News for hackers. Stuff that matters.
Re:Google-hosted malvertising leads to fake Keepass site tha... by izacus on Thursday October 19, 2023 @04:17AM (#37939988)
That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world.

Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding their power and reach.

Why would you want that? (And that also goes for people who want Apple to replace their government at law enforcement).

Re:Google-hosted malvertising leads to fake Keepass site tha... by Nextgrid on Thursday October 19, 2023 @04:30AM (#37940088)
> Why would you want that?

If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair.

Why shouldn't Google be held to the same standard?

Re:Google-hosted malvertising leads to fake Keepass site tha... by WrockBro on Thursday October 19, 2023 @06:40AM (#37940980)
The problem is you have to prove intent to build a legal case. If the person holding a banner doesn't know whatever they're advertising is illegal then they wouldn't be liable. A case could be made if they're informed it's illegal and they continue anyways, but that isn't likely to happen.
Re:Google-hosted malvertising leads to fake Keepass site tha... by JumpCrisscross on Thursday October 19, 2023 @07:07AM (#37941178)
If a billboard starts advertising meth, you obviously go after the meth dealer. But the billboard owner—who painted the ad onto it—should also have liability (albeit civil).
Re:Google-hosted malvertising leads to fake Keepass site tha... by DannyBee on Thursday October 19, 2023 @08:51AM (#37942169)
"If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair."

For the most part, you would not. While it is not protected by the first amendment in the US to advertise illegal products, it is also not particularly restricted in most of the US.

To whit: If you hold up a big banner saying "fentanyl sale - 30 cents per gram", you would not have committed a crime or an actionable legal tort in most places.

The thing that is actionable everywhere is deceptive/fraudulent/misleading advertising.

Re:Google-hosted malvertising leads to fake Keepass site tha... by MediumOwl on Thursday October 19, 2023 @05:29AM (#37940503)
The malicious website is published on google dot com. It's not unreasonable to require that a website doesn't publish obvious scams. Of course, "obvious" is hard to define precisely.
Re:Google-hosted malvertising leads to fake Keepass site tha... by izacus on Thursday October 19, 2023 @06:59AM (#37941121)
And why is the website that's pushing malicious scams not punished by the appropriate government mechanism?

That seems to be much more appropriate approach to prevent this kind of crime. Why is US so incompetent at punishing scammers as a country?

Re:Google-hosted malvertising leads to fake Keepass site tha... by mschuster91 on Thursday October 19, 2023 @05:45AM (#37940607)
> That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world.

Google is a company that nets 60 billion $ a year in profits. They can afford hiring a few thousand people to manually vet ads before they go out, and they should.

Re:Google-hosted malvertising leads to fake Keepass site tha... by izacus on Thursday October 19, 2023 @07:00AM (#37941128)
They can, but can you afford to be policed and punished by them?

It's kinda bizarre how many here whine about not trusting Google and then just want to give them police powers.

Re:Google-hosted malvertising leads to fake Keepass site tha... by DannyBee on Thursday October 19, 2023 @09:04AM (#37942335)
Your math is off, without more data.

What do you think the number of different ads being displayed is, given how much each ad costs?

Estimates suggest it's about 30 billion ad impressions per day to earn that.

If each distinct ad gets 1000 impressions, that's 10 billion ads to review per year.

Let's be super generous, and assume it's 10k impressions, leaving us with 1 billion ads to review.

Let's further assume it's 1 minute per ad to review them, because people are super good at it. This will take 694440 person/days to review.

So to even give a 24 hour turnaround time, they'd have to hire 694,000 people.

If they pay them 65k each (yearly minimum wage in california), that's 45 billion a year.

This again, assumes we have ads with lots of impressions, it's only a minute per ad, and that we are okay with 24 hour turnaround time. Otherwise, it costs more.

It's really easy for people to play the "company makes x, they can afford y" game, but without real data it's sort of magical thinking.

I doubt humans could easily keep up with the review load here, at scale, at any reasonable cost/living wage.

