A new AMP update shows how it can infiltrate every corner of the internet • Hacker News Board

Re: A new AMP update shows how it can infiltrate every corner of the internet

#91

Post by AgentME » Wed, Aug 21, 2019, 9:31 PM UTC

buboard wrote: post #81

AgentME wrote: post #24

Earlier quoted context omitted.

Website authors opting in to letting another server serve content "as" their own domain isn't anything new: it's what CDNs do. The Signed Exchanges standard is actually a huge step up because the website authors get to cryptographically sign their content. With normal CDNs, if the CDN is malicious or gets hacked, the CDN is free to serve modified content on the original domain.

I can already smell the fake news from hacked keys, and authoritarians demanding keys from media sites. Congrats, we found just another way to break the resilience of decentralisation

If an attacker gets a key for a site, I believe they can only serve the Signed Exchange claiming to be the site to a user if the user is at the attacker's own site and then navigates from there to the victim site. And then if the user refreshes, I assume that might force the request to go to the real site.

If an authoritarian can man-in-the-middle network connections and demand keys, it would be much simpler to just MITM the sites without doing anything with Signed Exchanges.

Re: A new AMP update shows how it can infiltrate every corner of the internet

#92

Post by tempodox » Thu, Aug 22, 2019, 11:06 AM UTC

I really do wonder how long it will take everybody to realize that Google is the ultimate computer virus.

Re: A new AMP update shows how it can infiltrate every corner of the internet

#93

Post by cpeterso » Tue, Aug 27, 2019, 4:33 AM UTC

drewg123 wrote: post #43

maaaats wrote: post #9

Google intentionally gimps Firefox on Android, by serving an old-school page. Using an addon (which you can on mobile Fx, and not on Chrome), fixes this by editing the UA string when visiting Google. Getting the "nice experience", however, gives me amp links. And when I click on them, I'm unable to scroll?! It doesn't matter if it loads fast, when I cannot read beyond the fold. It also breaks the "open in app" I norm…

The amp problem I have on Firefox for Android is that AMP links to TomsHardware articles never load. I have to re-write the URL to replace "amp" with "www" to be able to read an article.

Can you place share how you find a Tom's Hardware AMP page? I work at Mozilla and would like to test this. Google Search in Firefox for Android just returns regular www URLs. If I manually change "www." to "amp." (reversing your fix), I get a 404 page, not an AMP article.

Edit: I copied an AMP URL (https://www.google.com/amp/s/amp.tomshardware.com/...) from Google search in Chrome. I posted email it into Firefox and it redirected to a www. page on tomshardware.com that loaded successfully.