Gmail is opening and caching URLs within emails without user intervention (2019)

Post by account42 » Fri, Aug 20, 2021, 10:51 AM UTC

Tade0 wrote: post #126

vs4vijay wrote: post #84

Earlier quoted context omitted.

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

This endpoint is idempotent - clicking that link multiple times has the same effect as doing it once.

Post by c22 » Fri, Aug 20, 2021, 10:52 AM UTC

geofft wrote: post #109

hyperman1 wrote: post #105

Earlier quoted context omitted.

I understand they are known to the public? Every MTA from any random site between the sender and receiver gets the mail, including secrets. They can all decide to scan the site, write them in a log,... Then, when you click the link, if you don't have https, anything between receiver and site also gets a copy of the link. And there are proxys, add injecting ISPs, etc.

Are you claiming that the contents of emails are public? Which "random sites" see emails between sender and receiver? Yes, proxies and ad-injecting ISPs can see the contents of plaintext HTTP. But that's hardly a reason to say that logging into a website with a password or presenting a cookie doesn't count as an authentication system!

Post by Filligree » Fri, Aug 20, 2021, 11:13 AM UTC

xunn0026 wrote: post #128

vs4vijay wrote: post #84

Earlier quoted context omitted.

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

I was just wondering if a web page that counts visitors is idempotent. Not?

Post by chrisshroba » Fri, Aug 20, 2021, 11:15 AM UTC

janci wrote: post #113

mnahkies wrote: post #94

Earlier quoted context omitted.

Is it possible to embed a link that uses POST in an email? I can't think of a way unless form tags work, but then the link wouldn't work in a plain text email reader

You can use in email body (obviously does not work in plaintext mode)

Post by _wldu » Fri, Aug 20, 2021, 11:19 AM UTC

paxys wrote: post #63

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

I'm sure Google uses a specific user agent to make a request, so you can filter that out. A better solution is to assume that some middleman (email server or client) will always try to access links in the email. Instead send the user a code and have them manually enter it on the linked page.