4 ms·
I lack the patience to create a video (kudos!), but I'm still not seeing how this is any more of a vulnerability than just sending someone to that page in the f
by pwinnski 10y ago
I lack the patience to create a video (kudos!), but I'm still not seeing how this is any more of a vulnerability than just sending someone to that page in the first place? It's not on a google.com URL, which seems immediately obviously to me.
It might help that I always enter my password via command-\, never typing it. So even if I was really not paying any attention, and didn't realize the domain had completely changed, and that my username had disappeared (which still seems unlikely), command-\ wouldn't fill in my credentials, because it's not google.com.
That last page is phishing, for sure. And it's going to fool some number of people, for sure. I'm struggling to think of how that's something Google should do something about though.
- kuschku 10y agoGoogle obviously thinks it shouldn’t happen – that’s why they have a whitelist in the first place. This is just a simple whitelist bypass. But the issue is: How do you check the page you are on is the correct one? You might check everything the first time, but after that?