News for hackers. Stuff that matters.

A comment on Google AMP – The Newest of Evasive Phishing Tactic. Parent comment

Re:Google AMP – The Newest of Evasive Phishing Tactic by account42 on Thursday August 03, 2023 @07:36AM (#36984350)
Signed exchangs don't prove that that is the CURRENT content from the purpoted website while hiding the true (hosting) URL would give that impression.
[ Parent | on HN ]
Re:Google AMP – The Newest of Evasive Phishing Tactic by Spivak on Thursday August 03, 2023 @01:13PM (#36988720)
Within epsilon yes it does because the signer chooses the signature expiration and it's no more than 7 days.

If you don't like this you should also take issue with Cache-Control.

You, the website operator, opt in to signed exchanges and define exactly what resources are valid for how long. If you're okay with the browser caching pages there really should be no reason to be weirded out by any 3rd party caching them too.

[ Parent | on HN ]