Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

111–120 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#111

Post by kyrra »

iamdual wrote: post #104
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

You need to authenticate the user before the activation.

This. You could rely on a cookie during the get request as well, that you set on the users browser during registration. Or re-auth after click.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#112

Post by kuu »

Doxin wrote: post #74
paxys wrote: post #63

Earlier quoted context omitted.

I'm sure Google uses a specific user agent to make a request, so you can filter that out. A better solution is to assume that some middleman (email server or client) will always try to access links in the email. Instead send the user a code and have them manually enter it on the linked page.

Or link them to a page with a POST form that actually performs the action. That way you only add a single click to the flow, and no remotely sane software will automatically perform POST requests to arbitrary urls.

> no remotely sane software will automatically perform POST requests to arbitrary urls

I'm not a web developer. Out of curiosity, why is that?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#113

Post by janci »

mnahkies wrote: post #94
vs4vijay wrote: post #84

Earlier quoted context omitted.

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

Is it possible to embed a link that uses POST in an email? I can't think of a way unless form tags work, but then the link wouldn't work in a plain text email reader

You can use in email body (obviously does not work in plaintext mode)

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#115

Post by jsiepkes »

judge2020 wrote: post #4

This is a good feature in my opinion. Why should I let the sender know when I click on tracking links or view the email? If you really want to, just filter out clicks from AS15169.

> This is a good feature in my opinion.

Some links include automatic login functionality. I definitely don't want Google logging in to my accounts.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#116

Post by SevenSigs »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

I had the same issue with Microsoft's email service and Facebook messages. How I dealt with it was to not email private links... I use Element these days or email links to encrypted files in some circumstances. I wish websites would stop using email and phone verifications...

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#117

Post by motogpjimbo »

kuu wrote: post #112
Doxin wrote: post #74

Earlier quoted context omitted.

Or link them to a page with a POST form that actually performs the action. That way you only add a single click to the flow, and no remotely sane software will automatically perform POST requests to arbitrary urls.

> no remotely sane software will automatically perform POST requests to arbitrary urls I'm not a web developer. Out of curiosity, why is that?

For precisely the reason being discussed here: GET requests can be performed automatically for many reasons. For example, if you've ever pasted a URL into a Slack channel (or similar) and seen the link converted into a thumbnail of the page a few moments later, you've seen a piece of software issue a GET request on your behalf. Now imagine that wasn't a link to a page but a link to an something that modified your account - resetting your password, for example.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#118

Post by duckmysick »

ace2358 wrote: post #95
duckmysick wrote: post #86

Earlier quoted context omitted.

Clicking a link (one action) is easier than copying a code and pasting it (two actions). It's possible the user will copy the wrong thing or paste the code into a wrong field, including the browser address bar. All of that may affect the sign-up rate.

Kinda. I often read my email on my phone while working on my desktop. (Or visa versa). In these situations, a code is always better. I hate the links personally.

How many times having to click a link (instead of entering a code) stopped you from finishing a sign-up process?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#119

Post by karolist »

kuu wrote: post #112
Doxin wrote: post #74

Earlier quoted context omitted.

Or link them to a page with a POST form that actually performs the action. That way you only add a single click to the flow, and no remotely sane software will automatically perform POST requests to arbitrary urls.

> no remotely sane software will automatically perform POST requests to arbitrary urls I'm not a web developer. Out of curiosity, why is that?

POST requests typically perform modifications on the server based on user action, like POST'ing this comment. GET requests should be idempotent.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#120

Post by bawolff »

mnahkies wrote: post #94
vs4vijay wrote: post #84

Earlier quoted context omitted.

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

Is it possible to embed a link that uses POST in an email? I can't think of a way unless form tags work, but then the link wouldn't work in a plain text email reader

Depending on how your app works, non-idempotent links in emails can often be an over-looked csrf vector. Sometimes people also make such links auto log people in which can be problematic.
Post reply on HN