<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>Matt_Cutts</author><text>Hi there, allow me to correct this misconception. I&apos;ve debunked that idea often enough that I wrote a blog post about this four years ago: &lt;a href=&quot;http://www.mattcutts.com/blog/toolbar-indexing-debunk-post/&quot; rel=&quot;nofollow&quot;&gt;http://www.mattcutts.com/blog/toolbar-indexing-debunk-post/&lt;/a&gt; I wrote an earlier debunk post in 2006 too: &lt;a href=&quot;http://www.mattcutts.com/blog/debunking-toolbar-doesnt-lead-to-page-being-indexed/&quot; rel=&quot;nofollow&quot;&gt;http://www.mattcutts.com/blog/debunking-toolbar-doesnt-lead-...&lt;/a&gt;&lt;p&gt;I noticed a new twist in your post though: you&apos;re saying that because of Safe Browsing (which checks for e.g. malware as users surf the web), those urls are sent to Google. The way that Chrome and Firefox actually do Safe Browsing is that they download an encrypted blob which allows the browser to do a lookup for dangerous urls on the client side--not by sending any urls to Google. I believe that if there&apos;s a match in the client-side encrypted table, only then does the browser send the now-suspect url to Google for checking.&lt;p&gt;Here&apos;s more info: &lt;a href=&quot;https://developers.google.com/safe-browsing/&quot; rel=&quot;nofollow&quot;&gt;https://developers.google.com/safe-browsing/&lt;/a&gt; I believe the correct mental model of the Safe Browsing API in browsers is &quot;Download a hash table of believed-to-be-dangerous urls. As you surf, check against that local hash table. If you find a match/collision, then the user might be about to land on a bad url, so check for more info at that point.&quot;&lt;p&gt;Hope that helps. Further down in the discussion, someone posted this helpful link with more explanation: &lt;a href=&quot;http://blog.alexyakunin.com/2010/03/nice-bloom-filter-application.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.alexyakunin.com/2010/03/nice-bloom-filter-applic...&lt;/a&gt;</text><parent_chain><item><author>lazyjones</author><text>The URLs don&apos;t need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don&apos;t know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren&apos;t published or linked anywhere.</text></item><item><author>mkjones</author><text>My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.&lt;p&gt;For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).&lt;p&gt;As jpadvo surmised, the nonces expire after a period of time.  They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who&apos;s logging in. Regardless, due to some of these links being disclosed, we&apos;ve turned the feature off until we can better ensure its security for users whose email contents are publicly visible.  We are also securing the accounts of anyone who recently logged in through this flow.&lt;p&gt;In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: &lt;a href=&quot;https://www.facebook.com/whitehat&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/whitehat&lt;/a&gt;.  That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you&apos;ve found.</text></item></parent_chain></comment><story><title>More than 1MM Facebook accounts exposed </title><url>https://www.google.com/search?q=bcode%3D&amp;oq=bcode%3D&amp;sugexp=chrome,mod=0&amp;sourceid=chrome&amp;ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&amp;hl=en&amp;safe=off&amp;prmd=imvns&amp;filter=0&amp;bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&amp;fp=8c0bb27d33614e56&amp;bpcl=37189454&amp;biw=1560&amp;bih=698</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>mkjones</author><text>I&apos;m not sure either, but I doubt that Chrome or any of the badware-stopping features that are built in to it cause the URLs they&apos;re checking to be indexed.  I&apos;d be even more surprised if Firefox did this.&lt;p&gt;If you&apos;ve got the toolbar installed though, I&apos;d be less surprised if they tried crawling or indexing URLs you go to.&lt;p&gt;EDIT: It looks like they&apos;ve explicitly said the toolbar does &lt;i&gt;not&lt;/i&gt; cause things to appear in search results: &lt;a href=&quot;http://www.seroundtable.com/google-toolbar-indexing-12894.html&quot; rel=&quot;nofollow&quot;&gt;http://www.seroundtable.com/google-toolbar-indexing-12894.ht...&lt;/a&gt;.</text><parent_chain><item><author>lazyjones</author><text>The URLs don&apos;t need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don&apos;t know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren&apos;t published or linked anywhere.</text></item><item><author>mkjones</author><text>My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.&lt;p&gt;For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).&lt;p&gt;As jpadvo surmised, the nonces expire after a period of time.  They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who&apos;s logging in. Regardless, due to some of these links being disclosed, we&apos;ve turned the feature off until we can better ensure its security for users whose email contents are publicly visible.  We are also securing the accounts of anyone who recently logged in through this flow.&lt;p&gt;In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: &lt;a href=&quot;https://www.facebook.com/whitehat&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/whitehat&lt;/a&gt;.  That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you&apos;ve found.</text></item></parent_chain></comment><story><title>More than 1MM Facebook accounts exposed </title><url>https://www.google.com/search?q=bcode%3D&amp;oq=bcode%3D&amp;sugexp=chrome,mod=0&amp;sourceid=chrome&amp;ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&amp;hl=en&amp;safe=off&amp;prmd=imvns&amp;filter=0&amp;bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&amp;fp=8c0bb27d33614e56&amp;bpcl=37189454&amp;biw=1560&amp;bih=698</url></story>