1. I create a well crafted post to a normal site that gets 10.000 upvotes.

  2. I change the URL to a malicious site.

  3. ???

  4. Profit

  • Sulfur@kbin.social
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    Reminds me of a long time ago when GameSpot and GameFAQs forums merged. GameSpot users had the ability to edit titles so they would have threads like “what’s your shoe size?” Then they would change the title to something like “how old are you?” to get the GameFAQs posters banned (due to the minimum age requirements)

  • Salamander@mander.xyz
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    It makes it a little bit easier to do, but it is not difficult to replicate this effect without changing the URL in the title - using a redirected URL and changing the redirect address, for example.

    I think that this small increase in the way this kind of attack can be delivered is more than counter-balanced by the convenience of having editable titles.

      • Salamander@mander.xyz
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 year ago

        You don’t need to use a known redirect link. If the plan begins with a post that obtains 10,000 likes, I am sure the attacker can spend a small amount of effort and register a domain.

        • deweydecibel@lemmy.world
          link
          fedilink
          English
          arrow-up
          0
          ·
          1 year ago

          Surely you don’t think that’s equivalent to a simple 5 second copy paste of a new URL into the textbox, right?

          And it’s not just about attack vectors, it’s also about stealth ads and misinformation

          • Cinner@kbin.social
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            I’m not sure what you’re getting at but he’s right, it’s incredibly simple to setup a new redirect site.

  • ronaldtemp1@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    1 year ago

    I see what you are doing here. But being able to edit title is so convenient, I couldn’t live without it.

    Maybe add a heads-up notice saying the URL has been specifically edited after some time has passed since post creation? e.g. Two hours?

    Or do something like what Twitter is doing now, letting users add specific context on the title notifying people about what changed, even confirming misinformation?

    Or always crosscheck the hyperlink in title or body with an open-source malicious site database and flag all malicious sites once and for all?

    • DrYes@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      I’m not talking about the title but the actual page a post links to. Your idea to mark edited URLs is great, though.

      Or always crosscheck the hyperlink in title or body with an open-source malicious site database and flag all malicious sites once and for all?

      The internet is in flux. Once and for all is not possible.

    • DrYes@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I’m not talking about the title but the actual page the post links to. But your idea to mark the URL as edited is great.

      Or always crosscheck the hyperlink in title or body with an open-source malicious site database and flag all malicious sites once and for all?

      the internet is in flux. once and for all is not possible.

  • gun/linux@latte.isnot.coffee
    link
    fedilink
    English
    arrow-up
    0
    ·
    1 year ago

    There’s also

    1. I create a well crafted post woth a url to a normal site in the body of my post that gets 10.000 upvotes.

    2. I change the URL to a malicious site.

    3. ???

    4. Profit

  • BombOmOm@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    5
    ·
    edit-2
    1 year ago

    The url and title should both be locked after a post. The contents should be free to change, that way updates and such can be posted if necessary.

    Comments can continue to work as-is, there is a similar danger there, but it doesn’t matter nearly as much.