, does the db just start updating where it left off?

No and Yes in that order!

You only lose the accumulated data if you delete the database file.

Reply

Answer 8

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 4:24 PM in response to Klaus1

Thanks. I marked as solved and helpful. 🙂

So, the only way to refresh it and start from sratch is to delete the db file.

And, If I turn it off and then on, it will download what was missed..

Message was edited by: powerbook1701

Reply

Answer 9

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 4:41 PM in response to powerbook1701

looking at the entire log for that other MBP, I see it has only run the monthly 3 times in 2010...so, since I normally shut down, it must not run unless the computer is asleep during that time and then runs when it wakes....or, I didn't hit whatever magical thing has to happen otherwise to force it to run..

Reply

Answer 10

powerbook1701 Author

Level 3

666 points

Mar 19, 2011 5:25 PM in response to MadMacs0

yep, just clicked it and the page comes up of info, then you look for the "test page" link in the middle.

Reply