Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Magic links” can end up in Bing search results, rendering them useless

medium.com

Post reply on HN
Print view View original

121–130 of 243 posts

Re: “Magic links” can end up in Bing search results, rendering them useless

#121

Post by throwaway14356 »

rsbadger wrote: post #107
_8j50 wrote: post #104

Earlier quoted context omitted.

It is common for corporate email security appliances as well. URLs should not be used for authentication neither should email. I really want to pick brains of people that work on these types of systems to see why they don't think so.

Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending them an email link?

a confirmation code?

Also, mail might not live on the same computer.

Re: “Magic links” can end up in Bing search results, rendering them useless

#122

Post by causi »

morley wrote: post #81
causi wrote: post #80

Earlier quoted context omitted.

Wouldn't it be trivial to keep the list of malicious pages locally and not send any data?

If I were designing a system like this, I would not trust clients to perform legitimate analysis nor report legitimate results.

What? But you're the one writing the client.

Re: “Magic links” can end up in Bing search results, rendering them useless

#123

Post by throwaway14356 »

rbut wrote: post #52

I have observed this, but also found that BingBot modifies the query string parameters of your URL. It does this by changing a character of the URL, possibly in an attempt to find new pages? I noticed this because I generate links with a signed token to ensure integrity and started receving invalid token crash reports in Sentry, always from BingBot.. To fix this I had to move the tokens from the query string into the…

i imagine one could try use the location hash. it isnt send with the request

Re: “Magic links” can end up in Bing search results, rendering them useless

#125

Post by sofixa »

bigtones wrote: post #14

Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.

> Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks

The problem with that is that the logic is broken. Microsoft cannot possibly know all phishing sites, especially for smaller things. By obfuscating the link the user can no longer verify it by themselves without clicking, but Microsoft will say it's safe. So the user is left with a false sense of security and are worse off.

It only works for huge sites ( e.g. mytwitter.lol phishing for twitter and similar), but drastically lowers the chance of less high profile phishing being caught.

Re: “Magic links” can end up in Bing search results, rendering them useless

#126

Post by sofixa »

causi wrote: post #122
morley wrote: post #81

Earlier quoted context omitted.

If I were designing a system like this, I would not trust clients to perform legitimate analysis nor report legitimate results.

What? But you're the one writing the client.

Doesn't matter. Never trust the client - it's outside of your control, it can be patched, it can be hacked, it can be spoofed, etc.

Re: “Magic links” can end up in Bing search results, rendering them useless

#127

Post by dubya »

tyingq wrote: post #5

>As of Feb 2017 Outlook ( https://outlook.live.com/ ) scans emails Makes me curious if only the free, online, Outlook does this. There's also paid O365 online Outlook and the fat client Outlook.

It's not just the free client. My university uses O365 (?) and the links are in emails checked on other clients (Mail.app of ios/macos).

Admin has also turned on "You don't often get email for __" warnings that edit the email so that gets included in replies. Very useful when you could a new large cohort of student email correspondents each semester :(

Re: “Magic links” can end up in Bing search results, rendering them useless

#128

Post by ck2 »

And google harvests all your online purchase emails to log everything you've bought.

https://www.techspot.com/news/80134-google-uses-receipts-sen...

Just a reminder any email left on any online service over six months in the USA is allowed to be read by any law enforcement agency without a warrant.

You'd think these services would have a six-month auto-delete feature but nope.

There's good reason why there was a email server in the basement, everyone should have their email server where at least a physical warrant is needed.

Re: “Magic links” can end up in Bing search results, rendering them useless

#129

Post by [deleted] »

rsbadger wrote: post #108
dmw_ng wrote: post #102

Earlier quoted context omitted.

Links like this are stupid regardless of Outlook's behaviour because they require a perfectly reliable client and network and user in a perfectly undisturbed flow. If I can't F5, if I double-click, if my mouse is wonky, my wifi is bad, my power goes out, my computer hangs, my DSL dies just after a click, if I accidentally close the tab.. there are any of a thousand reasons why abusing GET for a one-time-use page or r…

The only purpose of this link was to verify that the email address is valid. Once it’s verified, you can login.

[deleted]
Post reply on HN