Preface
Actually, I feel like talking about this now is way too outdated. I saw that the earliest articles online started talking about this back in 2017. As for why I'm talking about it now? Because I only just found out myself. After all, Safari is just a decoration to me, and my main browser has always been Chrome~.
I also came across this on Zhihu recently by chance. Since I occasionally use Safari for testing, I felt it wasn't completely irrelevant to me, so I spent some time researching it to see if anything has changed after all this time, and decided to write a quick post about it.
What is the "Deceptive Website Warning"?
First, let's look at the explanation of the "Deceptive Website Warning" on mainland China iOS:
Next, let's look at the explanation of the "Deceptive Website Warning" on macOS:
Simply put, for user safety, when users browse URLs using the Safari browser, Apple uses databases provided by external security providers to verify whether the visited URL is safe. If the result is unsafe, the Safari browser will block the URL from loading and display a "Fraudulent Website Warning":
Of course, users can choose to click "Visit this unsafe website" (though I've also seen reports saying that clicking to visit doesn't work and you must turn off the "Fraudulent Website Warning" feature to access it). However, I believe most people will choose not to proceed, out of trust in Apple.
Where is the issue?
Previously, the external security provider was always "Google Safe Browsing". However, starting from September (or October) 2019, "Mainland China" was separated (and has now become "Mainland China" or "Hong Kong"), with "Tencent Safe Browsing" taking charge.
I believe everyone is familiar with Tencent's habits (sending a URL in WeChat often results in it failing to open in WeChat's built-in browser, claiming it was reported for anomalies; sending messages in QQ might get normal URLs flagged in red, yet they open fine in desktop browsers). Coupled with this sentence: “Google (or Tencent, for users with their region set to ”Mainland China“ or ”Hong Kong") may also log your IP address when receiving this information," this scared quite a few people. Indeed, some users found that URLs they previously accessed normally in Safari and knew were perfectly fine were suddenly blocked by the "Fraudulent Website Warning" after this change, prompting many to turn off the "Fraudulent Website Warning" feature.
"How the "Fraudulent Website Warning" Works
Question: How do the Safari browser and external security providers verify whether the URL visited by the user is safe? Does Safari directly send the user's visited URL and IP address to the external security provider?
After looking into it, it seems that in the early days (when there was only "Google Safe Browsing"), this was indeed the case. At that time, Google provided an API, and the browser would directly send the user's URL to Google's API for querying. So during that period, Google could indeed obtain the full URL visited by the user as well as the user's IP address. This API still exists today, called the Lookup API:
To address these issues, Google quickly proposed a more secure "Safe Browsing" method. This new method is called the "Update API", and it works like this:
Google first calculates the SHA256 hash of each unsafe URL in its database, and then truncates each hash to a 32-bit prefix to save space.
Google sends the database of truncated hashes to your browser.
Every time you visit a URL, the browser hashes it and checks if its 32-bit prefix is included in the local database.
If the prefix is found in the browser's local copy, the browser sends that prefix to Google's servers, which send back a list of all full 256-bit hashes matching that prefix, allowing the browser to check for an exact match.
With each request, Google's servers see the user's IP address as well as other identifying information such as the database state.
Undoubtedly, the Lookup API is a privacy disaster, whereas the "Update API" is much better for privacy: in principle, Google should only know the 32-bit hashes of some browsing requests. Furthermore, these truncated 32-bit hashes do not precisely reveal the URL address you are visiting, as there can be many collisions in such a short identifier, providing a form of anonymity.
The downside of this approach is that it only provides partial privacy: typical users do not visit just one URL; they browse thousands of URLs over time. This means that if a provider wants to de-anonymize a user, they need to collect more information about the URLs visited by that user. If a user browses many related websites, they will gradually leak details of their browsing history to the provider, and if the provider wishes, they could actually correlate these requests to deduce which websites the user visited.
Although only Google is mentioned above, it is estimated that Tencent likely uses the same method. Therefore, whether a user trusts the "Fraudulent Website Warning" issued by the Safari browser when browsing URLs depends on whether that user trusts the "Safe Browsing" provider.
"The Impact of Enabling the "Fraudulent Website Warning" Option
Actually, when Tencent first took over, they probably didn't have a good sense of proportion and habitually added many "self-defined" bad websites to the "Fraudulent Website" list, causing many users in the Mainland China region to be "warned" when using Safari to visit websites they were accustomed to visiting:
Although I don't know what site they are talking about in the image above, this would definitely have a major impact on Apple's image. So I estimate that negotiations must have taken place afterward, and the "Safe Browsing" database Tencent provides to Apple is likely quite different from the one used in domestic WeChat and QQ, so the "Fraudulent Website Warning" won't pop up at every turn anymore.
Should You Turn Off the "Fraudulent Website Warning"?
After saying so much, what is the conclusion? Should you actually turn off the "Fraudulent Website Warning" feature?
To be fair, although Tencent will certainly have some minor tricks, like adding some of their own "ingredients" to the "Safe Browsing" database, the vast majority of the problematic URLs in its "Safe Browsing" database are indeed real threats. Turning it off completely is a bit of a waste, so let's discuss it case by case:
If you are relatively professional, know a lot, and are very confident that the websites you frequently visit are fine and that you won't visit problematic websites, then you can actually turn it off, because knowing more brings more concerns.
If you don't know much about this and can't distinguish which websites are problematic and which are not, and you don't visit websites you shouldn't, then you can definitely keep it turned on.
If you want to enjoy the usual "Fraudulent Website Warning" but sometimes want to visit some unspeakable websites, and you are also worried about being logged (though the probability is very low), then as long as you have the energy, you can absolutely keep it on normally, turn it off when needed, and turn it back on when you don't need it.
Actually, there is another type, which is an upright person like me who has a completely clear conscience and will keep it turned on!
P.S. It was only temporarily turned off earlier for screenshots; it is all turned on now!
This reminds me of how some browsers have a feature to detect whether the passwords you use have been leaked – have i been pwned?. They use a similar mechanism: it would be easy for the browser to know your plaintext password, but for security reasons, it cannot do so. First, it hashes your password, takes a portion of the hash value, and sends this portion to the browser's official servers. Since they only receive a portion of a hash value, it is impossible for the browser's official servers to know what your exact password is. They then find data matching this portion of the hash in the leaked password database and return it to the user. The user's side then compares their password with this returned data. If there is a match in the returned data, it means the user's password is in the leaked database, indicating that the user is using a weak password or that the password has already been leaked.
I learned about this in a blog post before, but somehow I can't find the original article anymore. This mechanism also has a term called “k-anonymity”.