6 ms·

> And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome https://www.google.com/ch

> And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome https://www.google.com/chrome. Which could be faked, as seen in the referenced tweet: https://twitter.com/GabrielLandau/status/1055300918101598208 https://twitter.com/GabrielLandau/status/1055300918101598208 Yes, they show the word "Ad", alongside the domain name "google.com" - except the user doesn't end up on "google.com".

anonred 8y ago
Perhaps the ad was using one of the Google redirect tricks? There’s a few google.com endpoints (if I recall) that you can abuse to redirect to arbitrary URLs.
- Sephr 8y ago
  At first I suspected this as well, but apparently it was a link to itracking[.]services and Bing pre-resolved the redirect chain. You can spoof any domain you want in Bing Ads without needing an open redirect.
  - edoceo 8y ago
    > You can spoof any domain you want in Bing Ads without needing an open redirect. Is that a bug or a feature? It seems like the kind of thing that could erode user trust
    - ocdtrekkie 8y ago
      It's a feature, Google allows the same. Basically advertisers want to set the links to be tracking links and stuff which may be through third parties which then redirect to their site. So both ad services allow the advertiser to display one URL while directing users to another.
      - adanto6840 8y ago
        Surely they're doing some verification to ensure that either the redirect lands on the advertised TLD, or alternatively that you're at least "in control" of the TLD you're advertising as (similar to GAnalytics verification -- via meta tag, DNS txt entry, etc)?
        utopcell 8y ago
        Google does.
        ocdtrekkie 8y ago
        Doesn't seem to work much better than whatever solution Bing uses, see https://news.ycombinator.com/item?id=18317051 https://news.ycombinator.com/item?id=18317051 Though that was 2017, and Google might've improved their protections since then.
larkeith 8y ago
Data point: For me, the first result for 'download Chrome' is a legitimate ad that directs to google.com
Pica_soO 8y ago
Oh, yes, its "fixed". Like the nice shiny buttons, which allow to set my windows privacy settings, fixing all my problems. Its of course not a fixed fix, meaning, it will be reseted the next time i download a update. So sloppy, im sure somebody is terribly sorry. Its a miracle how bad a OS can go, that holds all of legacy hostage. If there ever is a standard for future project, there is a dire need for a interface layer, that allows to emulate every OS functionality and sunset the whole win32 ecosystem within some decades.

anonred 8y ago

Perhaps the ad was using one of the Google redirect tricks? There’s a few google.com endpoints (if I recall) that you can abuse to redirect to arbitrary URLs.

Sephr 8y ago
At first I suspected this as well, but apparently it was a link to itracking[.]services and Bing pre-resolved the redirect chain. You can spoof any domain you want in Bing Ads without needing an open redirect.
- edoceo 8y ago
  > You can spoof any domain you want in Bing Ads without needing an open redirect. Is that a bug or a feature? It seems like the kind of thing that could erode user trust
  - ocdtrekkie 8y ago
    It's a feature, Google allows the same. Basically advertisers want to set the links to be tracking links and stuff which may be through third parties which then redirect to their site. So both ad services allow the advertiser to display one URL while directing users to another.
    - adanto6840 8y ago
      Surely they're doing some verification to ensure that either the redirect lands on the advertised TLD, or alternatively that you're at least "in control" of the TLD you're advertising as (similar to GAnalytics verification -- via meta tag, DNS txt entry, etc)?
      - utopcell 8y ago
        Google does.
        ocdtrekkie 8y ago
        Doesn't seem to work much better than whatever solution Bing uses, see https://news.ycombinator.com/item?id=18317051 https://news.ycombinator.com/item?id=18317051 Though that was 2017, and Google might've improved their protections since then.

larkeith 8y ago

Data point: For me, the first result for 'download Chrome' is a legitimate ad that directs to google.com

Pica_soO 8y ago

Oh, yes, its "fixed". Like the nice shiny buttons, which allow to set my windows privacy settings, fixing all my problems. Its of course not a fixed fix, meaning, it will be reseted the next time i download a update. So sloppy, im sure somebody is terribly sorry. Its a miracle how bad a OS can go, that holds all of legacy hostage. If there ever is a standard for future project, there is a dire need for a interface layer, that allows to emulate every OS functionality and sunset the whole win32 ecosystem within some decades.