Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Magic links” can end up in Bing search results, rendering them useless

medium.com

Post reply on HN
Print view View original

141–150 of 243 posts

Re: “Magic links” can end up in Bing search results, rendering them useless

#141

Post by kornhole »

I struggle to understand how private companies like mine are OK with MS reading all employee email and processing it through their AI. I get these daily creepy emails from MS saying that you said you would do this yesterday.. I have resorted to using burnernote.com, not to hide anything from my company but to hide it from MS who competes with us on some products. I guess burnernote.com will also not work anymore since it creates one-time links.

We are monitoring you for your protection.

Re: “Magic links” can end up in Bing search results, rendering them useless

#142

Post by mbesto »

Linosaurus wrote: post #135
causi wrote: post #80

Earlier quoted context omitted.

Wouldn't it be trivial to keep the list of malicious pages locally and not send any data?

You mean, push bing's entire list of malicious websites to every client? I doubt they want to or can do that. And also use the local client to scan unknown links? They probably dont want outsiders to have access to this code.

Plus, how do you keep it from going stale?

Re: “Magic links” can end up in Bing search results, rendering them useless

#143

Post by shantnutiwari »

roci89 wrote: post #116
TremendousJudge wrote: post #109

Earlier quoted context omitted.

I have seen services where you have to click a link every time you want to log in

They are called magic links... only thing magic about them is their ability to annoy me

>They are called magic links... only thing magic about them is their ability to annoy me

I love them and prefer them to creating yet another account with a password.

Re: “Magic links” can end up in Bing search results, rendering them useless

#144

Post by jeroenhd »

Outlook will only send GET requests, which are idempotent unless you're ignoring the spec. A message saying "this code has already been used" after sending a GET request is a bug.

I don't see the problem here, all services need to do is add a page that's says "welcome back, $Username, click here to log in!" that sends a POST request to do any serious confirmation without breaking any specifications.

Microsoft claims the visiting not is BingBot but it's probably just SmartScreen system checking for malicious links/downloads/etc. like many cloud integrated security products do these days.

I can set my browser to pretend I'm BingBot, you can't derive anything meaningful from the user agent. Unless you find your secret URLs in Bing's search results, your secret links aren't actually being monitored by a search engine.

Re: “Magic links” can end up in Bing search results, rendering them useless

#145

Post by rsbadger »

jeroenhd wrote: post #144

Outlook will only send GET requests, which are idempotent unless you're ignoring the spec. A message saying "this code has already been used" after sending a GET request is a bug. I don't see the problem here, all services need to do is add a page that's says "welcome back, $Username, click here to log in!" that sends a POST request to do any serious confirmation without breaking any specifications. Microsoft claims…

I’m fairly certain they are. My links ended up indexed in Bing search results. The only place they were ever rendered was in private emails to users. Bing should not be indexing that.

Re: “Magic links” can end up in Bing search results, rendering them useless

#146

Post by decebalus1 »

NGRhodes wrote: post #85
sdfhdhjdw3 wrote: post #78

Earlier quoted context omitted.

It's not "your" calendar, it's Google's calendar.

By that logic they are not your emails, they are Google's.

Which would be correct, considering that ownership implies full and complete right of dominion over said entity, which you simply don't have. You could be locked out of your account with no means of getting back access, you can delete your data but have no guarantees that the data has been deleted, Google may create 'derivative works' on your data (see the terms of use) without your permission or will provide data about your account to authorities, etc.. That is not ownership, that's renting.

Re: “Magic links” can end up in Bing search results, rendering them useless

#147

Post by kevin_thibedeau »

dTal wrote: post #106
sandermvanvliet wrote: post #97

I've had to deal with this with e-mail verification links and Auth0. The user clicked the link after getting it in their mailbox but then Auth0 throws up an error page because the e-mail address has already been verified (by Outlook scanning). The problem becomes worse if for some reason the mail ends up in the junk mail folder so the user thinks they've never received the mail but when you check it looks like the e-…

>We ended up adding a custom page to handle e-mail validation so we could handle the situation where the user lands on the page and the address has already been verified. That's a yikes from me! So I can sign up on your service as anyone with an Outlook account, without verification?

Facebook has allowed this in the past and someone recently opened an unverified Instagram account with my address.

Re: “Magic links” can end up in Bing search results, rendering them useless

#148

Post by jeroenhd »

gunapologist99 wrote: post #86
tatersolid wrote: post #23

Earlier quoted context omitted.

Are the URLs being served with a “noindex” header? Blocking crawls with robots.txt cannot de-list items from Google or other search engines. > Warning: Don't use a robots.txt file as a means to hide your web pages from Google search results. If other pages point to your page with descriptive text, Google could still index the URL without visiting the page. If you want to block your page from search results, use anoth…

> Warning: Don't use a robots.txt file as a means to hide your web pages from Google search results. I realize that you are just the messenger and not the progenitor of that policy, so not addressing this to you, but: that is ridiculous. robots.txt is basically useless.

Robots.txt is a mechanism for providing instructions to automated crawlers but I don't think they've ever been promised to be used when a URL is manually or automatically submitted through other means (i.e. another site linking to yours). In those cases, a single page will probably be crawled, but the rest of the domain probably won't.

Re: “Magic links” can end up in Bing search results, rendering them useless

#149

Post by Spivak »

shepherdjerred wrote: post #139
sofixa wrote: post #126

Earlier quoted context omitted.

Doesn't matter. Never trust the client - it's outside of your control, it can be patched, it can be hacked, it can be spoofed, etc.

It sounds like you’re advocating for no client at all

Just as a trivial example, how confident would you be in this auth scheme?

1. User opens Outlook and types in their email and password.

2. The app requests the user's password hash from the server and checks it.

3. Outlook tells the server auth was successful and gets a session token.

Re: “Magic links” can end up in Bing search results, rendering them useless

#150

Post by jeroenhd »

weberer wrote: post #66
oever wrote: post #43

Earlier quoted context omitted.

The HTTP GET method is idempotent: it should behave the same way on multiple accesses. A single use link, e.g. for resetting a password or confirming a subscription, will usually show a webpage with a form that does a POST. Once that POST has been performed, the single use link is used up. Single use links will mostly have a one-time secret that should not be leaked. Mails that contain such links or any sensitive inf…

How do you send mail to an Outlook user and encrypt it so Microsoft can't snoop on it?

If your goal is to prevent third party software like spam filters and malware engines from triggering actions, you must require a second step that will send a POST/PUT/anything-that-isn't-idempotent request. You can copy the authentication code into a form field and do the entire thing without Javascript if you want to, but a second step is necessary.

If your goal is to hide your secrets from Microsoft, then send the email encrypted or don't send it to Microsoft's servers at all. This is practically impossible, it at least impractical in most cases. You can't control the hosting provider and software of your customers.

Post reply on HN