Can you explain this? I've never heard of "DOM hashes" before.

Not "DOM" but a hashes of the URL or a part of it, to check if the domain or URL is "safe." Also downloads are checked. And AFAIK it's more nuanced, there's also a database that can be checked and allow "offline" checks. But it would still be interesting to find one independent serious analysis of the behavior.

Actually it sends the DOM model too. It's named client side detection. https://news.ycombinator.com/item?id=5971403

It's named client side detection and it sends the DOM model(actually hashes of it) to Google. I found about it on HN too. Obviously you may check FF/Chrome source too. I would love to be proven wrong. https://news.ycombinator.com/item?id=5971403

Can you please explain this in more detail? Ideally with an example request that you see?

(I highly doubt that there is any truth to this claim)

I think they were referring to https://wiki.mozilla.org/Security/Safe_Browsing … which uses safebrowsing.google.com, but doesn't send any "DOM hashes" to them.

How do you explain this? https://news.ycombinator.com/item?id=5971403

helb was saying Firefox does not send "DOM hashes", the story you link to is about Chrome.

Both Chrome and Firefox use the same techniques as far as the client side detection is concerned if not even the same code. Both send the data to Google.

I think you can check the source https://cs.chromium.org/chromium/src/chrome/browser/safe_bro... Long story short it sends the DOM "model" including links, input names etc. There was a story on HN about this https://news.ycombinator.com/item?id=5971403

You should read the Privacy section at https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...

> One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe.

> While this was an option in version 1 of the Safe Browsing protocol (as disclosed in their privacy policy at the time), support for this "enhanced mode" was removed in Firefox 3 and the version 1 server was decommissioned in late 2011 in favor of version 2 of the Safe Browsing API which doesn't offer this type of real-time lookup.

Firefox 3 - That was 9 years ago.

I believe that doesn't take into account the client side detection. It was added later.

There's a lot of FUD about this, though.

https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...