Hacker News new | ask | show | jobs
by trengrj 2778 days ago
If I'm reading this right, does this mean that current Google AMP powered pages will now be able to impersonate the url of the original publisher site in Chrome provided the publisher performs a key exchange?
2 comments

Yes, fixing of AMP URLs is one of the motivators for this.

Note that it's not "impersonation", as it requires the domain owner to sign the bundle, and Google can't alter the signed files. It's more like proxying of HTTPS traffic, but delayed.

"Google can't alter the signed files"

The signed html files likely include a script tag that downloads Google controlled JS. Such that AMP can continue to do whatever it wants.

Edit: "The AMP runtime is loaded via the mandatory <script src="https://cdn.ampproject.org/v0.js"></script> tag in the AMP document <head>."

https://www.ampproject.org/docs/fundamentals/spec#amp-runtim...

So you can use signed http and Google can't alter the files. But, if you make your page valid AMP for their cache, they certainly alter the page with their runtime. Adding the header at the top, intercepting things like left/right swipe for carousel and top-stories loaded pages, etc.

As a content publisher, I do love AMP after putting time, sweat, and tears, into it. The URL issue is a big one especially for repeat visitors and branding perspectives.

However, what would this new system operate set the referrer to when a user clicks on my site, to go to another?