{"action":"created","issue":{"url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/issues/2316","repository_url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows","labels_url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/issues/2316/labels{/name}","comments_url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/issues/2316/comments","events_url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/issues/2316/events","html_url":"https://github.com/AdguardTeam/AdguardForWindows/issues/2316","id":355228723,"node_id":"MDU6SXNzdWUzNTUyMjg3MjM=","number":2316,"title":"Use a privacy-friendly protocol for the parental control web service","user":{"login":"ameshkov","id":5947035,"node_id":"MDQ6VXNlcjU5NDcwMzU=","avatar_url":"https://avatars0.githubusercontent.com/u/5947035?v=4","gravatar_id":"","url":"https://api.github.com/users/ameshkov","html_url":"https://github.com/ameshkov","followers_url":"https://api.github.com/users/ameshkov/followers","following_url":"https://api.github.com/users/ameshkov/following{/other_user}","gists_url":"https://api.github.com/users/ameshkov/gists{/gist_id}","starred_url":"https://api.github.com/users/ameshkov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ameshkov/subscriptions","organizations_url":"https://api.github.com/users/ameshkov/orgs","repos_url":"https://api.github.com/users/ameshkov/repos","events_url":"https://api.github.com/users/ameshkov/events{/privacy}","received_events_url":"https://api.github.com/users/ameshkov/received_events","type":"User","site_admin":false},"labels":[{"id":608152465,"node_id":"MDU6TGFiZWw2MDgxNTI0NjU=","url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/labels/P2:%20High","name":"P2: High","color":"d93f0b","default":false},{"id":237952325,"node_id":"MDU6TGFiZWwyMzc5NTIzMjU=","url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"northis","id":20269126,"node_id":"MDQ6VXNlcjIwMjY5MTI2","avatar_url":"https://avatars0.githubusercontent.com/u/20269126?v=4","gravatar_id":"","url":"https://api.github.com/users/northis","html_url":"https://github.com/northis","followers_url":"https://api.github.com/users/northis/followers","following_url":"https://api.github.com/users/northis/following{/other_user}","gists_url":"https://api.github.com/users/northis/gists{/gist_id}","starred_url":"https://api.github.com/users/northis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/northis/subscriptions","organizations_url":"https://api.github.com/users/northis/orgs","repos_url":"https://api.github.com/users/northis/repos","events_url":"https://api.github.com/users/northis/events{/privacy}","received_events_url":"https://api.github.com/users/northis/received_events","type":"User","site_admin":false},"assignees":[{"login":"northis","id":20269126,"node_id":"MDQ6VXNlcjIwMjY5MTI2","avatar_url":"https://avatars0.githubusercontent.com/u/20269126?v=4","gravatar_id":"","url":"https://api.github.com/users/northis","html_url":"https://github.com/northis","followers_url":"https://api.github.com/users/northis/followers","following_url":"https://api.github.com/users/northis/following{/other_user}","gists_url":"https://api.github.com/users/northis/gists{/gist_id}","starred_url":"https://api.github.com/users/northis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/northis/subscriptions","organizations_url":"https://api.github.com/users/northis/orgs","repos_url":"https://api.github.com/users/northis/repos","events_url":"https://api.github.com/users/northis/events{/privacy}","received_events_url":"https://api.github.com/users/northis/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/milestones/12","html_url":"https://github.com/AdguardTeam/AdguardForWindows/milestone/12","labels_url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/milestones/12/labels","id":3474823,"node_id":"MDk6TWlsZXN0b25lMzQ3NDgyMw==","number":12,"title":"6.4","description":null,"creator":{"login":"vozersky","id":17472907,"node_id":"MDQ6VXNlcjE3NDcyOTA3","avatar_url":"https://avatars1.githubusercontent.com/u/17472907?v=4","gravatar_id":"","url":"https://api.github.com/users/vozersky","html_url":"https://github.com/vozersky","followers_url":"https://api.github.com/users/vozersky/followers","following_url":"https://api.github.com/users/vozersky/following{/other_user}","gists_url":"https://api.github.com/users/vozersky/gists{/gist_id}","starred_url":"https://api.github.com/users/vozersky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vozersky/subscriptions","organizations_url":"https://api.github.com/users/vozersky/orgs","repos_url":"https://api.github.com/users/vozersky/repos","events_url":"https://api.github.com/users/vozersky/events{/privacy}","received_events_url":"https://api.github.com/users/vozersky/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":10,"state":"open","created_at":"2018-07-05T07:16:06Z","updated_at":"2018-09-06T16:09:00Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2018-08-29T16:00:25Z","updated_at":"2018-09-10T11:48:33Z","closed_at":null,"author_association":"MEMBER","body":"The current approach is to make a request to the parental control web service whenever we need to check if the domain is blocked or not as an adult site. The problem with this approach is that we're passing the domain name to this web service, therefore we can learn what domain is visited.