Hacker News Reader

Comment by captainmuon | Hacker News Reader

How is it even possible to spoof the shown URL?

It's just a setting in Google AdWords. The display URL and target URL are not related. You can also play tricks like a "tracking URL template" that is a URL that can be on another domain and receives the "target URL" as a parameter. It is expected to redirect to the correct URL, of course nothing enforces this other than a manual review.

I can't believe that Google allows this but tracking is clearly more important to them than user security.

I don't have as much a problem with them hiding the display url, but what shocks me is how it also masks the URL in the status bar. If I can right-click and copy the correct URL, then why isn't Chrome* showing me that URL down below?

*Yeah, I know, I kind of answered my own question. So I guess it's rhetorical, and less shocking in retrospect.

They should not allow this. At the very least, the actual and the displayed url need to be on the same domain, and preferably the displayed url needs to be a substring of the actual url. That way they can still pass parameters for all sorts of statistics.

Of course it is, they live off ads.

Kind of wild they don't require domain ownership proof in this case though, if I'm displaying one domain but actually linking to another, I should need to prove I own the original domain

Yes, but people don't come to Google for ads, so they need to balance the benefits and harm to the users to avoid losing the traffic.

Pay Google money, and they'll let you do all sorts of things you're not supposed to do.

Reply on news.ycombinator.com