3 ms·
He clearly states that security is about raising the bar as high as you can. You can't build a bulletproof system, but you can make systems that are not trivial
by davedx 10y ago
He clearly states that security is about raising the bar as high as you can. You can't build a bulletproof system, but you can make systems that are not trivial to game.
- GeneralMayhem 10y agoRedirecting based on client IP is trivial for anyone with sufficient resources to have put together that ESPN clone in the first place.
- mevile 10y agoFacebook could obviously detect the HTTP redirect.
- zeta0134 10y agoThey can detect that a redirect has happened, but not the logic that determined which destination to display. If a redirect happens no matter what (this is very, very common for advertisement landing pages to track campaign visibility) then the presence of one is not necessarily malicious.