Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AMP pages displaying your own domain

webmasters.googleblog.com

Post reply on HN
Print view View original

171–180 of 340 posts

Re: AMP pages displaying your own domain

#171

Post by rum3 »

gregable wrote: post #168
rum3 wrote: post #155

So now you can spoof a domain as long as you have the private part of the certificate even though you don't have control over the domain? If I understand this right then this seems to open up some doors for some new email phishing scams.

This is true with TLS as well, though it also requires man-in-the-middling (MITM) the connection. MITM is usually rather easy compared to stealing a private key.

Yes but it is much harder to MITM if the users are in different parts of the world.

Someone can buy a lookalike domain name using similar-looking UTF characters, send out a bunch of email spam with an URI that looks like the original, and once the user visits the webpage it instantly loads the AMP and suddently the URL is authentic. There will only be a very quick url change from the punycode url to the original that I doubt many will notice.

Re: AMP pages displaying your own domain

#172

Post by nerdjon »

mrweasel wrote: post #132
albertgoeswoof wrote: post #7

Let’s hope AMP, like most google products, is shut down within the next 2-3 years

What's wrong with it exactly... beside being weird. I'm not a fan of manipulating the URL the way they do with this change, but couldn't you just opt to not use AMP if you don't like it? Ideally people would develop fast sites on their own, but apparently they need the help of Google.

The issue is that you can't, or you risk your site being basically blacklisted from google. Especially if your a news site.

Users have no control outside of not using google. If google were to provide a setting for the user to never see AMP, I would have less issue with this. But they don't

Instead, they basically force publishers to use this because if they don't the news carousel will not show their article. It just gives Google more control over the web for minimal at best benefits

Re: AMP pages displaying your own domain

#173

Post by AlexandrB »

jsnell wrote: post #131
andy_ppp wrote: post #126

Earlier quoted context omitted.

Fair enough but there is now zero need to load them from the AMP cache at all - this security model could allow News Carousel to load them from the originating site and still have access to the pre-rendering instant load magic/lies that AMP provides. It feels a little dodgy to me this standard and a bit embrace extend but I'll see how it plays out and reserve judgement until we see this happening in the wild and how…

If you're loading the content from the originating site, surely there's no benefit at all to signing. If you're loading the content directly from the site, the browser just needs TLS to verify the integrity of the content. And you're also back to the situation where you can't preload the content in a controlled manner or privacy-preserving manner, nor have the page-speed guarantees since the version being served to t…

> And you're also back to the situation where you can't preload the content in a controlled manner or privacy-preserving manner...

A few people have pointed out the privacy-preserving aspect of AMP. I'm not sure I get how that's the case. Is this referring to the fact that the page is not being pre-loaded from the content owner's own webserver? The main privacy violators on the internet are Google and Facebook. How is loading something from Google cache protecting my privacy?

Worse still, if someone posts an amp link on Twitter or a chat client Google now gets to know when I access a specific website even though they are an unrelated third party[1].

Edit: [1] In practice this was probably already the case since Google Analytics is so popular. But still.

Re: AMP pages displaying your own domain

#174

Post by tytso »

gnomewascool wrote: post #147
jsnell wrote: post #119

This is such a strange reaction from HN. The AMP cache URLs have been a top 3 complaint about AMP here. "I can't copy-paste URLs, it's hard for users to understand which site they are on, it looks like the content is provided by Google rather than the real provider", etc. Now there's a solution that preserves the preloading and validation benefits of AMP caches but maintains the original URLs, in a way that's cryptog…

I think that most people are worried about Google using a controversial[0], draft web "standard" (Signed HTTP Exchanges), that introduces a major change in how the web works, in mass production, without trying to first resolve the problems raised with the proposal. [0] For instance, Mozilla considers the current specification to be harmful[1]. [1] https://mozilla.github.io/standards-positions/

There was an attempt to address Mozilla's concerns[1], but Mozilla never responded, unfortunately. If the Mozilla community chooses not to respond, that might cause people to consider whether or not their position should be given much weight.

[1] https://github.com/mozilla/standards-positions/issues/29#iss...

Re: AMP pages displaying your own domain

#175

Post by jedieaston »

dbbk wrote: post #156
jsnell wrote: post #119

This is such a strange reaction from HN. The AMP cache URLs have been a top 3 complaint about AMP here. "I can't copy-paste URLs, it's hard for users to understand which site they are on, it looks like the content is provided by Google rather than the real provider", etc. Now there's a solution that preserves the preloading and validation benefits of AMP caches but maintains the original URLs, in a way that's cryptog…

As bad as the URLs were, at least you could edit them to get back to the non-AMP version if you were technically literate enough. Now there'll be no distinction, you could get sent to an AMP link from Google which is a lesser experience than the 'real' site and have no way of getting out.

Can't you just click the link at the top right that will send you to the real page as it does today?

Re: AMP pages displaying your own domain

#176

Post by RubenSandwich »

tytso wrote: post #174
gnomewascool wrote: post #147

Earlier quoted context omitted.

I think that most people are worried about Google using a controversial[0], draft web "standard" (Signed HTTP Exchanges), that introduces a major change in how the web works, in mass production, without trying to first resolve the problems raised with the proposal. [0] For instance, Mozilla considers the current specification to be harmful[1]. [1] https://mozilla.github.io/standards-positions/

There was an attempt to address Mozilla's concerns[1], but Mozilla never responded, unfortunately. If the Mozilla community chooses not to respond, that might cause people to consider whether or not their position should be given much weight. [1] https://github.com/mozilla/standards-positions/issues/29#iss...

What do you mean they never responded? They say they are working on a response[0]. Taking time to respond and informing the other party that it will take a while is not "never responded".

[0] https://github.com/mozilla/standards-positions/issues/29#iss...

Re: AMP pages displaying your own domain

#179

Post by teddyh »

jedieaston wrote: post #175
dbbk wrote: post #156

Earlier quoted context omitted.

As bad as the URLs were, at least you could edit them to get back to the non-AMP version if you were technically literate enough. Now there'll be no distinction, you could get sent to an AMP link from Google which is a lesser experience than the 'real' site and have no way of getting out.

Can't you just click the link at the top right that will send you to the real page as it does today?

What reason does Google now have for keeping the link there?

Re: AMP pages displaying your own domain

#180

Post by Tepix »

Using the signed exchange mechanism means you allow anyone to serve your content. You will no longer know when it has been served and by whom. Instead, Google will know more about what your users are consuming on your website than you - despite HTTPS!

Also, there is no mechanism to limit who is allowed to serve your content for you.

I see no technical reason why the content has to be prefetched from Google instead of your own server.

It's also confusing for users and administrators. Want to block access to a website in your network? Guess what: Your block will not be effective because Google will proxy the data unbeknownst to the firewall.

Post reply on HN