A security researcher found a problem in Google’s own login page that could allow a hacker to easily steal people’s passwords — and the company apparently isn’t too worried about fixing it.
In a post published Saturday on his personal website, Aidan Woods writes of the find and some frustrating interactions he had with Google’s security team, which told him they would not track it as a security bug.
“I hope that public disclosure will encourage Google to do otherwise,” Woods wrote.
Here’s what Woods figured out: Google’s login page allows the insertion of an extra parameter called “continue” which can redirect a user to any URL, as long as it’s one that starts with google.com.
So, for example, adding ?continue=http://www.google.com/amp/businessinsider.com onto the login URL would bring a person to a real Google login screen. Then after they enter their username and password, it would take them to the home page of Business Insider.
And that can be a very bad thing. …
Google login page can be used for phishing
08/31/2016 by Leave a CommentFraud Alert: