Apple Clarifies Tencent's Role in Fraudulent Website Warnings, Says No URL Data is Shared and Checks are Limited to Mainland China

[stylinexpat]

I think that was explained - nothing about you is sent to TenCent's or Google's servers.

Apple gets two lists of suspicious URLs - one from TenCent, one from Google.
If you use the feature, and you enter a URL that looks suspicious (but may be harmless), then Apple asks TenCent or Google for a more detailed list. For example if you visit www.scam.prevention then "www.scam" looks suspicious but "www.scam.prevention" may be completely harmless. All that TenCent and Google know is that _some_ Apple user _somewhere_ in China / outside China has asked for a URL starting with www.scam. Apple knows more.

Doesn't someone have to confirm that the site being visited in China for locals is legit or not? What if bank sites are rerouted during cyber attacks to other websites to steal account holders money? This was quite an issue in China for some time. Verifying IP addresses helps prevent bank fraud and email fraud from taking place.

 

[Rogifan]

It’s not Apple’s finest hour in terms of wording; not the first time, won’t be the last. But MacRumors published a sensational story with the title “Apple Sending User Data to Chinese Company for Fraudulent Website Warnings in Safari” — a headline drawing quite the conclusion considering Apple’s statement here — without any indication that they had reached out to Apple for comment, as any sensible journalist would. People tend to draw their conclusions based on headlines above a more nuanced story, and again, that was quite the headline they had there.


Then ask! I get that MacRumors isn’t a pinnacle of journalism by any stretch, but that’s just laziness. Even if the story had to be run before receiving comment from Apple — and it’s certainly not like MacRumors has to deal with print deadlines — a simple “We reached out to Apple for comment but have yet to receive a response” would have sufficed in the interim, because otherwise it appears that some directly false statements or implications were made in the original article.

Of course, I doubt we’ll see an update and correction on the original story, but I’d love to be pleasantly surprised.

This ?. And it’s not just MacRumors. Other sites ran with this story as well without having the full details or taking the time to explain exactly what’s happening.

The only reason Apple ever made Google a boogyman was because they were/are behind Google with respect to ML and AI. So Apple leadership thought the right path was to scare people. Don‘t focus on the fact our photos app isn’t as good as Google’s because god knows what Google is doing with your photos. Of course Cook never used the word Google. But the implication was there and everyone knew who he was talking about. Yet no one seems to be able demonstrate how Google is invading people’s privacy in ways that nobody else is.

 

[szw-mapple fan]

Now this, this is another in a row of supporting China's oppression towards Chinese people. Tencent's "fraudulent website list" can be anything that Chinese doesn't see fit. Anything. If Chinese government is uncomfortable with it, than it is gonna be on "fraudulent sites list".


I am wondering where is the limit to Apple's hypocrisy?

That's not how the great fire wall works. The government can block a website's ip by either cutting off access or slowing it down dramatically so it becomes unusable. This has nothing to do with how China censors the internet and it does not need to rely on a list made by internet companies like Tencent to do the tracking and blocking. This is completely innocuous not only because it can be turned off but also because using such a list to censure content is laughable at best.
[automerge]1571141856[/automerge]

Given that Google is blocked in China, what would you suggest they do in this instance?

Also given that Google has not directly operated in the Chinese market for so long that any list they may have of fraudulent sites in China is most probably outdated and incomplete.

 

[szw-mapple fan]

Doesn't someone have to confirm that the site being visited in China for locals is legit or not? What if bank sites are rerouted during cyber attacks to other websites to steal account holders money? This was quite an issue in China for some time. Verifying IP addresses helps prevent bank fraud and email fraud from taking place.

The site domain is just an alias for IP addresses. So yes, IP will be checked for checks like these.

 

[rgbrock1]

If you are still concerned by this feature, you can disable it in Settings > Safari > Privacy & Security.

Thanks for that. I hadn't realized that Apple was sending anything to Google. What could possibly go wrong with that? (Which also explains the numerous Google cookies I seem to always acquire although I do not ever visit any website having anything to do with Google. Or, so I thought.)

 

[stylinexpat]

That's not how the great fire wall works. The government can block a website's ip by either cutting off access or slowing it down dramatically so it becomes unusable. This has nothing to do with how China censors the internet and it does not need to rely on a list made by internet companies like Tencent to do the tracking and blocking. This in completely innocuous not only because it can be turned off but also because using such a list to censure content is laughable at best.
[automerge]1571141856[/automerge]


Also given that Google has not directly operated in the Chinese market for so long that any list they may have of fraudulent sites in China is most probably outdated and incomplete.

This is true, there is a good side to it and bad side as well.

 

[MacBH928]

anything Google+privacy=not good

 

[curtvaughan]

Pull out.

Indeed. Apple, like the NBA, is looking solely at the bottom line when it comes to dealing with China. The interesting thing is that both Apple and the NBA have enough international clout to exert considerable influence on Chinese policy where privacy and belligerent policies come to the fore. If Apple and the NBA both packed up and left China, there would possibly be enough of an outcry from Apple and NBA fans in China for compromises to be made from the Chinese government. It would certainly provide considerable public relations bonuses. Additionally, this isn't the same China that was run by Mao 50 years ago. China is one of the most capitalistic oriented nations on the globe, and losing Apple or the NBA would hurt them at least as much as either business.

 

[curtvaughan]

Librem phone is about to get released. It sucks, it is 5 years behind in design, but if it turns out that it is only option in the end, then, well. I will be sorry to switch, but you got to do what is necessary.

If you live in Europe give SailfishOS a try. It's developed by a Finnish company called Jolla. I wish it was available in the US.

