3 ms·
The open redirect on google.com has been known for a while: [1] Google's official policy regarding open redirectors: "Our take on this is that tooltips are not
by andreasley 10y ago
The open redirect on google.com has been known for a while: [1]
Google's official policy regarding open redirectors:
"Our take on this is that tooltips are not a reliable security indicator, and can be tampered with in many ways; so, we invest in technologies to detect and alert users about phishing and abuse, but we generally hold that a small number of properly monitored redirectors offers fairly clear benefits and poses very little practical risk." [2]
[1] http://seclists.org/bugtraq/2016/Apr/70 http://seclists.org/bugtraq/2016/Apr/70
[2] https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op...
- acqq 10y ago> "tooltips are not a reliable security indicator" Translation: "we don't look at that sh.t" > "poses very little practical risk." I'm sure Powell, Podesta and a big part of the world now clearly agree with them. /s Everybody knew t.co/sh.t is somewhere else. www.google.com/whatever/without/query wasn't. Fracking up the established expectations. > "offers fairly clear benefits" Translation "For us. Muahhaha." At least, until something like this. Hopefully.