News for hackers. Stuff that matters.

A comment on Spammers Abusing Trust in US .Gov Domains.

Re:Spammers Abusing Trust in US .Gov Domains by Someone1234 on Friday March 18, 2016 @11:09AM (#11312262)
Bit.ly could follow the links, see if they redirect, and if they do then don't flag them as ".gov" if they don't terminate on a ".gov" site.

Ultimately however it would be better to eliminate these insecure redirects because even without bit.ly spammers can use .gov websites to make their link seem more legitimate.

[ Parent | on HN ]
Re:Spammers Abusing Trust in US .Gov Domains by duskwuff on Friday March 18, 2016 @03:55PM (#11314450)
Or a step further: don't use the usa.gov URLs for any link that appears to contain an embedded URL (e.g, contains "http://" or "https://").
[ Parent | on HN ]
Re:Spammers Abusing Trust in US .Gov Domains by Artur_Gaspar on Friday March 18, 2016 @11:40AM (#11312477)
It's not hard to not redirect bit.ly but redirect victims that click the link.

Some .gov sites need the redirect for whatever reason, but they could check the referer.

[ Parent | on HN ]