Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

251–260 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#251

Earlier quoted context omitted.

So the situation is: there is some url you open (with a normal get request. Typically but not neccesarily from an email), then that url does the non-idempotent POST request without any futher user interaction. A malicious page that knows the url used in the email could open the url from the email in a popup. The js will execute in the popup, and do the POST request. It doesn't matter how much csrf protection you have…

> A malicious page that knows the url used in the email could open the url from the email in a popup Sorry but this whole scenario is just ridiculous. If somebody can access your email it is already game over. It doesn't matter what web technology you are using at the that point, user interaction or not. If a "malicious page" knows the URL it doesn't matter at all because it means it is capable of arbitrary code exec…

So there's two scenarios:

Scenario a) No authentication-y bits in the url. User goes to the url, site checks if the user is already logged in via a cookie. If so, does the POST request.

Typically in this case the urls are easily guessable, so that's an easy CSRF. In principle they could be made per-user (some sort of HMAC on a user+timestamp). In practise, I think its fairly common for websites not to do that in this sort of situation.

scenario b) The url contains some sort of nonce, or signed assertion that automatically logs the user in. I think this is fairly common in email urls, because web developers want people to be able to take an action just from clicking the link in the email, even if the device they read email on is not the same as the device they normally use to interact with the application. I also think this is the scenario that applies to this discussion, since it was started around talking about the issues caused by google auto following links, and in scenario A, google auto-following links would not be an issue.

Of course, in principle, its possible that the authentication bits in the url, just authenticate that action, and don't generally log the user in. In practise I think its really common to just generally log the user in, since most sites want people to stay on the site once the user does anything, and not just immediately exit after the email action is completed.

These urls are typically not guessable. A small percentage of users do tend to smatter these across the internet (e.g. https://urlscan.io/), but ignoring that, this is a login-CSRF. That is, an attacker can generate their own such url, and force their victim to log into the attacker's account.

The impact of a login-csrf tend to be very application specific. Sometimes its kind of minor, but I have definitely seen cases in major websites where a login-csrf can lead to a full account take-over of the victim's account.

> Actually if the page can open a popup I think it could also execute JavaScript within the context of the page and perform the user interaction right there.

This is only true if the pop-up has the same origin as the site that opened it. Otherwise there is just a very limited API (Basically, postMessage(). Also both sides can change the current url of the other side, which is a bit nuts). Also there is now a new http header, Cross-Origin-Opener-Policy that affects this.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#252

Earlier quoted context omitted.

> A malicious page that knows the url used in the email could open the url from the email in a popup Sorry but this whole scenario is just ridiculous. If somebody can access your email it is already game over. It doesn't matter what web technology you are using at the that point, user interaction or not. If a "malicious page" knows the URL it doesn't matter at all because it means it is capable of arbitrary code exec…

So there's two scenarios: Scenario a) No authentication-y bits in the url. User goes to the url, site checks if the user is already logged in via a cookie. If so, does the POST request. Typically in this case the urls are easily guessable, so that's an easy CSRF. In principle they could be made per-user (some sort of HMAC on a user+timestamp). In practise, I think its fairly common for websites not to do that in this…

What you are describing isn't even CSRF

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#253
post #158

Earlier quoted context omitted.

We've done this for over 2 years now, and over 200k users never ran into this. Also not within government users.

How do you know your users have never run into this? People don't tend to report problems like "my account was activated sooner than I expected"

We use it to log in users. We quickly get complaints if something doesn't work well.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#254

This is a good feature in my opinion. Why should I let the sender know when I click on tracking links or view the email? If you really want to, just filter out clicks from AS15169.

At least according to the original link, GMail follows the link when a user views an email. That sounds like tracking gold to me.

As to masking your IP when you actually click on the link. How could that possibly work? Your IP is still definitely making its way to the tracking server upon clicking the link. There would be no mechanism for GMail to prevent that unless it rewrote the links to point at its caching server, which would pretty much break GMail.

Sure, pre-fetching would create a bit of noise because your IP would be mixed in with the Google IPs, but as you've quite rightly noted, filtering out clicks from AS15169 would eliminate that noise.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#255
post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

A "GET" request is not supposed to alter state. On the other hand. It validates the email address more quickly, so you could even refresh/poll when it's verified automatically

If there is a cookie session, 99% of GETs do alter the state.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#256
post #235

Earlier quoted context omitted.

I'm not following your argument. What is this thing that URLs are which makes them public? For instance, I could argue "Fingerprints are not passwords, and they need to be treated as public, because of what they are" - because I can finish that sentence with "and what they are is a pattern that's left on every single random thing you touch, and is also immutable and impossible to rotate." What's the analogous thing f…

> I'm not following your argument. It's almost certainly true that you do, you're just being dishonest. (The alternative is worse.) > What is this thing that URLs are which makes them public? You mean other than being identifiers ( universal identifiers, at that)? It's like you've never used or encountered someone else articulating an argument that incorporates (or would be appropriate to incorporate) the phrase "by…

I understand full well that you are claiming that URLs are public by definition. I am disputing that you are interpreting the definition correctly.

The invention of the card catalog and the Rolodex does not compromise anything, because the card catalog and the Rolodex simply catalogue information that is public, but in a poorly-accessible format. No card catalog can find the name of an unpublished, self-printed book that is sitting in my house. No Rolodex can determine the extension of the direct line at my work. Since I am claiming the URL in question is not public in the first place, I am claiming that it would not end up catalogued.

Can you explain, clearly, how this URL would end up catalogued? "By definition" is not an argument.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#257

Earlier quoted context omitted.

They're saying that URLs aren't an authentication (or authorization) system. I'm curious to know how those advocating a position similar to this think something like a password reset facility on a website should work. We all know security-sensitive systems should rely on alternative methods of authentication anyway, but for those of us living in the real world where billions of people access millions of systems via w…

What relation does your question have to the statement you're quoting?

As a wise person once said, playing dumb isn't clever, it's just obnoxious.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#259
post #173

Earlier quoted context omitted.

Tons of services send a verification link after registration, and when you click the link you are taken to a page that says "You're verified." But in those cases there may be an automatic POST after you travel to the link, so it wouldn't be triggered by gmail looking up the url.

This may be for the purpose of ensuring the email address itself is deliverable. You don't want someone to sign up with random garbage, then try sending notifications, newsletters, etc. to it- I believe doing so can affect domain reputation. For this use-case, it seems like even an automated link click would be a good signal of a deliverable email address.

Not just deliverable, but also that it's correct. There's a lot of people who think that my {firstname}{lastname}@gmail.com email address is their own. If they try to register it somewhere, a verification email stops them from completing the registration.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#260
post #257

Earlier quoted context omitted.

What relation does your question have to the statement you're quoting?

As a wise person once said, playing dumb isn't clever, it's just obnoxious.

You seem to have difficulty following the logical throughline here. There is no playing dumb in the previous comment.

Let's put it in a statement instead of the form of a question: it does not follow to respond to the quoted part ("URLs aren't an authentication (or authorization) system") with remarks about "those of us living in the real world where billions of people access millions of systems via websites using their email address as ID/fallback[...]".

You (both of you) are confusing the subject here: URLs vs reaching back to drag emails and their privacy into focus. They're different fucking things! Stop responding to comments about one with responses that deal in the other!

Billions of people access websites using their email addresses? Granted! Now say something about URLs if that's what your quibble is and shut up about the emails that the URLs were sent in and whether or not those emails are private. The comments about email are misdirection at worst, and a sign of unclear thinking (and a hazard to confuse others) at best.

Post reply on HN