I fully agree. Official looking redirect URLs are a dream come true for scams and phishing attacks.
The goo.gl link shortener hasn’t accepted new links for many years. Over 99% of the links had no recent activity. The play was to scrape the web for old goo.gl links that went to expired domains, register the domain, and then you have a goo.gl URL that you can send wherever you want, indefinitely.
Nearly all of the angry blog posts, Tweets, and HN comments missed this and jumped to the conclusion that it was purely a cost cutting measure, but link official-looking open redirect URLs are a big deal in the security space.
The goo.gl link shortener hasn’t accepted new links for many years. Over 99% of the links had no recent activity. The play was to scrape the web for old goo.gl links that went to expired domains, register the domain, and then you have a goo.gl URL that you can send wherever you want, indefinitely.
Nearly all of the angry blog posts, Tweets, and HN comments missed this and jumped to the conclusion that it was purely a cost cutting measure, but link official-looking open redirect URLs are a big deal in the security space.