Proton.B: What this Mac malware does

Re:Proton.B: What this Mac malware does by whatgoodisaroad on Saturday May 13, 2017 @08:54PM (#14333714)

The response from script.google.com is a 302 redirect to script.googleusercontent.com. IOW, google.com itself does not serve that user content.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by snowwrestler on Saturday May 13, 2017 @09:53PM (#14333833)

But why does Google redirect that? Why not just return an error?

It's not like users will accidentally type in script.google.com and get mad if it fails. Those script URLs are being used only by app developers, who will test their apps and fix script source URLs that are broken. Calling a googleusercontent script at google.com should return a 4xx status code telling them to use the googleusercontent domain.

Google.com is a trusted domain. I don't think it should be 302'ing to untrusted domains for arbitrary URLs.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by ryanlol on Saturday May 13, 2017 @09:57PM (#14333843)

>Google.com is a trusted domain. I don't think it should be 302'ing to untrusted domains for arbitrary URLs.

I think you should read this again and then take a moment to think about the services people primarily visit google.com for.

Also, what exactly are "trusted domains"? Why do they matter to users clicking links?

On a website there's no way for an user to verify where a link is going to take them without actually clicking the link. The tooltip for example tends to be relatively easy to spoof.

[ Parent | on HN ]