Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

twitter.com

Post reply on HN
Print view View original

71–80 of 89 posts

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#71

Post by hnarn »

This doesn't seem to be new, there's a Medium post from a year ago[1] talking about how the "data-saferedirecturl" attribute is used by Google to track clicks with Javascript, there's a question on support.google.com[2] with 100+ upvotes and no response asking what this attribute is for and how to disable it, and it even shows up in an internal (at least, targeted towards internal readers) U.S. Department of the Interior page which explicitly states that employees should not paste links from Google[3].

It's worth noting that this also happens on the "HTML version" of Gmail.

[1]: https://medium.com/@ohadinho25/googles-gmail-tracks-link-cli...

[2]: https://support.google.com/mail/thread/12875647

[3]: https://www.doi.gov/employees/drupal/links

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#72

Post by anjbe »

Nobody here has mentioned that sneak is using Google’s “Advanced Protection” feature: https://twitter.com/sneakdotberlin/status/131787094505949593...

Advanced Protection is that ultra‐secure mode that requires hardware security keys to login and prevents third‐party apps. Here’s a quote from its advertising copy:

> Protection against malware is built into Google Chrome, but Advanced Protection performs even more stringent checks before each download. It flags, or even blocks you from downloading files that may be harmful.

Sounds an awful lot like what’s going on here. It would explain why nobody’s been able to reproduce it—almost nobody has AP turned on. I imagine the number of people

1) with AP turned on

2) using a third‐party mail client (mail.app)

3) viewing plaintext mails instead of HTML mail where the link rewriting is less obvious

must be close to zero.

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#73

Post by sneak »

oefrha wrote: post #20
sneak wrote: post #13

Earlier quoted context omitted.

My track record? If you're going to accuse me of lying, I'd prefer that you do so overtly and put your own credibility on the line. https://twitter.com/sneakdotberlin/status/131783835638279782... It says source=gmail-imap right in the URL. Look.

Sorry, you have a history of making wild accusations like this: https://news.ycombinator.com/item?id=21109530

https://twitter.com/tblodt/status/1317875714981416962

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#74

Post by justaj »

hnarn wrote: post #71

This doesn't seem to be new, there's a Medium post from a year ago[1] talking about how the "data-saferedirecturl" attribute is used by Google to track clicks with Javascript, there's a question on support.google.com[2] with 100+ upvotes and no response asking what this attribute is for and how to disable it, and it even shows up in an internal (at least, targeted towards internal readers) U.S. Department of the Inte…

This was already happening in the HTML version of Gmail, like well a couple of years before as I remember.

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#75

Post by hnarn »

GuB-42 wrote: post #40
djbebs wrote: post #4

How can this be legal?

Because you agreed to it. Somewhere in the terms of service: > This license allows Google to [...] modify your content, such as reformatting or translating it

> Because you agreed to it.

Without debating the legality of this, surely you are aware that agreeing to something illegal does not make the thing legal.

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#76

Post by dragonwriter »

hnarn wrote: post #75
GuB-42 wrote: post #40

Earlier quoted context omitted.

Because you agreed to it. Somewhere in the terms of service: > This license allows Google to [...] modify your content, such as reformatting or translating it

> Because you agreed to it. Without debating the legality of this, surely you are aware that agreeing to something illegal does not make the thing legal.

> surely you are aware that agreeing to something illegal does not make the thing legal.

It very often does because much illegality has absence of consent as an essential criterion.

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#77

Post by hnarn »

dragonwriter wrote: post #76
hnarn wrote: post #75

Earlier quoted context omitted.

> Because you agreed to it. Without debating the legality of this, surely you are aware that agreeing to something illegal does not make the thing legal.

> surely you are aware that agreeing to something illegal does not make the thing legal. It very often does because much illegality has absence of consent as an essential criterion.

That is sometimes the case, but the comment that I replied to did not talk about some cases.

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#79

Post by jpp »

TooCreative wrote: post #60

I can reproduce it on gmail.com Google seems to hide this via Javascript. To reproduce in Chromium: Enable dev tools, enable "Preserve log", go to settings and enable "Auto-open DevTools for popups". Then click on a link in a mail. Now you can see under the Network tab, that the new window did not go to the link you clicked but to a Google redirect url. I guess Google outputs a normal link in the html but then interc…

I can confirm I'm seeing this -- I just noticed, searched Google, and ended up ... here.

I have an email generated by one of our internal systems with a link to it, fetched via IMAP using Apple Mail, and the link is edited to be like so:

&source=gmail-imap&ust=1603744768000000&usg=" rel="nofollow">https://www.google.com/url?q=&source=gmail...

We're on GSuite Business, and under "Spoofing and Authentication", have "Apply future recommended settings automatically." enabled. Probably some other options, too. I happen to have "Advanced Protection Program" enabled for my account; so this may be happening because of that.

Given the phishing attempts I've seen in my career, having this as an opt-in option for certain users ... well, let's just say I've personally had users I would have had this turned this on for and we would all be happier. I can also see the privacy concerns.

Perhaps we'll learn more about the opt-in / opt-out details in the coming days, so that users can make the appropriate choices for themselves?

Re: Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

#80

Post by berkes »

woodruffw wrote: post #57

I can't reproduce this either, so I'll ask maybe a simple question: how does URL-rewriting benefit Google in this situation? Google already knows the bodies of emails and can do whatever analytics they please on them. The vast majority of users are also using it via their web client, meaning that Google can put arbitrary JavaScript on the page to record which links are being clicked on. They already have most of the…

> how does URL-rewriting benefit Google in this situation?

When I use, say, thunderbird, Google does not know whether I opened an email, interacted with links on them or downloaded images/external resources in them.

With link-rewriting, when I click on e.g. shopping.example.com/product/1337 and not on shopping.example.com/product/42 in an email, google now knows that "berkes, thunderbird-user is more likely to like product 1337" and can offer that data to advertisers.

Post reply on HN