Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

261–270 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#261

Post by pwdisswordfish0 »

geofft wrote: post #256
pwdisswordfish0 wrote: post #245

Earlier quoted context omitted.

> I'm not following your argument. It's almost certainly true that you do, you're just being dishonest. (The alternative is worse.) > What is this thing that URLs are which makes them public? You mean other than being identifiers ( universal identifiers, at that)? It's like you've never used or encountered someone else articulating an argument that incorporates (or would be appropriate to incorporate) the phrase "by…

I understand full well that you are claiming that URLs are public by definition. I am disputing that you are interpreting the definition correctly. The invention of the card catalog and the Rolodex does not compromise anything, because the card catalog and the Rolodex simply catalogue information that is public, but in a poorly-accessible format. No card catalog can find the name of an unpublished, self-printed book…

You're mixing up "public" with "published" (intentionally, perhaps).

> I am disputing that you are interpreting the definition correctly.

And I question whether you've actually made an attempt to grok the subject as a matter of definition, rather than substituting your synthesis (based on an experiential mental model of the subject derived from firsthand inference) in place of what URLs actually are actually supposed to be. (Meaning the playing dumb comment would be apropos here as well.)

> Can you explain, clearly, how this URL would end up catalogued?

The mechanics of how don't have to be explained, because that's how definitions work (whether you accept it or not). Explaining how is not a pre-requisite to what.

But if you're really dying for some missing insight, how about pausing to demonstrate some awareness of the catalyst of this tedious exchange: that a company that was founded on the basis related to cataloguing documents and their public identifiers is (shocker) doing that, right before doing things to/with them—and this has led to people who built up a model of the world similar to yours getting upset because the mistaken assumptions that went into building that model conflict with they're now being told is happening.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#262

Post by futhey »

One of my favorite side effects of this feature is that, Firebase Authentication, which is entirely run by another segment of Google, constantly throws errors about this to the user, which they don't understand.

I get a support request at least once a week from a user who "Doesn't understand why they can't verify their email".

Turns out, their Gmail account already verified it by clicking the link before they opened the email, and they didn't think to try signing in, because they couldn't even verify the email.

¯\_(ツ)_/¯

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#263

Post by Anunayj »

futhey wrote: post #262

One of my favorite side effects of this feature is that, Firebase Authentication, which is entirely run by another segment of Google, constantly throws errors about this to the user, which they don't understand. I get a support request at least once a week from a user who "Doesn't understand why they can't verify their email". Turns out, their Gmail account already verified it by clicking the link before they opened…

wait... isn't that messed up though..? Anyone can register a account with my email.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#265

Post by debaserab2 »

weird-eye-issue wrote: post #252
bawolff wrote: post #251

Earlier quoted context omitted.

So there's two scenarios: Scenario a) No authentication-y bits in the url. User goes to the url, site checks if the user is already logged in via a cookie. If so, does the POST request. Typically in this case the urls are easily guessable, so that's an easy CSRF. In principle they could be made per-user (some sort of HMAC on a user+timestamp). In practise, I think its fairly common for websites not to do that in this…

What you are describing isn't even CSRF

Yes it is - and it's worthwhile to read bawolffs well written explanation of how exactly it could be exploited. Downplaying security vulnerabilities of this sort is precisely how database leaks happen.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#267

Post by bradknowles »

upofadown wrote: post #204
wodenokoto wrote: post #200

Earlier quoted context omitted.

Google claimed to do that. > Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers. Https://gmail.googleblog.com/2013/12/images-now-showing.html

Proxy servers, not caching servers.

When are proxy servers not caching?

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#268

Post by bradknowles »

whateveracct wrote: post #19
_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

Make the user take action after opening the link. Like click a button.

Make the link password protected, and they don’t get the password in the same e-mail message.

Kinda hard to pre-scan a URL if you can’t provide the password for it.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#269

Post by Silhouette »

skybrian wrote: post #243
Silhouette wrote: post #242

Earlier quoted context omitted.

What, specifically?

Some other software, other than Google, might follow the link automatically. Because the standard allows that. (Also, consider mistaken clicks, which happen all the time on touch screens.)

Some other software, other than Google, might follow the link automatically. Because the standard allows that.

That is literally the opposite of what good native email clients have been doing for a long time. They won't even open linked images and the like by default, to prevent tracking.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#270

Post by addingnumbers »

toshk wrote: post #253
addingnumbers wrote: post #206

Earlier quoted context omitted.

How do you know your users have never run into this? People don't tend to report problems like "my account was activated sooner than I expected"

We use it to log in users. We quickly get complaints if something doesn't work well.

But your users ought to believe it works well to have google's servers respond to the activation link instead of requiring them to click it themselves, so no complaints.

The verification process serves only you, the administrator. To everyone else it's a tedious obstacle.

Nobody will reach out to you to say "I made it through the registration process just fine but it was slightly less burdensome than I expected, is everything OK?"

If you want to know if Google is hitting your activation URLs, check your access logs. Your users will almost certainly not realize it happened. Even if they do notice it, there is no impact on them and no motivation to inform you. You would have to be extremely lucky to hear about it from a user.

Post reply on HN