3 ms·
This is not new. Various 'recognized' websites have redirect urls that are not protected. Once the redirect is complete the site it properly identified. If you
by bcl 17y ago
This is not new. Various 'recognized' websites have redirect urls that are not protected. Once the redirect is complete the site it properly identified.
If you have to be afraid of what links you click on you are running the wrong software.
- MichaelGG 17y agoIt's not about technical exploits, it's about making it eassier to social engineer and phish. For instance, redirecting to a fake youtube login page. Even slightly more savvy users will look at the original link, click it, then click through and follow instructions. Single signon systems that have redirects aren't uncommon, so the user can be used to seeing that sort of behaviour. I'm surprised youtube has such a basic problem on their site.
- jluxenberg 17y agoIsn't this what SSL is for, proving identity? In this case, even a cursory look at the URL would indicate that something was up. Sure, this makes fishing a little easier, but users need to watch out for themselves. It's a big bad world out there :)
- MichaelGG 17y agoYes, but it's not hard to get an SSL cert for some random domain. So user clicks a youtube link, ends up on "centralised-video-authentication.com", sees SSL icon, all good? I agree with you in general, but youtube shouldn't be making things harder for security.
- lsc 17y agoyou need to watch out, certainly, however you should also encourage webapp providers to write secure code.
- bcl 17y agoSSL doesn't prove identity. It just proves that the connection is encrypted. CA's try to add a layer of trust on top of this with their different levels of certification, but that doesn't guarantee identity.
- deno 17y agoBut the real danger is phising. You won't get a virus when you click, but you might trust the website you're redirected to and type in your password.
- bcl 17y agoYou should always check the URL in the browser before entering your secrets.