Can someone tell me what I'm missing here? The author is saying that, on hover, it indicates a different URL than what the href actually goes to, which is a much more serious issue than just "HTML element text doesn't match the href", which is also what most people here in the comments are talking about. But then the author calls for a solution of just enforcing that the element text match the href, which wouldn't fix this issue! I'm inclined to think that something's not right in this article.
Google AdWords Exploit Seen in the Wild
131–140 of 163 posts
Re: Google AdWords Exploit Seen in the Wild
#132Earlier quoted context omitted.
For the latter, as one of my sibling posts points out the user will go "Huh, stupid password manager didn't fill out my password - I'll have to do it manually". Often the password manager even helps them do this in the name of user convenience. Only Brick wall UX works. That's what WebAuthn does here. Don't offer the user a way to "continue anyway", don't ask them confusing questions, just a brick wall and no way for…
Can you elaborate on what "brick wall UX" is like to use as a user, or how one implements it? Are there known examples you could point me at? (It's a term I haven't heard before, and haven't noticed anything when searching.)
I don't think it's a known term; it seems something GP created. As for how it works, the concept is simple: if the user wants to do the wrong or potentially insecure thing, just don't let them, period. That's the brick wall.
I'm of two minds about this personally. On the one hand, I appreciate the argument that the only thing that can prevent businesses from doing something bad, stupid or abusive is if it's legally, physically or by design impossible. On the other hand, as a pro user, I do appreciate the ability to override software when it mistakenly tries to prevent me from doing something.
Re: Google AdWords Exploit Seen in the Wild
#133Earlier quoted context omitted.
https://www.forbes.com/sites/ericgoldman/2012/10/22/google-d... https://en.m.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google... .
Second link is broken, and the first is about a different thing (triggering an ad based on a competitor's trademark). Pretending to be a competitor clearly violates trademark law. But I somewhat suspect these fraudsters aren't that concerned with trademark law.
Fixed link for the second page:
https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_....
Re: Google AdWords Exploit Seen in the Wild
#134When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…
The real answer here is that tech companies are trying to solve this problem with tech - in an effort to cheap out on actually hiring some humans to look at the thing and verify that it's safe.
My eyeballs are not free. I hate advertising and advertisers. I have no pity for the advertising platform that cheaps out on security just because it's expensive.
Re: Google AdWords Exploit Seen in the Wild
#135I feel like all the technical arguments here are besides the point. The ad is designed to take you to a page, which tells you a lie, to convince you to give them your money. We already have a legal term for people that make money by misrepresenting something, it's called fraud. Sure, you can tell me it will still be a cat or mouse game and that laws aren't gonna reach into whatever sort of clickfarm network exists fa…
> We already have a legal term for people that make money by misrepresenting something, it's called fraud.
A nitpick, but if that was the definition of fraud, most of existing advertising would land people in jail. Unfortunately, laws around advertising are way too lax.
It's definitely not a technical problem, but the technical issues discussed are a symptom of it. They're enabling scummy behaviour in order to profit from it.
Re: Google AdWords Exploit Seen in the Wild
#136I feel like all the technical arguments here are besides the point. The ad is designed to take you to a page, which tells you a lie, to convince you to give them your money. We already have a legal term for people that make money by misrepresenting something, it's called fraud. Sure, you can tell me it will still be a cat or mouse game and that laws aren't gonna reach into whatever sort of clickfarm network exists fa…
> We already have a legal term for people that make money by misrepresenting something, it's called fraud. A nitpick, but if that was the definition of fraud, most of existing advertising would land people in jail. Unfortunately, laws around advertising are way too lax. It's definitely not a technical problem, but the technical issues discussed are a symptom of it. They're enabling scummy behaviour in order to profit…
Well, I can certainly tell you my snakeoil will improve your skin (I'm not making any medical claims and this isn't FDA approved), but I can't advertise that a new study has found that all people named TeMPoral will die within 10 days unless they buy my vitamin with a 100% cure rate.
I agree with you both about advertising being generally an awful thing that is almost always solely designed to manipulate someone rather than give them information, and that the laws are too lax, but this sort of YOU HAVE A VIRUS advertising would be illegal.
(Then again it's barely any worse than the postal junk mail I get designed to look like a sort of official bank repossession notice trying to get me to buy some scammy insurance...)
Re: Google AdWords Exploit Seen in the Wild
#137We should fix this with a new HTTP header. Browsers can verify that "expect redirect on next request" ends with the correct destination domain. It would be relatively simple for browsers to implement.
Google can set this on the headers for outgoing redirect link they already use for AdWords and search results. It would simply make sure that after all the 30X redirects, you actually land on the expected domain.
I can't believe this doesn't already exist. It would be widely useful even outside of ad-tech, when you need redirects for country specific subdomains for instance. And by the other replies on this thread it would fix an ancient security hole at the same time. Anybody want to make an RFC?
Re: Google AdWords Exploit Seen in the Wild
#138Earlier quoted context omitted.
> The use case that this breaks is doing click tracking on links I, personally, would be quite happy for this use case to break.
> I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refin…
> why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you?
Email A/B testing is always about marketing and trying to manipulate users, in my experience. If the content is the same, but a different button gets more clicks, it's hard for me to believe users are finding a benefit in that. I think it's far more likely that the content isn't all that compelling, but the UI tweaks managed to tickle some part of the reader's subconscious in the right way for them to click.
In other words, emails with quality content don't have marketing teams running them.
This is pretty much like all targeted advertising. The benefit to the company is very clear, but I don't think I'd be missing much if email analytics went away.
Just as a personal opinion that I'm sure plenty of people disagree with, I dislike it when products are hyper-customized based on a lot of analytics. For instance, Netflix has a ton of data on me, but all of their tests and micro optimizations make me use the app less. I would much prefer their product if they threw all of that info in the trash, rolled the UI back 5 years, and showed me more generalized start ratings again.
Re: Google AdWords Exploit Seen in the Wild
#139Earlier quoted context omitted.
...which then marks all these newsletters as scams, since the link usually first points to analytics site?
Sounds to me it’s working as intended.
Sure but regular users will see it and think "this message means nothing, I got an email I know was from my bank the other day and I saw the banner there, too!"
Re: Google AdWords Exploit Seen in the Wild
#140Earlier quoted context omitted.
>> Google's algorithms think the users query will be answered by going to that domain That's BS semantics. Their algorithms are based more on the age of your domain and other technicalities, rather than some hypothetical meaning of "search intention". Today you're much more likely to get directed to some SEO-optimised highly monetised blog content because they bought an incredibly old domain name rather than what you…
I think you're speaking to a point the parent wasn't really making. All they're saying is that being known as the canonical source for a brand gives you a steep discount on bidding for that brand name. We can quibble about the philosophical role of modern search engines I guess, but the basic idea is just that it should be easy to defensively bid on your own thing.
It’s not philosophical quibbling: Google does whatever makes them more money.
For all it is, allowing competitors to bid against each other just makes them more money. And the truth is that the customers who would click on a Lyft ad for “uber” query would not care if it was Uber indeed - as otherwise they would be intelligent enough to find Uber as a lower match.
So frankly “being the canonical source for the brand is a steep discount” is not their policy and I don’t really see how that policy is even motivated, financially or in terms of user-friendliness.