My emby server has been flagged as a Deceptive site.

[nonyhaha 4]

Just an update on my side. After 2 days of being free of deceptive site warnings, my dinamic dns provider - dynu.com - dropped support for all my domains redirects. 

My domain names do not get resolved anymore and i cant reach my server from outside of my home network.

While submitting a ticket with dynu they asked me about the google search console messages about my servers. 

This is awful. 

Is there anyway to find out what is generating the initial issue? I need to stop this because i am using multiple services behind my domain.

[visproduction 315]

Non,

Have you seen this service at dynu?  It looks like it might help.
 https://www.dynu.com/Resources/Tutorials/DynamicDNS/Advancedfeatures/How-To-Set-Up-DNSSEC

 

[nonyhaha 4]

1 minute ago, visproduction said:

Non,

Have you seen this service at dynu?  It looks like it might help.
 https://www.dynu.com/Resources/Tutorials/DynamicDNS/Advancedfeatures/How-To-Set-Up-DNSSEC

 

Ill check that as soon as the maintanence is over at dynu.

[visproduction 315]

 Removed

 

Edited March 26, 2023 by visproduction

[crusher11 1101]

On 3/17/2023 at 7:39 PM, rbjtech said:

Ah ok - so maybe it's a vulnerabilities issue on the sites.  It would be interesting to see what score they get on something like ssllabs/qualys -  https://www.ssllabs.com/ssltest/index.html

edit ..

maybe emby.media wanna try to improve things as well while they are looking (capped to B as they still support TLS 1.0/1.1) .. 

I haven't had the flagged-as-deceptive issue but I just ran this on my server and got the same result, is there anything I can do about it?

[nonyhaha 4]

54 minutes ago, visproduction said:

Non,

Have you seen this service at dynu?  It looks like it might help.
 https://www.dynu.com/Resources/Tutorials/DynamicDNS/Advancedfeatures/How-To-Set-Up-DNSSEC

 

I managed to buy a member account this morning, but I do not have the dnssec option available yet. 

I will wait until tomorrow morning to see if it will appear, otherwise ill submit another ticket

[pwhodges 2012]

30 minutes ago, crusher11 said:

I haven't had the flagged-as-deceptive issue but I just ran this on my server and got the same result, is there anything I can do about it?

See what's keeping the result down to B and use reverse proxy settings to change it (e.g. forbidding TLS1.0/1.1).  If you're using Emby's SSL without a reverse proxy, then it's down to Emby to change (I don't know if they need to, though).

Paul

[crusher11 1101]

1 minute ago, pwhodges said:

See what's keeping the result down to B and use reverse proxy settings to change it (e.g. forbidding TLS1.0/1.1).  If you're using Emby's SSL without a reverse proxy, then it's down to Emby to change (I don't know if they need to, though).

Paul

Like I said, it's exactly the same result: B due to TLS.

So it's an NGINX setting somewhere? 

[pwhodges 2012]

Sure to be - but I use Caddy

https://ixnfo.com/en/how-to-disable-tls-1-0-and-tls-1-1-in-nginx.html

Incidentally, Caddy no longer even allows TLS older than 1.2 to be enabled!  (Though if you sponsor them with enough money you could probably get them to set up a personal fork for you with the code re-included.)

Paul

Edited March 26, 2023 by pwhodges

[crusher11 1101]

1 hour ago, pwhodges said:

Sure to be - but I use Caddy

https://ixnfo.com/en/how-to-disable-tls-1-0-and-tls-1-1-in-nginx.html

Incidentally, Caddy no longer even allows TLS older than 1.2 to be enabled!  (Though if you sponsor them with enough money you could probably get them to set up a personal fork for you with the code re-included.)

Paul

Ironically, I can't see that link because the secure connection failed.

[crusher11 1101]

Well I fixed that up, but now I'm apparently missing a DNS CAA, and I have no idea what to enter for that.

[pwhodges 2012]

That's not essential as far as I can see; but if it affects your score, then why not?  You can add a CAA record to your DNS entries, which specifies what certificate authority is allowed to issue your certificates, and thus prevents any other CA from issuing one; I have one which says my certificates only come from LetsEncrypt.com |(but I don't remember specifying it - maybe I did it to get my score up! Ah, well...).

