XSS attacks on Googlebot allow search index manipulation

Re:XSS attacks on Googlebot allow search index manipulation by coldcode on Friday July 19, 2019 @07:43AM (#20477783)

No fix citing "internal communication difficulties", perhaps Google could use, I don't know, some kind of tool. I too work for a huge company, and oddly enough we also have communications difficulties sometimes despite all of our tools. But we not a technology company, seems like a Google should be better at this.

[ Parent | on HN ]

Re:XSS attacks on Googlebot allow search index manipulation by the_duke on Friday July 19, 2019 @08:27AM (#20478016)

"internal communication difficulties" does not mean "I can't talk to the person", it means political infighting or the responsible team doesn't care/see it as a problem.

[ Parent | on HN ]

Re:XSS attacks on Googlebot allow search index manipulation by AJ007 on Friday July 19, 2019 @08:28AM (#20478026)

There is probably a long winded explanation somewhere how this is actually a feature and not an exploit.

[ Parent | on HN ]

Re:XSS attacks on Googlebot allow search index manipulation by chrismorgan on Friday July 19, 2019 @08:41AM (#20478120)

Well, how are you going to fix it without removing important features like submitting pages to the index? There are no perfect XSS auditors; you can fairly consistently work around Chrome’s, which is why they’re giving up on it now.

I don’t see any realistic solution to this problem.

[ Parent | on HN ]

Re:XSS attacks on Googlebot allow search index manipulation by londons_explore on Friday July 19, 2019 @09:02AM (#20478270)

I can imagine the search teams response now...

"If your site has an XSS, then anyone can make any content appear on that domain... So why's it so bad if anyone can also make anything appear on the domain in Google Search? - we're just reflecting reality.

Next you guys will report that you wrote a comment in hackernews and that appeared on google search too!"

[ Parent | on HN ]

Re:XSS attacks on Googlebot allow search index manipulation by eadmund on Friday July 19, 2019 @08:47AM (#20478163)

> No fix citing "internal communication difficulties", perhaps Google could use, I don't know, some kind of tool.

That's the problem: half the team was using Google Hangouts, the other half of the team were using Google Meet, and three random guys are using Allo.

[ Parent | on HN ]

Re:XSS attacks on Googlebot allow search index manipulation by cbsks on Friday July 19, 2019 @01:10PM (#20480503)

Don't forget the one stubborn person still using Wave

[ Parent | on HN ]