Reply to thread

Message

<blockquote data-quote="Marko :)" data-source="post: 953299" data-attributes="member: 39702">I used uppercase letter just as an example to show how any character change results in completely new hash. On the web, <a href="http://www.google.com" target="_blank">www.google.com</a>, <a href="http://www.Google.com" target="_blank">www.Google.com</a>, <a href="http://www.gOOglE.com" target="_blank">www.gOOglE.com</a> lead to same address. So, no Google doesn&#039;t need to have hashes for every variant of domain name. When you type an address in uppercase, all web browsers will automatically make the address lowercase because uppercase letters don&#039;t exist in domains.And, URLs and domains are not the same thing. URLs contain domains along with specific path of the page on a web server. They often contain unique parameters which make hashed URLs undecryptable.Example;[ICODE]C32F0D568284387D515238E6BDF34C08AF10AACDEEEBA4777D7A8CD41850ECBA[/ICODE] leads to [ICODE]https://malwaretips.com/[/ICODE].[ICODE]C4E8A51D51CB479C4738C9BE05F2E1BBE43894DFF6F630EC356FC359249059FA[/ICODE] also leads to [ICODE]https://malwaretips.com/[/ICODE] but to a post in some thread I stumbled upon on this site.Even if Google gets the actual URL by somehow magically decrypting SHA-256 hash, I&#039;d have nothing against that since the only thing they got is the URL of malicious website. They still have no idea what I visited before and next because that info isn&#039;t sent.Well, in that case, attacker seeing what&#039;s sent to SmartScreen servers is the least of your problems. <img class="smilie smilie--emoji" loading="lazy" alt="😁" title="Beaming face with smiling eyes&nbsp; &nbsp; :grin:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f601.png" data-shortname=":grin:" />Domains aren&#039;t, but URLs could be like passwords. If they contain unique parameters which they do, most of the times. <img class="smilie smilie--emoji" loading="lazy" alt="😉" title="Winking face&nbsp; &nbsp; :wink:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f609.png" data-shortname=":wink:" /></blockquote>

[QUOTE="Marko :), post: 953299, member: 39702"] I used uppercase letter just as an example to show how any character change results in completely new hash. On the web, [I][URL='http://www.google.com']www.google.com[/URL][/I], [I][URL='http://www.Google.com']www.Google.com[/URL][/I], [I][URL='http://www.gOOglE.com']www.gOOglE.com[/URL][/I] lead to same address. So, no Google doesn't need to have hashes for every variant of domain name. When you type an address in uppercase, all web browsers will automatically make the address lowercase because uppercase letters don't exist in domains. And, URLs and domains are not the same thing. URLs contain domains along with specific path of the page on a web server. They often contain unique parameters which make hashed URLs undecryptable. Example; [ICODE]C32F0D568284387D515238E6BDF34C08AF10AACDEEEBA4777D7A8CD41850ECBA[/ICODE] leads to [ICODE]https://malwaretips.com/[/ICODE]. [ICODE]C4E8A51D51CB479C4738C9BE05F2E1BBE43894DFF6F630EC356FC359249059FA[/ICODE] also leads to [ICODE]https://malwaretips.com/[/ICODE] but to a post in some thread I stumbled upon on this site. Even if Google gets the actual URL by somehow magically decrypting SHA-256 hash, I'd have nothing against that since the only thing they got is the URL of malicious website. They still have no idea what I visited before and next because that info isn't sent. Well, in that case, attacker seeing what's sent to SmartScreen servers is the least of your problems. 😁 Domains aren't, but URLs could be like passwords. If they contain unique parameters which they do, most of the times. 😉 [/QUOTE]

Verification