Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

191–200 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#191

Post by t00 »

obuda wrote: post #187
eplanit wrote: post #181

Earlier quoted context omitted.

This is like the reason I quit using Skype 10 years ago. My colleagues and I noticed the same thing: send a link in a chat, and within seconds to minutes a request (or more) for that URL from a Microsoft server would be logged. Done and bye.

Wouldn't be surprised if pretty much every communication service is doing this. I sent a link to a large file over Viber and immediately some ip connected and started downloading. Stopped at 350mb of around 3.5gb. I get that they want to show thumbnails or whatnot, but they just don't discriminate between content types.

That is a great way to do a cross-link DDoS of unsolicited link opening services - send 1000 messages with google links on skype and send 1000 gmail messages with microsoft links there, all gigabytes in size...

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#192

Post by shadowgovt »

Tade0 wrote: post #126
vs4vijay wrote: post #84

Earlier quoted context omitted.

That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.

This endpoint is idempotent - clicking that link multiple times has the same effect as doing it once.

Correct. Idempotency isn't precisely the right concept to appeal to here. The right concept is that GET requests are assumed by convention to be "safe," which implies they aren't tied to user interaction. "...user did not request the side-effects, so therefore cannot be held accountable for them" (https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#:~:te....).

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#193

Post by clusterfish »

miken123 wrote: post #124
harg wrote: post #96

Earlier quoted context omitted.

You’d need to send the user to the verify page and populate a form with their token from the url. Then submit the form, either automatically or by getting the user to manually hit a button.

You should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.

Half of unsubscribe links seem to auto-submit. Are they all broken in O365?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#194

Post by miken123 »

toshk wrote: post #158
miken123 wrote: post #124

Earlier quoted context omitted.

You should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.

We've done this for over 2 years now, and over 200k users never ran into this. Also not within government users.

It could very well be that your specific Javascript does not run automatically or does not run correctly. I see the same with one of our auto-submitting forms. I do not know whether or not that is intentional on Microsoft's part. But other users have had different experiencies, so be aware that Microsoft may 'fix' their issue on some day and all of a sudden all your users will start clicking/unsubscribing/whatevering automatically.

See https://blog.healthchecks.io/2019/12/preventing-office-365-a... for someone who did have this experience.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#195

Post by eu »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

We've seen something similar with one of the email campaign services. The Unsubscribe links were "clicked" within a minute of emails being sent. Other services show you a message and process the unsubscribe on a POST request.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#197

Post by winrid »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

Make the link expire after a certain period of time and not after first click.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#198

Post by winrid »

iamdual wrote: post #104
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

You need to authenticate the user before the activation.

What about magic links? :)

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#199

Post by weird-eye-issue »

bawolff wrote: post #122
weird-eye-issue wrote: post #67

Earlier quoted context omitted.

Btw you could just have JS do a POST request, the user doesn't need to do anything except open the page. This is how unsubscribe pages work.

Depending on context and implementation details, this can often be a security issue (csrf or something similar). Probably not in the unsubscribe case though

Obviously you need to make sure your API is not susceptible to CSRF but that goes without saying... Should I also tell him to password protect his database? :P

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#200

Post by wodenokoto »

upofadown wrote: post #147
wodenokoto wrote: post #98

Earlier quoted context omitted.

I believe this is how they fetch images without meaningfully accessing tracking pixels. If everything send to gmail is opened upon arrival and cached, you know nothing about when or if the recipient actually opened the email.

Last time I looked into this, Gmail was not loading and caching images. Is there any evidence that this has changed? What is being described here is likely being done for some other purpose.

Google claimed to do that.

> Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers.

Https://gmail.googleblog.com/2013/12/images-now-showing.html

Post reply on HN