Google's login page has a fault that hackers could use to trick you out of your password


A man holds his smartphone which displays the Google home page, in this picture illustration taken in Bordeaux, Southwestern France, August 22, 2016. REUTERS/Regis Duvignau

Thomson Reuters

A security researcher found a problem in Google's own login page that could allow a hacker to easily steal people's passwords - and the company apparently isn't too worried about fixing it.

In a post published Saturday on his personal website, Aidan Woods writes of the find and some frustrating interactions he had with Google's security team, which told him they would not track it as a security bug.

"I hope that public disclosure will encourage Google to do otherwise," Woods wrote.

Here's what Woods figured out: Google's login page allows the insertion of an extra parameter called "continue" which can redirect a user to any URL, as long as it's one that starts with

So, for example, adding ?continue= onto the login URL would bring a person to a real Google login screen. Then after they enter their username and password, it would take them to the home page of Business Insider.


And that can be a very bad thing.

As Woods notes, an attacker can redirect someone to a Google form to gather personal information, or have them automatically download a malicious file uploaded to Google Drive. Or, in perhaps what would be the easiest use case, a hacker can redirect a user to a website they control that looks exactly like the Google login screen - with a message saying "password incorrect, please try again" - convincing the user to give up their password.

It's a classic phishing scheme that would basically use against the victim. Email phishing, where an attacker sends an email directing someone to download malicious files or click a link, is by far the most-used method cyber criminals employ these days.

That's because it's simple and very effective - and using a Google login page would make it even more so.

Woods shared emails with the company's security team, which downplayed the problem. A Google employee named Karshan sent the researcher to a Google website classifying such redirects as posing "very little practical risk" though it noted that a redirect classified as a URL whitelist bypass - which is what this is - can lead to "more serious flaws."


Business Insider confirmed the redirect issue still exists. Interestingly, another researcher who saw Woods post claimed he contacted the company back in late June, and was similarly rebuffed.

"I couldn't quite believe that Google had both understood this issue, and simply shrugged it off," Woods wrote.

Google did not immediately respond to a request for comment.

For now, users should be cautious when being asked to re-enter their password. If asked to give your password or other personal information, double-check the URL and ensure it's still coming from If it's not, it's possible you're seeing this attack in action.

Woods created a video of how it works:


NOW WATCH: Hackers can take over an entire network with this tiny $35 box