Allowing showing different domains than the actual click target is wildly reckless and should be punishable.
"Oh but our poor advertisers want to use click tracking and it is too hard to set up on their main domain". Oh boo hoo, I'm sure if it is important to them they will figure it out.
I worked for Google Ads support for a while and even this dumbed down system completely stumped so many fucking people.
God I hate advertising and advertisers so much.
These useless fucking cunts wanted every feature imaginable, setup for free, with no effort of research done from them.
That job made me hate taxi drivers so much.
What do taxi drivers have to do with it?
They are probably in cahoots with the lemon stealing whores.
What do lemons have to do with it?
The lemon was stealing all the whores and used a taxi to get away with them.
Even then it should be easy to add an additional field in their ad profile. Like "provide a list of domains your ads will go to."
And then set up some sort of domain authentication similar to let's encrypt or SPF records.
Probably they exploited the Google search redirect to have show google.com
Like this http://www.google.com/search?q=example&btnI
And because Google is a startup with limited resources they didn't implement a check against that
Probably not. Google Ads explicitly allows mismatch between displayed domain and actual domain. This is literally a supported configuration with no tricks.
The link you sent gives me a "Redirect Notice" interstitial that mitigates this attack greatly.
The ad blocking will continue until malvertisement prevention improves.
Ad Blocking >= Antivirus
"WhY aRe PeOpLe bLoCkInG aDs!?"
Google has shown time and time again they couldn't care less how malicious an ad is, they're still getting paid
Ads are always malicious, and I'm not talking about just the technical.
Ads are manipulation, so yes.
Need therapy.
(Chic 'N' Stu)
This kind of shit is why Googles (and anyone else that tries it as well) ever increasing push to put a layer of ads into anything is so off putting to me. Sure ads are annoying, but they are also probably second only to social engineering as the method for someones device and accounts getting compromised.
I personally will not go back to the days where just the act of visiting a website and clicking on nothing has a good chance of loading some Javascript and infecting my browser or whole device with the drive by malware of the day because the shit heads that run the site are to lazy to vet what they are letting their site call out too and the third party ad networks are to lazy to vet what sorts of things they are allowing their ad networks to serve.
I'm confused, does this mean that an ad can show the URL "google.com" even though clicking on it will take you to a different URL? Why doesn't Google just make it so that the ad shows the actual URL that the ad links to?
That's actually pretty simple to do. I don't know if this is how they did it, but one way is just creating an tag with the href to google.com. that'll show the destination if you hover over it. Then you just add an event listener to the click event, prevent the default event from executing, and manually redirect somewhere else.
Made a quick example: https://codepen.io/Ghoelian/pen/poXeOyo
Yes, but ads shouldn't have that level of control. They should provide an image or video and a link.
Oh absolutely. I kinda feel like preventing the default action on a tag like that should just not be allowed, or browsers should not display the target link thing if it has an event listener attached or something.
If I remember correctly the bad guys use similar characters that render the same (or close to) “standard” characters.
My E-Mail client warns me if the URL is too different from the designator. Is there something like this for Firefox?
Google.com isn’t at the top of the banned words list?
As always, ublock origin is fair game, google even had his identity verified.
This is a most excellent place for technology news and articles.
