News for hackers. Stuff that matters.
Re:Google AMP – The Newest of Evasive Phishing Tactic by londons_explore on Thursday August 03, 2023 @06:14AM (#36983754)
Google tried to solve this by having the URL bar show the cryptographic origin of the page being displayed, rather than the URL it was fetched from (the delivery provider).

There was strong pushback here on HN - people cared more about who delivered the page than who wrote it. To me that argument is non-sensical - if you take it to the extreme, the URL bar should always just display 'data from Comcast via 192.168.0.1'

Re:Google AMP – The Newest of Evasive Phishing Tactic by mesebrec on Thursday August 03, 2023 @06:49AM (#36983977)
This is a strawman argument. You're misrepresenting the pushback and then argue against that misrepresentation.

A large part of the pushback can be summerized as such: "Google created a technology that is incompatible with the open web. Now they want browsers to change their behavior to solve some of the ways this breaks the web."

Google is the only company that can get away with this, due to their incredible market share in browser, mobile and web. Browser vendors serve as the gatekeepers deciding what the operating space is for web developers. As a result, web developers can't fundamentally change how the web works, for better or for worse. Google can, and did, and is now cleaning up the mess this left behind.

The entire argument comes down to whether you think AMP is a good or a bad thing. Either you believe it's good, and you believe browsers should change to make it work, or you believe it's bad, and it's a problem that google has so much leverage to push this tech onto us.

Re:Google AMP – The Newest of Evasive Phishing Tactic by account42 on Thursday August 03, 2023 @07:36AM (#36984350)
Signed exchangs don't prove that that is the CURRENT content from the purpoted website while hiding the true (hosting) URL would give that impression.
Re:Google AMP – The Newest of Evasive Phishing Tactic by Spivak on Thursday August 03, 2023 @01:13PM (#36988720)
Within epsilon yes it does because the signer chooses the signature expiration and it's no more than 7 days.

If you don't like this you should also take issue with Cache-Control.

You, the website operator, opt in to signed exchanges and define exactly what resources are valid for how long. If you're okay with the browser caching pages there really should be no reason to be weirded out by any 3rd party caching them too.

Re:Google AMP – The Newest of Evasive Phishing Tactic by zagrebian on Thursday August 03, 2023 @11:05AM (#36986937)
> URL bar show the cryptographic origin

Chrome’s URL bar? When was this?

Re:Google AMP – The Newest of Evasive Phishing Tactic by ffpip on Thursday August 03, 2023 @01:15PM (#36988738)
I feel like that was just an exploit waiting to happen. Showing a different URL than the page was delivered from.