“Magic links” can end up in Bing search results, rendering them useless

Re:“Magic links” can end up in Bing search results, renderin... by excalibur on Monday June 27, 2022 @07:23PM (#31902234)

It is in fact possible to extract a destination URL from a Safelink one without clicking it. For the full link this can be tedious, but identifying the domain can still be done quickly.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by hyperman1 on Tuesday June 28, 2022 @10:56AM (#31908529)

For normal URLs, I agree. But in this case you have adversarial urls. Suppose the scammer puts some http and www.google.com in the url parameters, after some randomly generated 8 characters dot someobscuretld site.

I don't trust myself enough to be 100% sure I can decode an URLencoded misleading mess perfectly all the time.

They already hid urls in the username of the url, like www.google.com.unholymessherethatscrollsoutoftheurlbar @ malignantdomainnotgoogle.blah

[ Parent | on HN ]