Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

21–30 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#21

Post by ljm »

mike_d wrote: post #6

All URLs sent to any major email provider are "clicked" because they are scanning the page to see if it is phishing or otherwise malicious (desktop antivirus and other things will also prescan URLs). It also protects privacy by defeating click tracking on marketing emails. Google will also pre-load all the images in your email too. You shouldn't take any write action to your database just based on a URL being visited…

You think every email provider crawls links in your email and the inspects the destinations to protect you from spam?

That is patently not true, otherwise you would be dealing with utter chaos as you interacted with the internet. If, as the OP claims, Gmail actually _is_ doing this, then that is worrying but it's not the general case.

Google pre-loads and caches images, which many people consider problematic, but they're not pre-fetching URLs.

Refer to these two incredibly recent posts to understand why:

1. https://news.ycombinator.com/item?id=28192269 - How to prevent email spoofing, using an unholy combination of silly standards

2. https://news.ycombinator.com/item?id=28194477 - Email Authenticity 101: DKIM, Dmarc, and SPF

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#22

Post by _wldu »

whateveracct wrote: post #19
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

Make the user take action after opening the link. Like click a button.

Thanks. That's good advice.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#23

Post by ev1 »

etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

Almost everywhere I see just prefills your email into a text box (or for the more asshole ones, doesn't) and provides a button to click. I rarely if ever see one click unsub.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#24

Post by justinator »

ShakataGaNai wrote: post #15
justinator wrote: post #8

Earlier quoted context omitted.

You make just visiting the URL not everything that needs to be done. So for example, the URL you visit then also runs a small bit of javascript behind the scenes that does the actual unsub action - or the javascript just does a redirect. Or even simpler, you make it so the user has to click a button to POST the request. You've had to do this for years, now. I would assume though, that Gmail is smart enough to go, "oh…

But to be fair, 1-click unsubscribe is a very user friendly thing to do. As a user, if I have to jump through a bunch of hoops to unsubscribe, I'm just going to mark your message as spam and move on with my life.

I absolutely agree. That's why on the app I wrote, the default is one-click unsubscribe, but I still have to do it using a little bit of Javascript. If JS is disabled, you just have to click a button that POSTs the request. I'm not sure what else to do!

There's a similar but different problem with the reader-supplied "unsubscribe" button. This usually uses information found in the header of the email message - "List-Unsubscribe", but guess what also gets prefetched sometimes? Enter RFC8058 and, "List-Unsubscribe-Post"and another email kludge to throw on the pile,

https://datatracker.ietf.org/doc/html/rfc8058

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#25

Post by sxp »

whateveracct wrote: post #19
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

Make the user take action after opening the link. Like click a button.

And make sure the action is a POST instead of a GET. GETs should never modify important state.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#26

Post by justinator »

wcoenen wrote: post #14

HTTP GET requests should not be interpreted by the server as a request to change something. That's what POST, PUT, DELETE and PATCH are for.

I agree, but how do you initiate a POST request via an email message? Embedding a form sometimes raises its own security alert.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#27

Post by dheera »

rgbrgb wrote: post #18
dheera wrote: post #12

Earlier quoted context omitted.

> Google will also pre-load all the images in your email too PLEASE disable automatic loading in Gmail settings. Don't let the idiots use unethical, stalkerish e-mail read receipts.

Doesn't gmail's preloading defeat the read receipts? It makes it so every tracking pixel sent to gmail gets loaded (and not by your IP), thereby making it meaningless.

I thought gmail preloads only when the e-mail is opened. I thought it was basically just a proxy.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#28

Post by contravariant »

etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

Run some javascript on the page that sends a POST? Not ideal, but not sure how else to fix it, you can't send a POST with a single link as far as I can tell.

Google could of course send the POST as well but then at least they're violating the HTTP standard.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#29

Post by contravariant »

Xophmeister wrote: post #5
etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

Or “click this link to verify your e-mail address”…

Well the email address exists. If they wanted you to prove you can read the mail account they should send you a token or something, or at least require authentication if you click the link.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#30

Post by akersten »

justinator wrote: post #8
etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

You make just visiting the URL not everything that needs to be done. So for example, the URL you visit then also runs a small bit of javascript behind the scenes that does the actual unsub action - or the javascript just does a redirect. Or even simpler, you make it so the user has to click a button to POST the request. You've had to do this for years, now. I would assume though, that Gmail is smart enough to go, "oh…

Well, the problem is at some point (maybe the can-spam act) there was a nebulous requirement for "one click unsubscribe." So rock, meet hard place. On mobile or I'd look up the law. I suppose a link and then a button press counts as two clicks.
Post reply on HN