Google Phishing Quiz
phishingquiz.withgoogle.com
Google Phishing Quiz
1–10 of 103 posts
Re: Google Phishing Quiz
#2I had no idea google allows arbitrary redirects through its own https://google.com domain. Why?
Re: Google Phishing Quiz
#3Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
Re: Google Phishing Quiz
#4I had no idea google allows arbitrary redirects through its own https://google.com domain. Why?
open redirects have always been a thing.
Re: Google Phishing Quiz
#5I had no idea google allows arbitrary redirects through its own https://google.com domain. Why?
They don't seem to consider open redirects an issue worth mitigating (see https://sites.google.com/site/bughunteruniversity/nonvuln/op...). Though in the example given, they have taken the sensible step of inserting an interstitial warning page, there are known URLs (e.g. https://vagmour.eu/google-open-url-redirection/) that don't use such a page.
Personally, I don't think it's particularly realistic to expect users to be able to work out when an open redirect is being abused in a phishing attack - particularly if e.g. other junk query string parameters are used to obfuscate the destination, or a domain is chosen that looks like it could legitimately be part of a site's URL structure.
Checking the domain gets you some peace of mind (assuming it's not abusing lookalike Unicode characters!) but if there are "reflected" or even "stored" open redirects [1] on the domain then all bets are off. I don't think I could confidently make a decision regarding the safety of such a link except by following it (with e.g. curl -L) and seeing what happened.
[1] I'm abusing XSS terminology here by applying it to redirects, but hopefully the meaning is clear. I consider a "stored open redirect" a page under a user-known-safe domain where an attacker can persist the final destination s.t. it's not visible in the original URL.
Re: Google Phishing Quiz
#6I had no idea google allows arbitrary redirects through its own https://google.com domain. Why?
Actually, it looks like navigating to the link you're talking about https://google.com/amp/tinyurl.com/y7u8ewlr, or any link beginning with https://google.com/amp/, will first bring you to a redirect confirmation, not immediately redirect you.
(The shortlink above is actually safe - it redirects to https://jigsaw.google.com/)
Re: Google Phishing Quiz
#7Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
The inclusion of that one kinda baffled me.
No way for me to tell whether the app that's connecting would be one I'd want reading emails (I wasn't familiar with it) and without an address bar, hard to tell if it's a spoof or the real thing.
Re: Google Phishing Quiz
#8Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
Yeah, anyone asking for that, even if it's not a phishing attempt would never get the OK from me. That's just crazy.
Re: Google Phishing Quiz
#9I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful signal on if I want to look at an attachment, though even if they are someone I know, do they have a reason to send me that PDF is the second question). Unsolicited attachments are always suspect.
Re: Google Phishing Quiz
#10Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
Amusingly, Google doesn't let its own employees allow TripIt to access corporate email accounts.
(But personal ones? Go for it...)