Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Unchecking Enable phishing and malware protection in Chrome's browser settings page does not prevent Chrome from communicating with safebrowsing.clients.google.com and safebrowsing-cache.google.com (according to packets captured using Wireshark).

How can I disable this feature?

share|improve this question

4 Answers 4

up vote 6 down vote accepted

You could edit your hosts file, which will block the traffic. Maybe there is a less brute force way, but I'm sure this will work.

Add the following to your hosts file in Linux and Windows:

127.0.0.1 safebrowsing.clients.google.com
127.0.0.1 safebrowsing-cache.google.com

Add the following to your hosts file in OSX:

0.0.0.0 safebrowsing.clients.google.com
0.0.0.0 safebrowsing-cache.google.com

Your hosts file is found at the following location:

  • Windows XP and later: c:\windows\system32\drivers\etc\hosts
  • Linux: /etc/hosts
  • OSX: /private/etc/hosts

More information: http://en.wikipedia.org/wiki/Hosts_%28file%29

Mac OSX information added from JTM's answer to ensure everyone seeing this gets the correct information.

share|improve this answer
1  
Fun fact: Google still uses other firm's ad-servers to pass on info about you if you block them or attempt to disable these services. –  user64406 Jan 24 '11 at 15:06
2  
That is a fun fact, do you have any proof to back up the claim, out of interest? I'd like to see how they accomplish this and work on blocking them too...:) –  Paul Jan 25 '11 at 0:11
    
Well, all since "goog" forensic analysis posts tend to "get disappeared" - all I can tell you is that proxy logs are your friend. –  user64406 Jan 27 '11 at 19:40

Adding 127.0.0.1 for safebrowsing-clients.google.com or safebrowsing-cache.google.com does not help. I did just that and according my suricata logs it is still pointing to the Google's real addresses, so browser does not use hosts file for that. I also tcpdumped the whole C-class where it previously pointed and still there is traffic to these addresses while I request totally different web sites.

However string match in iptables does the trick:

iptables -I FORWARD -m string --to 41 --algo bm --string 'safebrowsing-clients' -j GOOGLE
iptables -I FORWARD -m string --to 41 --algo bm --string 'safebrowsing-cache' -j GOOGLE
iptables -I GOOGLE -m string --to 80 --algo bm --string 'google' -j DROP

So a bit awkward and works only in Linux, but it works.

share|improve this answer

In response to Paul's post, the OS X file is /private/etc/hosts. Don't use 127.0.0.1 on OS X. Use 0.0.0.0. You want it to return no route, not a route to the localhost.

0.0.0.0 safebrowsing.clients.google.com
0.0.0.0 safebrowsing-cache.google.com
share|improve this answer

How to disable in Chrome: http://www.google.com/support/chrome/bin/answer.py?answer=99020&hl=en

  1. Click the wrench icon on the browser toolbar.
  2. Select Options (Preferences on Mac and Linux; Settings on Chrome OS).
  3. Click the Under the Hood tab and find the "Privacy" section.
  4. Deselect the "Enable phishing and malware protection" checkbox.

How to disable in FireFox: http://www.mozilla.com/en-US/firefox/phishing-protection/

Phishing and Malware Protection options can be found on the Security Preferences pane. Go to Tools > Options... > Security.

(Uncheck "Block reported attack sites" and "Block reported web forgeries".)

share|improve this answer
3  
Wireshark shows Google Chrome still connects to Google even after unchecking/deselecting the "Enable phishing and malware protection" checkbox. –  David H Mar 15 '11 at 10:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.