Hacker News Reader

Comment by PuffinBlue | Hacker News Reader

I can appreciate their stance on phishing but being able to automatically execute an arbitrary file download that appears to come from Google as part of the login process strikes me as a bad thing, no?

View on HN

To get that exploit you'd need to send a faulty URL and get the user to follow it. You could just as easily do that with a faulty URL and no Google login.

The only risk is if the redirect can access your login session/credentials. If it can't, no exploit.

The Google login wraps the whole flow in a trojan horse, though. Users are taught to trust the single sign ons from FB/Google, and they're also taught to check the URL. Both of those would be false senses of security in this case. In isolation, this isn't necessarily a security vulnerability. But that it breaks down when users do what they're supposed to do? That's bad.

The logo and the host portion of the URL are ensuring that my credentials are going to Google, and not anyone else. The rest of the URL is telling me I shouldn't trust where I'm going. ;-)

> automatically execute an arbitrary file download

Your phrasing could easily be misread. A downloaded program would not automatically run.

And in modern browsers/OS not even after you click on them, until you clear a "yes, I know this is risky" dialog.

Replace execute with 'initiate'?

It is. It also seems like an easy fix, I'm surprised why this hasn't been done yet.

Probably corporate inertia and big testing/deployment pipeline, etc.

It's not an "easy fix", there could be (and probably are) thousands of different endpoints that can be redirected to after login, whitelisting all of those just doesn't make sense.

That sounds tedious, not necessarily difficult. I wonder if there is a technical challenge that goes beyond the tedious work of going through possible redirects and whitelisting them

Reply on news.ycombinator.com