4 ms·
I'm guessing that the NSA website uses recaptcha, which is served by Google. Perhaps in order to comply with strict origin policy, they want everything on nsa.g
by orisho 7y ago
I'm guessing that the NSA website uses recaptcha, which is served by Google. Perhaps in order to comply with strict origin policy, they want everything on nsa.gov to be served from their domain. They seem to have a reverse proxy that proxies requests to google.com.
That's one plausible explanation, but in any case, even if my explanation is wrong, I doubt the explanation is interesting.
- dessant 7y agoIf that's the case, they are being sloppy, considering that everything under www.google.com is proxied through their servers, not just specific reCAPTCHA assets. Gmail by NSA: https://captcha.nsa.gov/intl/us/gmail/about/ https://captcha.nsa.gov/intl/us/gmail/about/ They're inheriting a considerable part of Google's attack surface. For example, Google's open redirects could be used to bypass origin checks as part of an attack on nsa.gov, or to phish NSA employees.
- itcmcgrath 7y agoMy favorite so far: https://captcha.nsa.gov/logos/2019/loteria/rc2/loteria19.html?hl=en https://captcha.nsa.gov/logos/2019/loteria/rc2/loteria19.htm...
- bjornsing 7y agoFor me (in Sweden) that URL seems to just redirect to https://www.nsa.gov/?hl=en https://www.nsa.gov/?hl=en ...
- TimWolla 7y agoThey appear to have change something in the past few minutes. When I first opened this HN thread it showed me Google's homepage. Now I'm also seeing that redirect.
- dessant 7y agoNSA has just shut down the proxy. The link was a Google Doodles game.
- lkbm 7y agoYou can just replace captcha.nsa.gov with www.google.com to see what it used to serve up: https://www.google.com/logos/2019/loteria/rc2/loteria19.html?hl=en https://www.google.com/logos/2019/loteria/rc2/loteria19.html...
- Apofis 7y agoSomebody possibly got a written up for this.
- winternett 7y agoNBD... Just a quick test in PROD.... ಠ_ಠ
- bigiain 7y ago"No no, we just put it out to 'the public', that's BETA, not PROD..." -- some startup guy at the NSA...
- dessant 7y agoYou were right: https://twitter.com/NSAGov/status/1224456957622472706 https://twitter.com/NSAGov/status/1224456957622472706