News for hackers. Stuff that matters.

A comment on Google's login page accepts a vulnerable GET parameter. Parent comment

Re:Google's login page accepts a vulnerable GET parameter by admax88q on Tuesday August 30, 2016 @09:57PM (#12395402)
> at you damn well expect to be google.

That's not really true though. Google serves as an identity provider providing login into 3rd party websites. Plus there's also OAuth prompts when 3rd party services want to use your Google data.

[ Parent | on HN ]
Re:Google's login page accepts a vulnerable GET parameter by rathish_g on Wednesday August 31, 2016 @12:09AM (#12395960)
> at you damn well expect to be google.

If it's again asking for a password, it must be Google.

[ Parent | on HN ]
Re:Google's login page accepts a vulnerable GET parameter by djsumdog on Wednesday August 31, 2016 @12:50AM (#12396110)
No, that's not true. Think of every time you click on a "sign in with Google" link. If you're not signed in, it will take you to this login page. The redirect will only send back a token, and only for that site.
[ Parent | on HN ]