Info - Sailfish OS

sailfishos.org

 

[iGeneo]

anything Google+privacy=not good

Turn off fraudulent website tracking and all of your Google problems go away

 

[Nugget]

Turn off fraudulent website tracking and all of your Google problems go away

What problems arise from using the fraudulent website tracking feature? I try to avoid interacting with Google whenever I can, but I don't see any problems with how this service works.

 

[DeadeyeM]

Ok TimApple... oh sorry I meant TimChina

 

[nt5672]

Don’t banks,online trading brokerages for stocks and other government websites request or require IP verification to prevent cyber crimes from taking place ..? Otherwise some other person can log into your account. No..?

No it does not work that way. That is so they can track you after you break into an account.

But that does not apply with safe browsing sites as I do not log into them.
[automerge]1571169482[/automerge]

They don't send your IP address per se. It is provided in the network packets the phone sends to the server when it connects to the service.

It is how the Internet works.

Then Apple should proxy it.

 

[curtvaughan]

do Edge, Firefox, Opera doing this with Tencent?

Opera was bought out by Chinese businessman Zhoui Yahui, founder of Kunlun Tech in Beijing, which specializes in mobile games and a cyber security company called Qihoo 360. Edge is Microsoft based. Don't know that I'd put a lot of faith in either of those browsers if I was concerned with privacy. I don't know if they actually work with Tencent, but Qihoo 360 has quite an interesting history:

Qihoo 360 - Wikipedia

en.wikipedia.org

If you are really concerned with privacy on the internet, get a reliable VPN subscription and run Tor on Tails. Send all your messages on Signal. It would be nice if there were more FOSS offerings for mobile phones. If I lived in Europe or South America I'd look seriously in putting SailfishOS on an unlocked Sonly Xperia phone. It is based in Finland and is open source. Check on https://jolla.com . I just bought a new iPhone (vanilla 11), mainly for the convenience of portage from my old iPhone 6S+. I've been using both iPhones and Android phones, each for different reasons, since around 2010. I like the hardware options on my LG V-series phones, especially for sound (headphone jack, high quality DAC) and their ability to insert SD cards for storage. Just wish I could run a FOSS OS rather than Android for security peace of mind. To date, the iPhone is still my goto for everyday messaging and phone service. It is at least more secure than Android. You can use the DuckDuckGo search engine on Safari and at least get away from Google. DuckDuckGo even has a browser for both iOS and Android, available on the Apple App Store or Google Play.

 

[iGeneo]

What problems arise from using the fraudulent website tracking feature? I try to avoid interacting with Google whenever I can, but I don't see any problems with how this service works.

None, totally agree

 

[Tech198]

I guess cross checks are cross checks, and what better way than China.
[automerge]1571199690[/automerge]

Opera was bought out by Chinese businessman Zhoui Yahui, founder of Kunlun Tech in Beijing, which specializes in mobile games and a cyber security company called Qihoo 360. Edge is Microsoft based. Don't know that I'd put a lot of faith in either of those browsers if I was concerned with privacy. I don't know if they actually work with Tencent, but Qihoo 360 has quite an interesting history:

Qihoo 360 - Wikipedia

en.wikipedia.org

If you are really concerned with privacy on the internet, get a reliable VPN subscription and run Tor on Tails. Send all your messages on Signal. It would be nice if there were more FOSS offerings for mobile phones. If I lived in Europe or South America I'd look seriously in putting SailfishOS on an unlocked Sonly Xperia phone. It is based in Finland and is open source. Check on https://jolla.com . I just bought a new iPhone (vanilla 11), mainly for the convenience of portage from my old iPhone 6S+. I've been using both iPhones and Android phones, each for different reasons, since around 2010. I like the hardware options on my LG V-series phones, especially for sound (headphone jack, high quality DAC) and their ability to insert SD cards for storage. Just wish I could run a FOSS OS rather than Android for security peace of mind. To date, the iPhone is still my goto for everyday messaging and phone service. It is at least more secure than Android. You can use the DuckDuckGo search engine on Safari and at least get away from Google. DuckDuckGo even has a browser for both iOS and Android, available on the Apple App Store or Google Play.

Tor is based on Chromium...

I don't even trust VPN's because "trust" is something that head winds everything else, even privacy...

Therefore if privacy was that important you wouldn't be trusting anyone.

 

[MacBH928]

What problems arise from using the fraudulent website tracking feature? I try to avoid interacting with Google whenever I can, but I don't see any problems with how this service works.

its just that anything "Google" is not trust worthy. They work for shareholders, and all shareholders want is more money.

 

[Tech198]

its just that anything "Google" is not trust worthy. They work for shareholders, and all shareholders want is more money.

Perhaps not, but its pretty hard to avoid now-a-days, particularly when everything is shares weather directly, or indirectly..

It's like saying "you can VPN to a country where nothing is shared to the government/agencies or participates in the 14-eye system"


What's that ... there wold be only 3 countries.. and even then you cannot guarantee 100%

 

[MacBH928]

Perhaps not, but its pretty hard to avoid now-a-days, particularly when everything is shares weather directly, or indirectly..

It's like saying "you can VPN to a country where nothing is shared to the government/agencies or participates in the 14-eye system"


What's that ... there wold be only 3 countries.. and even then you cannot guarantee 100%

but when you fight it, you limit it, and push it the other way around, instead of accepting it and making it the norm. Due to privacy concerns today we have many privacy oriented software and services like:
Brave Browser, DuckDuckGo, ProtonMail, PiHole, uBlockOrigin, PrivacyBadger, VPNs, TorBrowser, LibreOffice.

Imagine if we gave up and said "We can not avoid it, so everyone uses Google Search, Maps, Chrome, Android, and Gmail".

Its like child labour and sweat shops, if consumers thought "those are just too big corporations, we might as well give up on it" then it would have gone indefinitely.