Faking Twitter unfurling to phish you
harrydenley.com
Faking Twitter unfurling to phish you
1–10 of 70 posts
Re: Faking Twitter unfurling to phish you
#2And also don't trust this link: https://t.co/MPesRJdK5y
Re: Faking Twitter unfurling to phish you
#3Is there any sort of within-a-page HTTPS "secured" function?
Like how banks have that "only type your password if we show your correct profile picture". Almost like if embedded tweets could be "signed" by twitter in a way that would register in my browser in a graphical way that would not be known to the server itself (ie putting the twitter logo next to a tweet is easily faked). But if content appearing to be from twitter was verified instead, and had my custom chosen avatar next to each showing both my key and twitter's key had signed the text.
Maybe not making sense, if anyone wants to play this back clearer go for it :)
Re: Faking Twitter unfurling to phish you
#4Why would twitter trust the Location header and not just parse the URL given to them? This seems like a strange choice to rely on their backend lookup just to display the URL...
Re: Faking Twitter unfurling to phish you
#5Why does this require the extra step of using a burner account? Why not tweet https://twitter-unfurl-faker.herokuapp.com/ from your main account and that's it?
Does Twitter only unfurl t.co URLs? If so, why would they write separate code for unfurling t.co with ?amp=1 vs without ?amp=1 ? And why would Twitter unfurl a t.co link past the first non-t.co URL? I guess that's the vuln, right, that they don't stop after the first non-t.co URL?
Re: Faking Twitter unfurling to phish you
#6Is there any sort of within-a-page HTTPS "secured" function? Like how banks have that "only type your password if we show your correct profile picture". Almost like if embedded tweets could be "signed" by twitter in a way that would register in my browser in a graphical way that would not be known to the server itself (ie putting the twitter logo next to a tweet is easily faked). But if content appearing to be from t…
> Like how banks have that "only type your password if we show your correct profile picture".
Do they? My banks did that years ago, and they also stopped doing it years ago.
Re: Faking Twitter unfurling to phish you
#7Firefox is doing a horrendous job of rendering the text on this site for me, on Arch Linux. Is it just me?
Re: Faking Twitter unfurling to phish you
#8Firefox is doing a horrendous job of rendering the text on this site for me, on Arch Linux. Is it just me? https://i.imgur.com/ZP9wC85.png
Looks like some poor subpixel rendering. You might want to try looking for some settings to tune it.
Re: Faking Twitter unfurling to phish you
#9Why would twitter trust the Location header and not just parse the URL given to them? This seems like a strange choice to rely on their backend lookup just to display the URL...
Because that's how HTTP redirects work. A `t.co` link is simply a 301/302 redirect to another site with a `Location` header.
Re: Faking Twitter unfurling to phish you
#10Why would twitter trust the Location header and not just parse the URL given to them? This seems like a strange choice to rely on their backend lookup just to display the URL...
Twitter follows the Location header since the purpose of that header is to redirect to another page. It's considered a good user experience to display the final page as a link preview rather than the intermediary redirect.