3 ms·
I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh <insert regular complaint of google am
by julianozen 8y ago
I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh <insert regular complaint of google amp ruining the web>
- londons_explore 8y agoMy bet is on this site being developed by a google security team to try to embarrass other teams around google to get their act together and close flaws like this. The concept of AMP for example should have been built into browsers, perhaps as a new protocol, for example: amp:https://newyorktimes.com https://newyorktimes.com Then the browser can go to any amp-provider to retrieve the amp page, which will be signed by the origin that it came from so the browser can still validate the amp-provider hasn't tampered anything. That model would also let any company be an amp provider with no trust required. The benefit of AMP is much reduced with QUIC zero-rtt resume anyway.
- PaulBGD_ 8y agoOr just `amp://nytimes.com`, would make more sense even if it's being sent over https.