201–210 of 271 posts
Earlier quoted context omitted.
Here's a quick PoC: location.href = "/actual_validate/email/1d00a5c2648c211befd33f5a8a7cbfab?js=1"; Click to confirm your account
Why the prefetch though? Reason being bots don't open them? If so, this is a really good idea!
Earlier quoted context omitted.
You could add a single line of JS to have it auto submitted as well
Wouldn't that be equivalent to just doing a GET?
I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…
This is like the reason I quit using Skype 10 years ago. My colleagues and I noticed the same thing: send a link in a chat, and within seconds to minutes a request (or more) for that URL from a Microsoft server would be logged. Done and bye.
Earlier quoted context omitted.
Last time I looked into this, Gmail was not loading and caching images. Is there any evidence that this has changed? What is being described here is likely being done for some other purpose.
Google claimed to do that. > Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers. Https://gmail.googleblog.com/2013/12/images-now-showing.html
Earlier quoted context omitted.
Why the prefetch though? Reason being bots don't open them? If so, this is a really good idea!
It’s likely faster for the noscript case.
I assume so, because of an old trick where query strings are used for ad-hoc cache control as in /style.css?1629472765
Earlier quoted context omitted.
You should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.
We've done this for over 2 years now, and over 200k users never ran into this. Also not within government users.
People don't tend to report problems like "my account was activated sooner than I expected"
Earlier quoted context omitted.
This is like the reason I quit using Skype 10 years ago. My colleagues and I noticed the same thing: send a link in a chat, and within seconds to minutes a request (or more) for that URL from a Microsoft server would be logged. Done and bye.
Does Skype generate preview images? Most chat clients do at this point. They all have to access the link to get the relevant metadata to do that.
I'd be fine if the fine print in the EULA provides a guarantee that the feature scans content solely for generating previews, and that M$ keeps no copy of it, etc....But, I'm sure I'd go blind looking for such text in the EULA.
Trying to explain this to some marketing people looking at "click through rates" was extremely frustrating. This screwed with a lot of a/b testing analytics everywhere and I suspect most people were none the wiser.
My heart bleeds for the oh-so-poor marketing people whose data, consisting of unwitting human test subjects, has been poisoned.
Earlier quoted context omitted.
Depending on context and implementation details, this can often be a security issue (csrf or something similar). Probably not in the unsubscribe case though
Obviously you need to make sure your API is not susceptible to CSRF but that goes without saying... Should I also tell him to password protect his database? :P
You can (or used to be able to) embed an HTML form inside an email, and clicking the submit button will perform a POST if that is the method specified. This would probably solve the issue. You avoid an extra click on the resulting page, it's a POST which matches the standard, and Google (presumably) won't hit it.