4 ms·
If that's the case, they are being sloppy, considering that everything under www.google.com is proxied through their servers, not just specific reCAPTCHA assets
by dessant 7y ago
If that's the case, they are being sloppy, considering that everything under www.google.com is proxied through their servers, not just specific reCAPTCHA assets.
Gmail by NSA: https://captcha.nsa.gov/intl/us/gmail/about/ https://captcha.nsa.gov/intl/us/gmail/about/
They're inheriting a considerable part of Google's attack surface. For example, Google's open redirects could be used to bypass origin checks as part of an attack on nsa.gov, or to phish NSA employees.
- itcmcgrath 7y agoMy favorite so far: https://captcha.nsa.gov/logos/2019/loteria/rc2/loteria19.html?hl=en https://captcha.nsa.gov/logos/2019/loteria/rc2/loteria19.htm...
- bjornsing 7y agoFor me (in Sweden) that URL seems to just redirect to https://www.nsa.gov/?hl=en https://www.nsa.gov/?hl=en ...
- TimWolla 7y agoThey appear to have change something in the past few minutes. When I first opened this HN thread it showed me Google's homepage. Now I'm also seeing that redirect.
- dessant 7y agoNSA has just shut down the proxy. The link was a Google Doodles game.
- lkbm 7y agoYou can just replace captcha.nsa.gov with www.google.com to see what it used to serve up: https://www.google.com/logos/2019/loteria/rc2/loteria19.html?hl=en https://www.google.com/logos/2019/loteria/rc2/loteria19.html...
- Apofis 7y agoSomebody possibly got a written up for this.
- winternett 7y agoNBD... Just a quick test in PROD.... ಠ_ಠ
- bigiain 7y ago"No no, we just put it out to 'the public', that's BETA, not PROD..." -- some startup guy at the NSA...