“Magic links” can end up in Bing search results, rendering them useless

Post by aaaaaaaaaaab » Mon, Jun 27, 2022, 6:15 PM UTC

hannob wrote: post #176

sandermvanvliet wrote: post #97

I've had to deal with this with e-mail verification links and Auth0. The user clicked the link after getting it in their mailbox but then Auth0 throws up an error page because the e-mail address has already been verified (by Outlook scanning). The problem becomes worse if for some reason the mail ends up in the junk mail folder so the user thinks they've never received the mail but when you check it looks like the e-…

HTTP GET requests are supposed to be idempotent, meaning that when you call an URL twice it should not lead to any different result compared to calling it once. This is part of the HTTP standard. So while I think what Outlook does here is wrong, what these webpages do is simply a bug that should be fixed and shows a lack of understanding of HTTP.

Post by ggurface » Mon, Jun 27, 2022, 6:27 PM UTC

sofixa wrote: post #125

bigtones wrote: post #14

Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.

> Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks The problem with that is that the logic is broken. Microsoft cannot possibly know all phishing sites, especially for smaller things. By obfuscating the link the user can no longer verify it by themselves without clicking, but Microsoft will say it's safe. So the user is left with…

Post by inopinatus » Mon, Jun 27, 2022, 6:42 PM UTC

rsbadger wrote: post #107

_8j50 wrote: post #104

Earlier quoted context omitted.

It is common for corporate email security appliances as well. URLs should not be used for authentication neither should email. I really want to pick brains of people that work on these types of systems to see why they don't think so.

Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending them an email link?

Post by hyperman1 » Mon, Jun 27, 2022, 6:57 PM UTC

ggurface wrote: post #183

sofixa wrote: post #125

Earlier quoted context omitted.

> Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks The problem with that is that the logic is broken. Microsoft cannot possibly know all phishing sites, especially for smaller things. By obfuscating the link the user can no longer verify it by themselves without clicking, but Microsoft will say it's safe. So the user is left with…

I believe the recommended practice is to hover over the URL before clicking the link. If you do so, in Outlook, there will be a pop that shows "Original URL: XXX". This allows users to make a determination for themselves whether the link is safe or not.

Post by jcranberry » Mon, Jun 27, 2022, 7:00 PM UTC

causi wrote: post #80

bigtones wrote: post #14

Microsoft does this because they're security scanning / checking all links in every Outlook email for known phishing and malware attacks. If Bing has not seen the web page before and it's not in the Bing dangerous web page index it first needs to check it to make a determination of if it's a phishing/malware page by scanning/indexing it before returning that outcome back to Outlook to flag the email as dangerous.

Wouldn't it be trivial to keep the list of malicious pages locally and not send any data?