News for hackers. Stuff that matters.

A comment on Google's login page accepts a vulnerable GET parameter. Parent comment

Re:Google's login page accepts a vulnerable GET parameter by rathish_g on Wednesday August 31, 2016 @12:09AM (#12395960)
> at you damn well expect to be google.

If it's again asking for a password, it must be Google.

[ Parent | on HN ]
Re:Google's login page accepts a vulnerable GET parameter by djsumdog on Wednesday August 31, 2016 @12:50AM (#12396110)
No, that's not true. Think of every time you click on a "sign in with Google" link. If you're not signed in, it will take you to this login page. The redirect will only send back a token, and only for that site.
[ Parent | on HN ]