3 ms·

I can appreciate their stance on phishing but being able to automatically execute an arbitrary file download that appears to come from Google as part of the log

I can appreciate their stance on phishing but being able to automatically execute an arbitrary file download that appears to come from Google as part of the login process strikes me as a bad thing, no?

rezashirazian 10y ago
It is. It also seems like an easy fix, I'm surprised why this hasn't been done yet.
- quickben 10y ago
  Probably corporate inertia and big testing/deployment pipeline, etc.
- innoying 10y ago
  It's not an "easy fix", there could be (and probably are) thousands of different endpoints that can be redirected to after login, whitelisting all of those just doesn't make sense.
  - rezashirazian 10y ago
    That sounds tedious, not necessarily difficult. I wonder if there is a technical challenge that goes beyond the tedious work of going through possible redirects and whitelisting them
cbsmith 10y ago
To get that exploit you'd need to send a faulty URL and get the user to follow it. You could just as easily do that with a faulty URL and no Google login. The only risk is if the redirect can access your login session/credentials. If it can't, no exploit.
- _asummers 10y ago
  The Google login wraps the whole flow in a trojan horse, though. Users are taught to trust the single sign ons from FB/Google, and they're also taught to check the URL. Both of those would be false senses of security in this case. In isolation, this isn't necessarily a security vulnerability. But that it breaks down when users do what they're supposed to do? That's bad.
  - cbsmith 10y ago
    The logo and the host portion of the URL are ensuring that my credentials are going to Google, and not anyone else. The rest of the URL is telling me I shouldn't trust where I'm going. ;-)
im4w1l 10y ago
> automatically execute an arbitrary file download Your phrasing could easily be misread. A downloaded program would not automatically run.
- euyyn 10y ago
  And in modern browsers/OS not even after you click on them, until you clear a "yes, I know this is risky" dialog.
- PuffinBlue 10y ago
  Replace execute with 'initiate'?

rezashirazian 10y ago

It is. It also seems like an easy fix, I'm surprised why this hasn't been done yet.

quickben 10y ago
Probably corporate inertia and big testing/deployment pipeline, etc.
innoying 10y ago
It's not an "easy fix", there could be (and probably are) thousands of different endpoints that can be redirected to after login, whitelisting all of those just doesn't make sense.
- rezashirazian 10y ago
  That sounds tedious, not necessarily difficult. I wonder if there is a technical challenge that goes beyond the tedious work of going through possible redirects and whitelisting them

cbsmith 10y ago

To get that exploit you'd need to send a faulty URL and get the user to follow it. You could just as easily do that with a faulty URL and no Google login. The only risk is if the redirect can access your login session/credentials. If it can't, no exploit.

_asummers 10y ago
The Google login wraps the whole flow in a trojan horse, though. Users are taught to trust the single sign ons from FB/Google, and they're also taught to check the URL. Both of those would be false senses of security in this case. In isolation, this isn't necessarily a security vulnerability. But that it breaks down when users do what they're supposed to do? That's bad.
- cbsmith 10y ago
  The logo and the host portion of the URL are ensuring that my credentials are going to Google, and not anyone else. The rest of the URL is telling me I shouldn't trust where I'm going. ;-)

im4w1l 10y ago

> automatically execute an arbitrary file download Your phrasing could easily be misread. A downloaded program would not automatically run.

euyyn 10y ago
And in modern browsers/OS not even after you click on them, until you clear a "yes, I know this is risky" dialog.
PuffinBlue 10y ago
Replace execute with 'initiate'?