Paul

https://letsencrypt.org/docs/caa/

Edited March 26, 2023 by pwhodges

[crusher11 1101]

30 minutes ago, pwhodges said:

That's not essential as far as I can see; but if it affects your score, then why not?  You can add a CAA record to your DNS entries, which specifies what certificate authority is allowed to issue your certificates, and thus prevents any other CA from issuing one; I have one which says my certificates only come from LetsEncrypt.com |(but I don't remember specifying it - maybe I did it to get my score up! Ah, well...).

Paul

https://letsencrypt.org/docs/caa/

My certificate just comes from CloudFlare, though...you'd think they'd handle that themselves. 

[pwhodges 2012]

This record is in your DNS - where is that held?

Paul

[crusher11 1101]

8 hours ago, pwhodges said:

This record is in your DNS - where is that held?

Paul

I know how to add a CAA in CloudFlare, I just don't know what to enter into the fields.

[pwhodges 2012]

I'm sure that CloudFlare will document that (as LetsEncrypt do in the link I gave).

Obviously it needs to be correct, or certificate renewal will fail.

Paul

[crusher11 1101]

CloudFlare implies it's done, but hidden: https://developers.cloudflare.com/ssl/edge-certificates/custom-certificates/caa-records#caa-records-added-by-cloudflare

But I have no idea how to run that dig thing, and that testing site is flagging it as an issue.

[cypher0117 4]

Not having your DNA CAA specified doesn't appear to affect the score of the SSL test.  Mines not specified, but I get an A+ from that SSL test link.

[TheKamakaZi 15]

So I've done the boring thing and read through Google's definitions of deceptive sites, recommendations, etc, and I believe I may have figured out the crux of the issue.

They think we're all imitating Emby!
Well, emby.media, or app.emby.media, but you get my point.

There's no concrete evidence of this, but simply looking at the examples, it seems that all our instances share strings, images (logos), and login patterns. As Emby has become an established entity in media streaming, it seems natural for those of lesser moral fibre to imitate its looks and logins in an effort to gain access.

@Luke@pir8radioWould it be at all possible to customise the look and feel of the UI, even as a once off test to see if this satisfies the Google god?

Edited April 8, 2023 by TheKamakaZi

[AmIBeingObtuse 3]

On 24/03/2023 at 17:12, Luke said:

I think what we'll do is just remove those from the built-in web app.

Will these changes occur in a beta? How fast will this be implemented. Thanks for the response to all this.

 

@Luke

Edited April 11, 2023 by AmIBeingObtuse
Tagged admin

[Luke 42077]

1 hour ago, AmIBeingObtuse said:

Will these changes occur in a beta? How fast will this be implemented. Thanks for the response to all this.

 

@Luke

HI, yes this should be in soon. Thanks.

[zepx 1]

@Luke

Is there any update on this issue?

[Luke 42077]

7 minutes ago, zepx said:

@Luke

Is there any update on this issue?

The beta server has removed a number of things from the web app html that might have caused this. If you've already been flagged then you'll have to go through the process with google as mentioned above to get unflagged. Hopefully the changes will help prevent it from happening again.

[indianaguy 2]

My domains also been flagged. Not sure if this is what could be causing recent peoples connection problems or what?

One user couldnt get connect to work so i gave them direct ip. worked for  a day they went back to device and was logged out. They tried connecting again just to get a error:1408f10b:SSL routines:SSL3_get_record:wrong version number .  Not sure if thats related to any of this stuff going on or not but everybody else seems to be connecting fine.

 

 

Edited April 22, 2023 by indianaguy

[Luke 42077]

59 minutes ago, indianaguy said:

My domains also been flagged. Not sure if this is what could be causing recent peoples connection problems or what?

One user couldnt get connect to work so i gave them direct ip. worked for  a day they went back to device and was logged out. They tried connecting again just to get a error:1408f10b:SSL routines:SSL3_get_record:wrong version number .  Not sure if thats related to any of this stuff going on or not but everybody else seems to be connecting fine.

 

 

Hi, no, not related. The topic in this thread is related to using the built-in web app.