Subject: [Tools-discuss] google thinks etherpad is phising

From: Michael Richardson <[email-masked]>
Date: Tue, 28 Oct 2014 10:17:50 -0400

Several people (nomcom call yesterday, 6tisch security team this morning)
get this in the past day from etherpad.tools.ietf.org:
        http://www.sandelman.ca/tmp/mcrcapture/6969.2014-10-28/capture1.png

specifically, a warning that the site is a phising site.

I expect that it's a false positive, but in order to get the details, you
have to connect to the Google web site manager portal to find out.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 28 Oct 2014 17:25:31 +0100

Hi Michael,

> have to connect to the Google web site manager portal to find out.

The portal shows no current warnings for ethernet.tools.ietf.org; I just
checked.  Furthermore, I don't get this warning when I open a test document
in etherpad; but I do get it for the link visible in your screenshot.

In the webmaster tools for etherpad.tools.ietf.org, under security issues,
they mention this (see the second paragraph):

  Security Issues

  Currently, we haven't detected any security issues with your site's content.
  If you want to learn more about security issues and how they could affect
  your site, review our resources for hacked sites.

  However, if you see a malware warning in the browser when navigating to your
  site, it's likely that your site is referencing code or content from another
  domain that has malware. Read up on cross-site malware and learn how to address
  it. 

Could it be that there are links in the xml content of the etherpads which
google find suspicious?  Or something else related to the content being
an xml document under guise of a html page?

Best regards,

	Henrik

---

From: Michael Richardson <[email-masked]>
Date: Tue, 28 Oct 2014 12:57:37 -0400

> in etherpad; but I do get it for the link visible in your screenshot.

hmm. So it's specific to that link.

    > an xml document under guise of a html page?

Sounds reasonable, except that it also occured for multiple nomcom members;
we use the etherpad for relatively benign activity of taking attendance.
No xml documents living in etherpad, no links...

And it wasn't just me.

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 28 Oct 2014 18:20:37 +0100

> No xml documents living in etherpad, no links...

Ack; I don't doubt the report; but I'd like to understand.  And if no XML doc
was involved for the nomcom etherpad, then it must be something else.  Mph.

Best regards,

	Henrik