Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

31–40 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#31

Post by skybrian »

jeroenhd wrote: post #9
judge2020 wrote: post #4

This is a good feature in my opinion. Why should I let the sender know when I click on tracking links or view the email? If you really want to, just filter out clicks from AS15169.

I disagree. I think the image and resource preloading done by Google is perfectly fine, but clicking actual links will mess up tons of systems (like, for example, links that are only supposed to be valid once, like in password reset emails). There are good use cases for links with single-use tokens in them. Companies sad and desperate enough to suck as much data from you as humanly possible (i.e. every single news le…

From the very beginning of the web when HTTP was defined, there has been the rule that a GET request should never take an action on its own. Actions should be based on some other method like a POST request.

Google is following the standard. People who take actions based on GET requests are not. Sure, mistakes happen out of ignorance, but they should be fixed.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#32

Post by Silhouette »

ShakataGaNai wrote: post #15
justinator wrote: post #8

Earlier quoted context omitted.

You make just visiting the URL not everything that needs to be done. So for example, the URL you visit then also runs a small bit of javascript behind the scenes that does the actual unsub action - or the javascript just does a redirect. Or even simpler, you make it so the user has to click a button to POST the request. You've had to do this for years, now. I would assume though, that Gmail is smart enough to go, "oh…

But to be fair, 1-click unsubscribe is a very user friendly thing to do. As a user, if I have to jump through a bunch of hoops to unsubscribe, I'm just going to mark your message as spam and move on with my life.

Exactly. And it's not just one-click unsubscribe. Using a secret link sent to an account's email address as a way to implicitly log in instead of having to remember a password is increasingly common and also an interesting idea in terms of user experience and security.

If it's OK for your mail service to open one secret link, where does it stop? Is it also OK for them to spider the content they can reach from that link? Now they are potentially gaining access to all kinds of possibly sensitive information that they would not have been able to reach except for spying on your email. And if that's not OK, why was it OK for them to open the secret link in the first place?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#33

Post by elif »

etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

one-click unsub is implemented by ignoring scrapers. Google is especially good about using a unique UA string

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#34

Post by technion »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

I have an email from 2015 where I reported this as a potential vulnerability in the Hartl Rails tutorial, having seen it myself back then. Consider "verified" ashley madison accounts in their breach and this scenario.

This is not just a Gmail thing. Most corporate mail filters visit a link and scan for malware as a feature.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#36

Post by justinator »

akersten wrote: post #30
justinator wrote: post #8

Earlier quoted context omitted.

You make just visiting the URL not everything that needs to be done. So for example, the URL you visit then also runs a small bit of javascript behind the scenes that does the actual unsub action - or the javascript just does a redirect. Or even simpler, you make it so the user has to click a button to POST the request. You've had to do this for years, now. I would assume though, that Gmail is smart enough to go, "oh…

Well, the problem is at some point (maybe the can-spam act) there was a nebulous requirement for "one click unsubscribe." So rock, meet hard place. On mobile or I'd look up the law. I suppose a link and then a button press counts as two clicks.

The CAN-SPAM act actually doesn't require one-click unsubscribe, but there needs to be a way to unsubscribe in any email you send out, and your physical address has to be listed in the email message.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#37

Post by meowster »

contravariant wrote: post #29
Xophmeister wrote: post #5

Earlier quoted context omitted.

Or “click this link to verify your e-mail address”…

Well the email address exists. If they wanted you to prove you can read the mail account they should send you a token or something, or at least require authentication if you click the link.

The verification link shouldn't be used to verify the email exists, it should be used to verify that the owner of the email address is the same person that signed up for whatever service.

I have a common name gmail address, and I get verification emails all the time that I never open. If websites keep emailing me after that, then I rightfully mark them as spam.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#38

Post by Xophmeister »

contravariant wrote: post #29
Xophmeister wrote: post #5

Earlier quoted context omitted.

Or “click this link to verify your e-mail address”…

Well the email address exists. If they wanted you to prove you can read the mail account they should send you a token or something, or at least require authentication if you click the link.

The verification is usually to prove the address is yours, as well as whether it exists.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#39

Post by sp332 »

ljm wrote: post #21
mike_d wrote: post #6

All URLs sent to any major email provider are "clicked" because they are scanning the page to see if it is phishing or otherwise malicious (desktop antivirus and other things will also prescan URLs). It also protects privacy by defeating click tracking on marketing emails. Google will also pre-load all the images in your email too. You shouldn't take any write action to your database just based on a URL being visited…

You think every email provider crawls links in your email and the inspects the destinations to protect you from spam? That is patently not true, otherwise you would be dealing with utter chaos as you interacted with the internet. If, as the OP claims, Gmail actually _is_ doing this, then that is worrying but it's not the general case. Google pre-loads and caches images, which many people consider problematic, but the…

Well, yes I do believe that. How else do you explain the behavior seen in the article? Outlook.com emails have been doing it for years. https://stackoverflow.com/questions/32851044/how-do-i-stop-o...

Microsoft also scans links sent in encrypted Skype messages. https://arstechnica.com/information-technology/2013/05/think...

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#40

Post by hirundo »

Why isn't rel="nofollow" a solution to this? According to the docs [1]

  Use the nofollow value when other values don't apply, and you'd rather Google not associate your site with, or crawl the linked page from, your site.
It seems like crawling a nofollow anchor tag in an email breaks this rule. Am I reading it wrong, is there an exception for emails, or is Google being inconsistent?

[1] https://developers.google.com/search/docs/advanced/guideline...

Post reply on HN