Re:Google-hosted malvertising leads to fake Keepass site tha... by mschuster91 on Thursday October 19, 2023 @09:46AM (#37942837)
So what? If Google is only profitable because the vast externalized costs to it are borne by society at large (e.g. malvertising, scams, unsafe "medical" products and supplements, competitors placing ads in an unfair way [1]), then maybe prices for advertising have to rise to match the prevention cost, or Google has to figure out other ways of staying profitable. I don't care all that much.

And if it leads to less, but higher quality ads in the end, even better.

[1] https://dejure.org/dienste/vernetzung/rechtsprechung?Gericht...

Re:Google-hosted malvertising leads to fake Keepass site tha... by DannyBee on Thursday October 19, 2023 @10:28AM (#37943386)
The so what is that the comment is completely and totally wrong in it's estimation of how simple or not it would be.

That is all.

We should decide what to do about it based on correct data and sane assumptions, not random assertions that are off by orders of magnitude and backed by no data.

Re:Google-hosted malvertising leads to fake Keepass site tha... by sccxy on Thursday October 19, 2023 @09:50AM (#37942885)
Strange explanation.

If Google cannot handle legit business then it should manage their resources better.

Advertising malware is not legit business.

"We are so profitable and big" is not excuse for it.

It is reason why they earn so much money, they do not care if criminals advertise malware.

Now banks must spend awful lot of money to fight money laundering. Maybe it is time to force Google to take some responsibility.

Re:Google-hosted malvertising leads to fake Keepass site tha... by DannyBee on Thursday October 19, 2023 @10:26AM (#37943363)
"Advertising malware is not legit business."

Sure. I"m pointing out this simple sort of "they can easily afford to do x" is usually nonsense.

I haven't commented at all on what the result should be (not allowed to do it or whatever), simply that the math that it would be simple to fix is wrong.

If we are going to argue about things in a useful way, we should avoid random assertions without data that don't really advance the argument, especially when they are trivially wrong?

Re:Google-hosted malvertising leads to fake Keepass site tha... by sccxy on Thursday October 19, 2023 @10:36AM (#37943486)
Sorry, but that is most fanboyish thing ever.

If Google cannot handle their ad business, when there are too many customers, then stop taking new customers.

Very simple.

But taking money from criminals is very profitable and that is the reason.

Re:Google-hosted malvertising leads to fake Keepass site tha... by DannyBee on Thursday October 19, 2023 @11:27AM (#37944223)
Ah, i see we've moved onto ad-hominen attacks and dismissal rather than engaging for real. That certainly may feel good, but it changes nothing about the argument?

This sort of dismissal based on who you work for is both childish, and unproductive to a real discussion. Similar to the "most fanboyish thing ever" comment, which, honestly, if telling someone their totally unsourced math and claim is wrong, by providing data and real math, is the most fanboyish thing you've ever seen, then i think you are very lucky in what you see ;)

Beyond that, i'll repeat what I said - i simply pointed out the assertion and math is wrong. That is all. You are the one claiming i am defending anything, beyond that, at all. I was very careful about not defending anything, and in fact said i'm open to all sorts of views about what to do about it.

Maybe you should re-read what i wrote, and point out any point where i did anything but show that the claim made was wrong, and the math was wrong?

Re:Google-hosted malvertising leads to fake Keepass site tha... by sccxy on Thursday October 19, 2023 @11:32AM (#37944303)
Your math is wrong because you say that Google spends 0 dollars at the moment to fight scam ads.

If it is true, then Google execs should be in jail right now.

And proves point again that Google does not care about filtering content and it is profitable to accept money from criminals.

Ofcourse if your paycheck depends of criminals money then it is very dumb to share that profit to hire more people to fight malware content.

Re:Google-hosted malvertising leads to fake Keepass site tha... by brucethemoose2 on Thursday October 19, 2023 @08:48AM (#37942142)
Google is effectively a giant mall, and mall owners sure as heck police their stores by actively trying to identify criminal storefronts.

Google doesn't have to do this because they are anticompetitive.

The root problem here is that Google shouldn't be in this position where we are talking about them acting as law enforcement, and a business getting banned by Google is akin to getting ejected from society.