News for hackers. Stuff that matters.

A comment on Google's login page accepts a vulnerable GET parameter. Parent comment

Re:Google's login page accepts a vulnerable GET parameter by woliveirajr on Tuesday August 30, 2016 @10:52PM (#12395662)
Perfect example. Everything that I can see in my cell looks right, including informations from the green padlock, just opening (and understanding! ) the whole URL would make one NOT enter the password.
[ Parent | on HN ]
Re:Google's login page accepts a vulnerable GET parameter by kuschku on Tuesday August 30, 2016 @11:05PM (#12395721)
And that’s the thing, thanks to Let’s Encrypt, the padlock on the fake site also stays, everything looks normal.

If you now also register something like accountsgoogle.com or a similar page, people likely wouldn’t even notice.

This is like it’s made for phishing.

[ Parent | on HN ]