This link says it's from YouTube but it's not
1–10 of 60 posts
Re: This link says it's from YouTube but it's not
#2This title makes me definitely not want to click it.
Re: This link says it's from YouTube but it's not
#3It is technically a YouTube link, but it is redirecting to securitytube.net. I know this because the Internet I am on blocks YouTube, but not SecurityTube, so going directly to the redirect link works, but the YouTube link does not.
At least that is what my browser says:
http://www.youtube.com/redirect?username=digitalhook&q=h...
Looks like someone found a YouTube exploit.
Re: This link says it's from YouTube but it's not
#4Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.
Re: This link says it's from YouTube but it's not
#5This title makes me definitely not want to click it.
Can you suggest something better?
Re: This link says it's from YouTube but it's not
#6It is technically a YouTube link, but it is redirecting to securitytube.net. I know this because the Internet I am on blocks YouTube, but not SecurityTube, so going directly to the redirect link works, but the YouTube link does not. At least that is what my browser says: http://www.youtube.com/redirect?username=digitalhook&q=h... Looks like someone found a YouTube exploit.
correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.
Re: This link says it's from YouTube but it's not
#7Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.
Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.
Re: This link says it's from YouTube but it's not
#8It is technically a YouTube link, but it is redirecting to securitytube.net. I know this because the Internet I am on blocks YouTube, but not SecurityTube, so going directly to the redirect link works, but the YouTube link does not. At least that is what my browser says: http://www.youtube.com/redirect?username=digitalhook&q=h... Looks like someone found a YouTube exploit.
correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.
This is why redirect links should limit themselves to relative URLs, or limit it to a whitelisted set of domains.
(Can anyone think of downsides to limiting yourself to relative URLs or a whitelist of domains?)
It is very interesting that Youtube has this vulnerability. Almost every time I implement something like this, I double check the domain name. (This is really easy in PHP)
Re: This link says it's from YouTube but it's not
#9I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.
Re: This link says it's from YouTube but it's not
#10[deleted]