Google's login page has a fault that hackers could use to trick you out of your password

A security researcher found a problem in Google's own login page that could allow a hacker to easily steal people's passwords - and the company apparently isn't too worried about fixing it.

In a post published Saturday on his personal website, Aidan Woods writes of the find and some frustrating interactions he had with Google's security team, which told him they would not track it as a security bug.

"I hope that public disclosure will encourage Google to do otherwise," Woods wrote.

Here's what Woods figured out: Google's login page allows the insertion of an extra parameter called "continue" which can redirect a user to any URL, as long as it's one that starts with google.com.

So, for example, adding ?continue=http://www.google.com/amp/businessinsider.com onto the login URL would bring a person to a real Google login screen. Then after they enter their username and password, it would take them to the home page of Business Insider.

And that can be a very bad thing.

As Woods notes, an attacker can redirect someone to a Google form to gather personal information, or have them automatically download a malicious file uploaded to Google Drive. Or, in perhaps what would be the easiest use case, a hacker can redirect a user to a website they control that looks exactly like the Google login screen - with a message saying "password incorrect, please try again" - convincing the user to give up their password.

It's a classic phishing scheme that would basically use Google.com against the victim. Email phishing, where an attacker sends an email directing someone to download malicious files or click a link, is by far the most-used method cyber criminals employ these days.

That's because it's simple and very effective - and using a Google login page would make it even more so.

Woods shared emails with the company's security team, which downplayed the problem. A Google employee named Karshan sent the researcher to a Google website classifying such redirects as posing "very little practical risk" though it noted that a redirect classified as a URL whitelist bypass - which is what this is - can lead to "more serious flaws."

Business Insider confirmed the redirect issue still exists. Interestingly, another researcher who saw Woods post claimed he contacted the company back in late June, and was similarly rebuffed.

"I couldn't quite believe that Google had both understood this issue, and simply shrugged it off," Woods wrote.

Google did not immediately respond to a request for comment.

For now, users should be cautious when being asked to re-enter their password. If asked to give your password or other personal information, double-check the URL and ensure it's still coming from google.com. If it's not, it's possible you're seeing this attack in action.

Woods created a video of how it works: