Re:Google's login page accepts a vulnerable GET parameter
by ebbv on Tuesday August 30, 2016 @10:34PM
(#12395580)
That's a weak excuse for this horrible security hole.
Google is facilitating phishing with this terrible behavior. It means that someone trying to phish a Google user can send someone to a totally valid google.com URL and it will still result in their credentials being stolen. That's the #1 thing that you teach non-technical people to avoid phishing; "Make sure the site you're on is the one you think you're logging into."
Because Google has chosen to be sloppy and dumb that simple instruction is not enough to protect people.
Google is 100% wrong here. This is a blatant hole and just a lazy, sloppy stupid, way too broad whitelist.
Google is facilitating phishing with this terrible behavior. It means that someone trying to phish a Google user can send someone to a totally valid google.com URL and it will still result in their credentials being stolen. That's the #1 thing that you teach non-technical people to avoid phishing; "Make sure the site you're on is the one you think you're logging into."
Because Google has chosen to be sloppy and dumb that simple instruction is not enough to protect people.
Google is 100% wrong here. This is a blatant hole and just a lazy, sloppy stupid, way too broad whitelist.