Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Magic links” can end up in Bing search results, rendering them useless

medium.com

Post reply on HN
Print view View original

41–50 of 243 posts

Re: “Magic links” can end up in Bing search results, rendering them useless

#41

Post by rsbadger »

iJohnDoe wrote: post #10
lizardactivist wrote: post #2

Not the least surprised. By accepting the EULA and using the service free of monetary charge, you are instead paying with the contents of your e-mails and adress-book.

If it’s Outlook doing the dirty work then running your own mail server won’t get rid of this problem. Outlook is the client reading the links regardless of mail server. Also, somewhat a different topic, people that run their own mail servers might also still use Outlook.

Exactly. I also noticed Bing had accessed some non microsoft tokens too. Even gmail accounts were affected. I assume some people have connected their gmail account to the outlook client?

Re: “Magic links” can end up in Bing search results, rendering them useless

#42

Post by feet »

cryptonym wrote: post #21
feet wrote: post #3

Earlier quoted context omitted.

Another reason to run your own email server

How would you prevent recipients from using Outlook?

We can control one side of the equation, so that prevents them from reading some at least.

Re: “Magic links” can end up in Bing search results, rendering them useless

#43

Post by oever »

christophilus wrote: post #36

This would kind of break single-use links, no? That seems like a real nuisance.

The HTTP GET method is idempotent: it should behave the same way on multiple accesses.

A single use link, e.g. for resetting a password or confirming a subscription, will usually show a webpage with a form that does a POST. Once that POST has been performed, the single use link is used up.

Single use links will mostly have a one-time secret that should not be leaked. Mails that contain such links or any sensitive information should be encrypted.

Re: “Magic links” can end up in Bing search results, rendering them useless

#44

Post by rsbadger »

bezoz wrote: post #40

tldr: In 2022, whether you are a paying customer or a free customer, YOU are the product and you will be squeezed for all you got (not specific to Microsoft at all)

I don't think that's very surprising for most people, the real takeaway is that not only will Bing read your emails, but they may also index any links you send and serve them in search results.

Re: “Magic links” can end up in Bing search results, rendering them useless

#45

Post by Beltiras »

rsbadger wrote: post #38
christophilus wrote: post #36

This would kind of break single-use links, no? That seems like a real nuisance.

Exactly. From what I've heard today it sounds like most apps have an extra step between the email link and the login, usually a JS step, to check for bots. Not adding that was my downfall I think.

There's also robots.txt

Re: “Magic links” can end up in Bing search results, rendering them useless

#48

Post by FrenchDevRemote »

OnePlusfans99 wrote: post #46

It might lead to sensitive data leak as cloud storage links can also be crawled to Bing

> It might lead to sensitive data leak as cloud storage links can also be crawled to Bing

no what might link to sensitive data leak is fools who store sensitive data on unprotected links

Re: “Magic links” can end up in Bing search results, rendering them useless

#50

Post by FrenchDevRemote »

Semaphor wrote: post #18
matsemann wrote: post #4

Isn't the quick fix that you arrive at some page, and there have to press a button or load some JS to do some action? AFAIK most email providers (like Gmail) will also visit links. Therefore you shouldn't do actions directly on the GET request. For instance if you have an unsubscribe link and all you have to do is visit that address, most of your subscribers will be accidentally unsubscribed. Same if you paste a link…

> AFAIK most email providers (like Gmail) will also visit links. I keep hearing this, but our newsletter system has been using GET unsubscribe links since at least 2007 (but probably longer), and we never found a wave of Gmail users unsubscribing, we still have a lot of them. I wonder if this is simply an urban legend, if Gmail tries to recognize unsubscribe links, or if there is something else going on.

your newsletter system probably ignore bots or some IPs
Post reply on HN