I observed this with amused, scornful yet despondent cynicism when it rolled out for me a couple of months ago. (I'm in AU.) It doesn't work. At all. (TL;DR cl

I observed this with amused, scornful yet despondent cynicism when it rolled out for me a couple of months ago. (I'm in AU.) It doesn't work. At all. (TL;DR click the links at the bottom, or keep reading and be prepared to reattach your jaw.) In an age of technical illiteracy from both young people and old, Google has made phishing campaigns a million times easier. I have no contacts inside Google, but I would (still) put decent money on the chances being 1000% that a very large security stink was raised about this internally... to apparently no avail. So I'm fascinated to see where this goes, security debacle, bathwater and all. YouTube universally shows "https://www.youtube.com https://www.youtube.com › watch". This site consists entirely of the One True Path™ "https://news.ycombinator.com https://news.ycombinator.com › item". Google Books, similarly, stocks hundreds of millions of one particular title, "https://books.google.com https://books.google.com › books". GitHub often shows up as "https://github.com https://github.com › ..." or "https://github.com https://github.com › projectname" (yes, I'm not kidding, the repo author is elided from the URL). Looking forward to seeing how spammers take advantage of this. Best of all was the one time I clicked something that _downloaded a file_ (it had Content-Disposition: attachment set). Oh, because it was an .mbox file; that makes sense... except the filename and extension were completely elided from the URL, so the random download was quite the violation of the principle of least surprise. Shortly after the file download event, I decided to get in touch with Google to politely sort of go "what gives" in case anything interesting or insightful came of the resulting conversation. The Product Forums is basically "cat /dev/pitchforks > /dev/null" so I didn't want to get stampeded to death in there, and the various feedback options on the site feel like a surreal merging of /dev/urandom and /dev/zero so I was distinctly uncertain about pursuing those options either. So I decided to try https://issuetracker.google.com/ https://issuetracker.google.com/. Well, I can report that this little-known corner of Google, mostly used to track Android issues, is very topically focused and simply doesn't have the forwarding infrastructure (ahem, or policy) to handle anything else. At least the human at the other end was nice about it. I took a screenshot of the thread I created (which only I can view), and put it up at https://imgur.com/a/K443Tkp https://imgur.com/a/K443Tkp. While writing this post, I also decided to properly memorialize this insanity and added screenshots of all the examples in the bugreport to the above album. (Besides the small screenshot of LWN, all were taken today.) Since PNGs aren't very clipboard-friendly, here's a copy-paste (expires: never) of my submission: https://pastebin.com/ksBEEG91 https://pastebin.com/ksBEEG91 NB. Don't thrash against the New Way. It ensures your job security as a security consultant. And earmarks you as Elite, And To Be Watched Out For, or something. I don't know. (Oh, and I took all the screenshots using super-sized Xvnc. Chrome's devtools' full-page screenshot function doesn't work at all with the issue tracker UI.) (And I don't live anywhere near Hurstville. May GeoIP forever remain hand-wavily inaccurate!)