Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

121–130 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#121

Post by enlyth »

ageofzfarm wrote: post #108
enlyth wrote: post #100

We have had the same problem with Microsoft where our marketing department is effectively DDoSing our service by sending out links to 50k+ users. We would get spikes of thousands of requests per second from Microsoft IP addresses, which after some googling were linked to their threat detection.

Threat detection is becoming essential because of ransomware phishing and alikes, protection from click tracking is good too. Just send email in tranches. If the marketing department is sending too many e-mails for the web server to handle, then the volume is probably out of proportion to the company and what they are doing is probably just spam.

I agree, I'm not blaming Microsoft here, and it is our problem to solve (the service should handle the traffic, and/or the emails should be staggered over time)

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#122

Post by bawolff »

weird-eye-issue wrote: post #67
_wldu wrote: post #22

Earlier quoted context omitted.

Thanks. That's good advice.

Btw you could just have JS do a POST request, the user doesn't need to do anything except open the page. This is how unsubscribe pages work.

Depending on context and implementation details, this can often be a security issue (csrf or something similar). Probably not in the unsubscribe case though

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#123

Post by tonypace »

duckmysick wrote: post #118
ace2358 wrote: post #95

Earlier quoted context omitted.

Kinda. I often read my email on my phone while working on my desktop. (Or visa versa). In these situations, a code is always better. I hate the links personally.

How many times having to click a link (instead of entering a code) stopped you from finishing a sign-up process?

Nobody remembers the exact moment they stopped thinking about something because it was easier not to.

Ragequitting is one way to exit a process, but just not going to the next step from distraction is surely more common.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#124

Post by miken123 »

harg wrote: post #96
mnahkies wrote: post #94

Earlier quoted context omitted.

Is it possible to embed a link that uses POST in an email? I can't think of a way unless form tags work, but then the link wouldn't work in a plain text email reader

You’d need to send the user to the verify page and populate a form with their token from the url. Then submit the form, either automatically or by getting the user to manually hit a button.

You should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#125

Post by raxxorrax »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

That is a security risk that Google is causing here. While I agree that URLs shouldn't necessarily be used to store secrets, the usual password reset mail is nothing else and the mechanism has merit.

https://www.w3.org/TR/capability-urls/

It is also a good way to communicate between two parties that don't want to have user account in any service, we constantly request input from B2B customers by providing forms with a capability URLs. An no, we don't want to use an identity provider. Maybe good ones like auth0. Amazon Cognito is pretty decent in my opinion, but Amazon is also big tech. Industrial espionage is something real for that matter.

We have mail providers that respect privacy, just saying... I don't understand the love for Gmail at all, especially when you use a mail client, which I would heavily recommend to everyone.

Ironically a lot of security scanner also do follow links. Understandable, but I just hope they don't plaster the logs too much...

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#126

Post by Tade0 »

vs4vijay wrote: post #84
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

This endpoint is idempotent - clicking that link multiple times has the same effect as doing it once.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#127

Post by jbverschoor »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

A "GET" request is not supposed to alter state.

On the other hand. It validates the email address more quickly, so you could even refresh/poll when it's verified automatically

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#128

Post by xunn0026 »

vs4vijay wrote: post #84
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

I was just wondering if a web page that counts visitors is idempotent. Not?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#129

Post by motoboi »

vs4vijay wrote: post #84
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

Well, this is why your email provider should not open your links for you. Use a different email provider instead.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#130

Post by kosinus »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

I’ve also seen anti-virus do this, though I don’t remember which brand.
Post reply on HN