Researcher crosses swords with Google over XSS 'flaw'
Bug or feature?
Google has crossed swords with an independent security researcher who claims that the domain used by Google module applications provides a potential "safe haven" for phishing fraudsters.
Google modules are small web apps (widgets) designed for functions such as displaying weather forecasts or sports scores on a third-party website.
Because the gmodules domain (gmodules.com) is trusted by phishing filters the flaw poses a greater risk than it might on other domains.
Hansen, a critic of Google's security response in general, argues that the search engine giant has missed the point. He posted a demo of cross-site scripting of the gmodules domain to illustrate his concern that Google ought to be worried about risks beyond simple credential (cookie) theft.
The exchange between Hansen and Google has sparked a lively debate on the ha.ckers.otg forum with participants weighing in on both sides of the debate. Some point out that Google has at least mitigated the risk by running modules from the gmodules domain, while others argue that the security policies at the ad brokering giant leave a lot to be desired. ®