5 ms·

Yeah this is all nice and good except that's not what the URL is... There's a bunch more after the q parameter: &sa=D&source=editors&ust=169652334

• lern_too_spel 3y ago
  That's a signature, so scammers can't send people trusted google.com links and be redirected to a malware site unless the signature verifies with the timestamp. This was standard practice circa 2005.
  • aftbit 3y ago
    Um, except, they can? As clearly shown in the example link in the GP post: https://www.google.com/url?q=https://example.com/ https://www.google.com/url?q=https://example.com/ Google has had this open redirect forever afaict. I guess they don't consider that a serious threat. I think the better answer is that this is tracking, just like they do on all of the search results, to see which links are most popular. There still might be a malware surveillance use case but that's not the only one.
    • lern_too_spel 3y ago
      If there is a verified signature, it skips the confirmation page. Your link does not. The user has to manually confirm that they want to visit a non-Google URL.
      • thibautg 3y ago
        I'm not seeing a confirmation page, it redirects transparently. So it seems that YMMV.
      • aftbit 3y ago
        Ah my mistake. That would be because I long ago installed "google-no-tracking-url" extension into my Firefox. If I use a clean profile in FF or Chrome, it does indeed show a warning screen.
  • sbarre 3y ago
    Fair enough, TIL. Do you have any details on the signature spec? Is this something anyone can generate or only Google?