Comment on Google flags Immich sites as dangerous

• Nibodhika@lemmy.world ⁨1⁩ ⁨day⁩ ago

  It is for pull requests. A user makes a change to the documentation, they want to be able to see the changes on a web page.

  So? What that has to do with SSL certificates? Do you think GitHub loses SSL when viewing PRs?

  If you don’t have them on the open web, developers and pull request authors can’t see the previews.

  You can have them in the open, but without SSL you can’t be sure what you’re accessing, i.e. it’s trivial to make a malicious site to take it’s place an MitM whoever tries to access the real one.

  The issue they had was being marked as phishing, not the SSL certificate warning page.

  Yes, a website without SSL is very likely a phishing attack, it means someone might be impersonating the real website and so it shouldn’t be trusted. Even if by a fluke of chance you hit the right site, all of your communication with it is unencrypted, so anyone in the path can see it clearly.

  source

  • Count042@lemmy.ml ⁨1⁩ ⁨day⁩ ago

    Yes, a website without SSL is very likely a phishing attack, it means someone might be impersonating the real website and so it shouldn’t be trusted. Even if by a fluke of chance you hit the right site, all of your communication with it is unencrypted, so anyone in the path can see it clearly.

    No, Google has hit me with this multiple times for sub domains where the subdomain is the name of the product and has a login page.

    So, for example, if I have emby running at emby.domain.com they’ll mark it as a phishing site. You have to add your domain to their web console and dispute the finding which is probably automated. I’ve had to do this at least three times now.

    All my certs were valid.

    source

    • Nibodhika@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Yes, Google has miss reported my websites in the past, all of which were valid, but the person I’m replying to seemed to assume no-SSL is a requirement of the feature, and he doesn’t understand that a wrong/missing SSL is indistinguishable from a Phishing attack, and that the SSL error page is the one that warns you about phishing (with reason).

      source
• FreedomAdvocate@lemmy.net.au ⁨1⁩ ⁨day⁩ ago

  The issue they had was being marked as phishing, not the SSL certificate warning page.

  Have you seen what browsers say when you have a look at the SSL certificate warning page?

  It is for pull requests. A user makes a change to the documentation, they want to be able to see the changes on a web page.

  Why is a user made PR publishing a branch to Immich’s domain for the user to see?

  source

  • BCsven@lemmy.ca ⁨17⁩ ⁨hours⁩ ago

    I thought that was how pull requests worked, its a branch if you’veade a departure to edit code, you have the pull request and ask them to merge into the main branch. It should be visible to everyone so everyone can review the change.

    source