Google told how Chrome protects users from sites that flood the browser with intrusive notifications. In the first quarter alone, the company reduced the number of such notifications on Android by more than 7 billion a day. To combat abuse, the browser uses several levels of protection at once, so that malicious mailing does not pass even when one of the mechanisms fails.
One of the measures concerns sites that the user has not used for a long time. Chrome automatically withdraws their permission to send notifications. The browser also deprives such access sites that have repeatedly received warnings due to suspicious notifications. If desired, the user can return the permission through the security verification section.
Chrome has learned to identify entire networks of sites that work together. To find such circuits, the system analyzes the behavior of sites and the work of the background components of the browser, including signs of coordinated activity. This approach helps to detect resources that spread malware or fraudulent messages, even if the contents of the pages themselves do not look dangerous at first glance.
The extra layer of protection works on the Firebase Cloud Messaging side, through which sites can deliver notifications. The system takes into account the volume of messages, the time that users spend on the site, the frequency of resolution requests and the overall level of interaction with the resource. For offenders, there is a limit of 1000 messages per minute, and when the limit is exceeded, the server responds with the HTTP 429 code.
With repeated violations, the restrictions become tougher. Limits return to normal values only after the period of normal operation of the site. According to Google, such a mechanism makes mass campaigns much more expensive and prevents attackers from quickly sending out a huge number of messages.
The company also changed the process of issuing permits on Android. The new interface allows the user to decide whether they want to receive notifications without interrupting the work with the site with an intrusive request. Earlier, Chrome added to Android the ability to refuse notifications of a particular resource with one click.
Google believes that a combination of several mechanisms helps to combat fraudulent notifications through which attackers distribute malicious programs, lure personal data and try to get money. At the same time, excess background activity is reduced, which reduces the load on the device and battery consumption.
The user can still check the permissions on their own. In the desktop version of Chrome, notification settings are in the privacy and security section, and on Android access to them opens through the browser settings menu. Google advises periodically viewing the list of sites with permission to send notifications and delete unnecessary.
One of the measures concerns sites that the user has not used for a long time. Chrome automatically withdraws their permission to send notifications. The browser also deprives such access sites that have repeatedly received warnings due to suspicious notifications. If desired, the user can return the permission through the security verification section.
Chrome has learned to identify entire networks of sites that work together. To find such circuits, the system analyzes the behavior of sites and the work of the background components of the browser, including signs of coordinated activity. This approach helps to detect resources that spread malware or fraudulent messages, even if the contents of the pages themselves do not look dangerous at first glance.
The extra layer of protection works on the Firebase Cloud Messaging side, through which sites can deliver notifications. The system takes into account the volume of messages, the time that users spend on the site, the frequency of resolution requests and the overall level of interaction with the resource. For offenders, there is a limit of 1000 messages per minute, and when the limit is exceeded, the server responds with the HTTP 429 code.
With repeated violations, the restrictions become tougher. Limits return to normal values only after the period of normal operation of the site. According to Google, such a mechanism makes mass campaigns much more expensive and prevents attackers from quickly sending out a huge number of messages.
The company also changed the process of issuing permits on Android. The new interface allows the user to decide whether they want to receive notifications without interrupting the work with the site with an intrusive request. Earlier, Chrome added to Android the ability to refuse notifications of a particular resource with one click.
Google believes that a combination of several mechanisms helps to combat fraudulent notifications through which attackers distribute malicious programs, lure personal data and try to get money. At the same time, excess background activity is reduced, which reduces the load on the device and battery consumption.
The user can still check the permissions on their own. In the desktop version of Chrome, notification settings are in the privacy and security section, and on Android access to them opens through the browser settings menu. Google advises periodically viewing the list of sites with permission to send notifications and delete unnecessary.
