Post #1570713

2026-03-24 11:33 UTC

@ErikvanStraten @grammasaurus @SteveRudolfi How does this work with https? To show different content claiming to be the web site you searched for, they need to persuade your browser that the proxy they redirected it to is the real thing, which is a man-in-the-middle attack, presumably exactly the kind of thing https is designed to prevent.

Replies (4)

@robinadams@mathstodon.xyz 2026-03-24 11:39

@petealexharris @ErikvanStraten @grammasaurus @SteveRudolfi The idea is not that they redirect requests to your URL. They want to show a link in their search results to a page dynamically generated by AI, above (or maybe: instead of) the link to your URL.

Open ##1570714
@brouhaha@mastodon.social 2026-03-24 18:31

@petealexharris @ErikvanStraten @grammasaurus @SteveRudolfi Google has control of the browser, for a huge percentage of users. Why did you think they got into browsers? Might not have been with this specifically in mind, but certainly it was to get them more control over what users see, and this is definitely doing it.

Open ##1570718
@merospit@infosec.exchange 2026-03-25 19:37

@petealexharris @ErikvanStraten @grammasaurus @SteveRudolfi They have been working for years to destroy URLs as a basis of trust. Even when you think a domain is real on a Google search result it can be someone else's site that they told Googlebot went through to your real site after a redirect. In that context HTTPS could be used but just send you to their new AMP site (or whatever they are calling this feature once it actually comes out).

Open ##1570719
@raphaelmorgan@disabled.social 2026-03-30 19:35

@petealexharris @ErikvanStraten @grammasaurus @SteveRudolfi that's the fun part: for most people, Google *is* the browser and they don't have to convince it of shit.

Open ##1570720