\r\n\r\nWe should use a privacy-friendly approach just like what we use for the browsing security web service checks. The idea is to send prefixes of one-way hashes of the domain name significant parts. Therefore, users will be sure that we don't see the real domain name.\r\n\r\n### Checking example.domain.com\r\n\r\n##### Definitions\r\n\r\n```\r\nPCTRL_REASON = GOOD_SITE | RATING_NOT_FOUND | CATEGORY_BLACKLISTED | NEGATIVE_CATEGORY\r\nPCTRL_SENSITIVITY =  3 | 10 | 13 | 17  // EARLY_CHILDHOOD / YOUNG / TEEN / MATURE\r\n```\r\n\r\n\r\n1. Extract the most significant parts of that host (in fact just extract subdomains and concatenate with '/') AND the IP address.\r\n\r\n    ```\r\n    example.domain.com/\r\n    domain.com/\r\n    192.168.0.1/\r\n    ```\r\n\r\n2. Calculate SHA256 hashes for each part:\r\n\r\n    ```\r\n    example.domain.com/   ->   6372934A1C222E79F9C6B60833C24C0CBF63FFF53BF2C8CDC874C4F3BEFE2B3A\r\n    domain.com/           ->   C9529394138C895A50E70E537673B48A7BA0ED6D7BDC2CFC0BB205AA3B7BEDBE\r\n    192.168.0.1/           ->  719AEECD10F94270B6D21C837150D8DCA8BD7D55C8065AD40094052165DECC38\r\n    ```\r\n\r\n3. Extract hashes prefixes (substring length=8)\r\n\r\n    ```\r\n    example.domain.com/    ->    6372934A\r\n    domain.com/                  ->     C9529394\r\n    192.168.0.1/                   ->    719AEECD\r\n    ```\r\n\r\n4. Send these prefixes to the backend server (separate with \"/\")\r\n\r\n    ```\r\n    curl -X GET '/check-parental-control-hash?prefixes=A379A6F6&sensitivity=PCTRL_SENSITIVITY'\r\n    ```\r\n\r\n    The response will be either `204 No Content` (if none of these prefixes are found) or a list of full hashes matching any of the specified prefixes:\r\n\r\n    ```\r\n    [{\r\n      \"blocked\": false|true,\r\n      \"reason\": PCTRL_REASON,\r\n      \"clientTtl\": 86400000,\r\n      \"hash\": \"A379A6F6EEAFB9A55E378C118034E2751E682FAB9F2D30AB13D2125586CE1947\"\r\n    },\r\n    ...\r\n    ]\r\n```\r\n\r\n5. Check if any of the returned full hashes match any of your hashes."},"comment":{"url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/issues/comments/419885350","html_url":"https://github.com/AdguardTeam/AdguardForWindows/issues/2316#issuecomment-419885350","issue_url":"https://api.github.com/repos/AdguardTeam/AdguardForWindows/issues/2316","id":419885350,"node_id":"MDEyOklzc3VlQ29tbWVudDQxOTg4NTM1MA==","user":{"login":"northis","id":20269126,"node_id":"MDQ6VXNlcjIwMjY5MTI2","avatar_url":"https://avatars0.githubusercontent.com/u/20269126?v=4","gravatar_id":"","url":"https://api.github.com/users/northis","html_url":"https://github.com/northis","followers_url":"https://api.github.com/users/northis/followers","following_url":"https://api.github.com/users/northis/following{/other_user}","gists_url":"https://api.github.com/users/northis/gists{/gist_id}","starred_url":"https://api.github.com/users/northis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/northis/subscriptions","organizations_url":"https://api.github.com/users/northis/orgs","repos_url":"https://api.github.com/users/northis/repos","events_url":"https://api.github.com/users/northis/events{/privacy}","received_events_url":"https://api.github.com/users/northis/received_events","type":"User","site_admin":false},"created_at":"2018-09-10T11:48:33Z","updated_at":"2018-09-10T11:48:33Z","author_association":"NONE","body":"Resloved in `adguard-windows/pull-requests/197`\r\n\r\n**How to test**\r\n1. Ensure, that the parent control & safebrowsing works fine.\r\n2. Ensure, that no domain name is transmitted via network, use wireshark to check.\r\n\r\n**Example**\r\n_Right request:_\r\n```\r\nGET /check-parental-control-hash?prefixes=F451A0CE/9EB1BEA9&sensitivity=10 HTTP/1.1\r\nHost: pctrl.adguard.com\r\n```\r\n_Wrong request_\r\n```\r\nGET /check-parental-control?domain=pornhub.com&sensitivity=10 HTTP/1.1\r\nHost: pctrl.adguard.com\r\n```"}}
{"actor":{"display_login":"northis"}}