Can this be exploited to confirm some action automatically?
Or to prevent some site from being indexed by flooding it with invalid links?
“Magic links” can end up in Bing search results, rendering them useless
31–40 of 243 posts
Re: “Magic links” can end up in Bing search results, rendering them useless
#32Isn't the quick fix that you arrive at some page, and there have to press a button or load some JS to do some action? AFAIK most email providers (like Gmail) will also visit links. Therefore you shouldn't do actions directly on the GET request. For instance if you have an unsubscribe link and all you have to do is visit that address, most of your subscribers will be accidentally unsubscribed. Same if you paste a link…
Yeh I think you're right, an extra JS step on the page that the email link leads to would help a lot.
Re: “Magic links” can end up in Bing search results, rendering them useless
#33Earlier quoted context omitted.
I found them in Bing results
That should be clearer in the article. It's not evident from the SO question or from what you've actually written. A screenshot of those search results would go a long way towards making the article sound more credible.
Yeh I was a bit reluctant to post that as it doesn't look great for my app! But here's the results: https://www.bing.com/search?q=https%3A%2F%2Fshoprocket.io%2F...
Re: “Magic links” can end up in Bing search results, rendering them useless
#34Can this be exploited to confirm some action automatically? Or to prevent some site from being indexed by flooding it with invalid links?
Absolutely
Re: “Magic links” can end up in Bing search results, rendering them useless
#35Can this be exploited to confirm some action automatically? Or to prevent some site from being indexed by flooding it with invalid links?
[deleted]
Re: “Magic links” can end up in Bing search results, rendering them useless
#36This would kind of break single-use links, no? That seems like a real nuisance.
Re: “Magic links” can end up in Bing search results, rendering them useless
#37Earlier quoted context omitted.
Essentially yes - but "previewing" link and sending that link to Bingbot to crawl and index is another matter. Imagine you send someone a "private" link to a file...Bing sees that and indexes it for the world to see. Not cool.
“Private links” should be covered by robots.txt. The only case I see this happening is for those “anyone with link” shares and those are easy to cover.
AFAIK, most of those "private" links are actually just "unlisted" but they're still public. I'm sure Bing is indexing those too...
Re: “Magic links” can end up in Bing search results, rendering them useless
#38This would kind of break single-use links, no? That seems like a real nuisance.
Exactly. From what I've heard today it sounds like most apps have an extra step between the email link and the login, usually a JS step, to check for bots.
Not adding that was my downfall I think.
Re: “Magic links” can end up in Bing search results, rendering them useless
#39>As of Feb 2017 Outlook ( https://outlook.live.com/ ) scans emails Makes me curious if only the free, online, Outlook does this. There's also paid O365 online Outlook and the fat client Outlook.
Office 365 just seems to make links useless for security now.
Our 365 instance now turns every link into this massive monolith of safelink checking URLs through Microsoft, making literally every email undeterminable if it is a phishing attempt or otherwise without turning to pasting it into one of many online 'decoders'...
Re: “Magic links” can end up in Bing search results, rendering them useless
#40tldr: In 2022, whether you are a paying customer or a free customer, YOU are the product and you will be squeezed for all you got (not specific to Microsoft at all)