51–60 of 243 posts
tldr: In 2022, whether you are a paying customer or a free customer, YOU are the product and you will be squeezed for all you got (not specific to Microsoft at all)
I don't think that's very surprising for most people, the real takeaway is that not only will Bing read your emails, but they may also index any links you send and serve them in search results.
I noticed this because I generate links with a signed token to ensure integrity and started receving invalid token crash reports in Sentry, always from BingBot..
To fix this I had to move the tokens from the query string into the URL itself to avoid BingBot changing it. eg.
http://mysite.io/do-action?token=shvgaaehr2rnyxhh-391-1 to http://mysite.io/do-action/shvgaaehr2rnyxhh-391-1/
Anyone else noticed this?
Earlier quoted context omitted.
That should be clearer in the article. It's not evident from the SO question or from what you've actually written. A screenshot of those search results would go a long way towards making the article sound more credible.
Yeh I was a bit reluctant to post that as it doesn't look great for my app! But here's the results: https://www.bing.com/search?q=https%3A%2F%2Fshoprocket.io%2F...
Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.
Scanning something for malware and publishing it in search results seem like 2 completely different things to me...?
Google reads your emails. Whenever I buy a flight, google puts the date on "my" calendar. Just lets not pretend Microfsoft is especially bad at this, ok?
>As of Feb 2017 Outlook ( https://outlook.live.com/ ) scans emails Makes me curious if only the free, online, Outlook does this. There's also paid O365 online Outlook and the fat client Outlook.
Office 365 just seems to make links useless for security now. Our 365 instance now turns every link into this massive monolith of safelink checking URLs through Microsoft, making literally every email undeterminable if it is a phishing attempt or otherwise without turning to pasting it into one of many online 'decoders'...
Though that is optional and configurable.
It might lead to sensitive data leak as cloud storage links can also be crawled to Bing
> It might lead to sensitive data leak as cloud storage links can also be crawled to Bing no what might link to sensitive data leak is fools who store sensitive data on unprotected links
Are there any cloud vendors that don't follow this approach?
Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.
Scanning something for malware and publishing it in search results seem like 2 completely different things to me...?
The original post is just complaining that the malware scanning is visiting the links.
They come to the following conclusion
>This effectively makes all one-time use links like login/pass-reset/etc useless.
Which we all know is not true because sites like onetimesecret.com allow for entering a separate password to prevent this sort of thing when it does happen.
It would be an interesting discussion to talk about what Microsoft's whitelisting process looks like, but the original article doesn't seem to understand what is going on well enough to drive the conversation in that direction.