Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

221–230 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#221

Post by _wldu »

_wldu wrote: post #57
elif wrote: post #33

Earlier quoted context omitted.

one-click unsub is implemented by ignoring scrapers. Google is especially good about using a unique UA string

The access I saw to the registration URL was from cache.google.com and it looked like a client browser 74.51.221.37 - - [19/Aug/2021:22:05:16 +0000] "GET /validate/email/1d00a5c2648c211befd33f5a8a7cbfab HTTP/1.1" 404 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36" $ dig -x 74.51.221.37 +short cache.google.com.

I see other GETs like this one:

216.99.127.196 - - [20/Aug/2021:16:25:42 +0000] "GET /validate/email/2591b346e5b8b435bdde54d797fe23a9 HTTP/1.1" 200 811 "" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36"

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#222

Post by wutbrodo »

nickjj wrote: post #185
wutbrodo wrote: post #180

Earlier quoted context omitted.

Ideally they wouldn't be following redirects _if they're POST requests_, right?

True, that was a bad choice of words but gmail could still load the page, execute the JS which in turn submits the form which is a POST request to your back-end. It's technically not following a redirect but it's doing things beyond just visiting the URL linked in the email due to it executing JS.

Ah interesting, so you're saying that GMail is not likely to be avoiding the POST requests if they're in the JS code? I have a passing, non-professional familiarity with Web practices, so this isn't something I have a great intuition for.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#223

Post by obuda »

rrjanbiah wrote: post #217
obuda wrote: post #205

Earlier quoted context omitted.

Yeah, I don't know about that. Wouldn't it be that the query strings differentiate the two links? I assume so, because of an old trick where query strings are used for ad-hoc cache control as in /style.css?1629472765

Query string is to differentiate the links (to understand which case is getting triggered)

OK, but then the prefetch link as it stands is useless, no?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#224

Post by Silhouette »

meibo wrote: post #102
Silhouette wrote: post #41

Earlier quoted context omitted.

From the very beginning of the web when HTTP was defined, there has been the rule that a GET request should never take an action on its own. Actions should be based on some other method like a POST request. Maybe, but then several decades passed and now billions of people don't use online systems the same ways any more. It used to be that I could send a legitimate mail to a friend or family member and not worry that…

"Things change as time goes on" is not an excuse to ignore valid standards. All big email providers know this and know that GETs should not affect their unsubscribe/confirmation links. It's part of their job.

"Things change as time goes on" is not an excuse to ignore valid standards.

You're talking about an idealised, theoretical world. I'm talking about the real one, the same one where big mail providers routinely ignore valid standards themselves in their efforts to fight real world problems like spam and identity theft.

Again, if someone is going to help themselves to private information then the burden should be 100% on them not to screw anything up for anyone, whether or not that anyone was following any particular set of rules.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#225

Post by Silhouette »

pwdisswordfish0 wrote: post #162
geofft wrote: post #109

Earlier quoted context omitted.

Are you claiming that the contents of emails are public? Which "random sites" see emails between sender and receiver? Yes, proxies and ad-injecting ISPs can see the contents of plaintext HTTP. But that's hardly a reason to say that logging into a website with a password or presenting a cookie doesn't count as an authentication system!

> But that's hardly a reason to say that logging into a website with a password or presenting a cookie doesn't count as an authentication system! That's fine. No one is saying that. They're saying that URLs aren't an authentication (or authorization) system.

They're saying that URLs aren't an authentication (or authorization) system.

I'm curious to know how those advocating a position similar to this think something like a password reset facility on a website should work. We all know security-sensitive systems should rely on alternative methods of authentication anyway, but for those of us living in the real world where billions of people access millions of systems via websites using their email address as ID/fallback, what else would you do that does not rely on trusting emails to be acceptably secret for at least a few minutes?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#226

Post by Silhouette »

rypskar wrote: post #70
Silhouette wrote: post #32

Earlier quoted context omitted.

Exactly. And it's not just one-click unsubscribe. Using a secret link sent to an account's email address as a way to implicitly log in instead of having to remember a password is increasingly common and also an interesting idea in terms of user experience and security. If it's OK for your mail service to open one secret link, where does it stop? Is it also OK for them to spider the content they can reach from that li…

>>Using a secret link sent to an account's email address as a way to implicitly log in instead of having to remember a password is increasingly common and also an interesting idea in terms of user experience The user experience with this is terrible if email is not set up on the device you want to log in from

The user experience of lots of things is terrible if the relevant facilities aren't set up on the device you want to use at the time. It's a curse of our modern, highly-connected and always-online world. You get the same problem with logging into sites that require ID and password from a device that doesn't have your password manager on it.

But the fact is, many systems do work like that and many users do prefer it. I'm taking a pragmatic stance here because assuming the messy, unpredictable real world always follows some theoretical standards at a scale of billions of people and millions of organisations is very predictably going to give bad results in a lot of cases.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#228

Post by ChrisArchitect »

why share this now? It's like a discussion from 2019 that traces back to posts google themselves made in like 2009 about preloading images, sending links thru their own servers etc, anti-phishing etc. why share this now/find a new discussion/link about it.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#229

Post by nickjj »

wutbrodo wrote: post #222
nickjj wrote: post #185

Earlier quoted context omitted.

True, that was a bad choice of words but gmail could still load the page, execute the JS which in turn submits the form which is a POST request to your back-end. It's technically not following a redirect but it's doing things beyond just visiting the URL linked in the email due to it executing JS.

Ah interesting, so you're saying that GMail is not likely to be avoiding the POST requests if they're in the JS code? I have a passing, non-professional familiarity with Web practices, so this isn't something I have a great intuition for.

The basic flow would be:

    - You GET /reset/abc123
    - Your server responds back with a page that has a form
    - There's a hidden field with the token
    - Javascript kicks in and on page load executes the form as a POST request
    - Your server responds to that POST request and does whatever it needs to do
All of that is kicked off by gmail visiting /reset/abc123, and now it comes down to whether or not gmail's pre-visiting code will run the JS on the page. If not, then the above workflow fixes this issue, if it does then you're in the same position as avoiding all of this and having a GET /reset/abc123 perform the destructive action.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#230

Post by prepend »

acdha wrote: post #183
prepend wrote: post #157

Earlier quoted context omitted.

It’s pretty easy to measure. I had a site with a verification step. And we would see like 20% drop off of people who clicked on the link but never confirmed. Not sure why. We didn’t have them copy and paste anything, just click a confirm button. Switching to no confirm obviously changed this to 0% drop off of people who clicked the link, but the number of people who clicked was the same. It was curious to me why peop…

How would you have known if that 20% were real people and not bot activity?

I don’t necessarily. But they have active accounts that do stuff and had the drop off activity consistent with “normal users.”

So it doesn’t matter to me if they were bots or not.

For example, 100 users clicked on the first link, 80 completed, and had normal account activity (clicking on stuff, uploading and downloading things, etc).

100 users clicked on the second link and then had normal account activity.

Maybe they were all bots, but they seemed human based on the “normal activity.”

Post reply on HN