They bought that TLD and then never did anthing fun with it. I can forgive them for not doing https://google, since that's discouraged apparently, but not even fonts.google? docs.google? mail.google? Apparently once upon a time you could do com.google for an April Fools prank but they didn't even keep a basic redirect. The only thing they ever permanently used it for (afaik) was domains.google, and they sold that to Squarespace. Why even spend the money?
the pattern seems to be that all of these don't use your google account, i suppose their system (through cookies or something similar) depends on the domain google.com somehow.
The way they describe it as an issue with free accounts seems vague and misleading. Why would _any_ account have this broad of access? Why would free ones be uniquely insecure vs official ones?
This suggests a bad actor at any institution could do the same thing done here. No?
reply