I think if google (verified with ssl cert etc) is asking for my password, there was a certain expectation there, but you're right, I should be less trusting ;)

I think if google (verified with ssl cert etc) is asking for my password, there was a certain expectation there, but you're right, I should be less trusting ;) Here is the demonstration url from the report https://accounts.google.com/ServiceLogin?service=mail&continue=https://www.google.com/amp/yahoo.com#identifier https://accounts.google.com/ServiceLogin?service=mail&contin... My point isn't about 'open redirects' not being a security issue, it's that the report should be valid because it's a whitelist bypass. continue=yahoo.com is blocked but continue=https://www.google.com/amp/yahoo.com https://www.google.com/amp/yahoo.com is not blocked. both do the same thing as far as the end user is concerned.