91–100 of 243 posts
Earlier quoted context omitted.
They are publishing them - it has bitten us (e.g. expired one click links for customers ending up on Bing from their emails)
If you can say for certain that the links being published are coming from the malware scanning, and not being taken from users' browser sessions that are using Microsoft Edge you should elaborate on this.
Earlier quoted context omitted.
Yes, but there is no indication they are publishing it in the search results. The original post is just complaining that the malware scanning is visiting the links. They come to the following conclusion > This effectively makes all one-time use links like login/pass-reset/etc useless. Which we all know is not true because sites like onetimesecret.com allow for entering a separate password to prevent this sort of thin…
They are publishing them - it has bitten us (e.g. expired one click links for customers ending up on Bing from their emails)
All pages with one click links should have no index follow or no index no follow. Your seo consultant (if you have one) should have advised you on this.
I am not saying this excuses the privacy violation but just suggesting there are things we can do...
Earlier quoted context omitted.
The HTTP GET method is idempotent: it should behave the same way on multiple accesses. A single use link, e.g. for resetting a password or confirming a subscription, will usually show a webpage with a form that does a POST. Once that POST has been performed, the single use link is used up. Single use links will mostly have a one-time secret that should not be leaked. Mails that contain such links or any sensitive inf…
How do you send mail to an Outlook user and encrypt it so Microsoft can't snoop on it?
Earlier quoted context omitted.
If you can say for certain that the links being published are coming from the malware scanning, and not being taken from users' browser sessions that are using Microsoft Edge you should elaborate on this.
That would be even worse.
It's about trying to get to the core of the issue, not just the random speculation going on in the article and in this comment thread.
Earlier quoted context omitted.
I have observed that twitter's bot hits links within seconds of being tweeted. The traffic comes from several locations, not all twitter ASNs. One interesting source is Apple. Their bot/scanner hits soon after.
Anyone paying for the firehose access can do this.
[0] https://www.washingtonpost.com/technology/2022/06/08/elon-mu...
Earlier quoted context omitted.
They are publishing them - it has bitten us (e.g. expired one click links for customers ending up on Bing from their emails)
If you can say for certain that the links being published are coming from the malware scanning, and not being taken from users' browser sessions that are using Microsoft Edge you should elaborate on this.
Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.
Even if Microsoft claim this is about security scanning, isn't it fairly trivial to configure your webserver to serve up different content depending on the User-Agent request header? BingBot scans the link, gets a dummy page with 'clean' content, Microsoft delivers the email message to the user, user clicks through the link with actual browser, gets phishing / malware content...
It's not just MS. Lots of enterprise email security stuff works like this.
Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.
I just love it when they "scan" password reset links.