Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail is opening and caching URLs within emails without user intervention (2019)

support.google.com

Post reply on HN
Print view View original

41–50 of 271 posts

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#41

Post by Silhouette »

skybrian wrote: post #31
jeroenhd wrote: post #9

Earlier quoted context omitted.

I disagree. I think the image and resource preloading done by Google is perfectly fine, but clicking actual links will mess up tons of systems (like, for example, links that are only supposed to be valid once, like in password reset emails). There are good use cases for links with single-use tokens in them. Companies sad and desperate enough to suck as much data from you as humanly possible (i.e. every single news le…

From the very beginning of the web when HTTP was defined, there has been the rule that a GET request should never take an action on its own. Actions should be based on some other method like a POST request. Google is following the standard. People who take actions based on GET requests are not. Sure, mistakes happen out of ignorance, but they should be fixed.

From the very beginning of the web when HTTP was defined, there has been the rule that a GET request should never take an action on its own. Actions should be based on some other method like a POST request.

Maybe, but then several decades passed and now billions of people don't use online systems the same ways any more. It used to be that I could send a legitimate mail to a friend or family member and not worry that whatever mail system they use would refuse to deliver it to them because my system didn't jump through several not-quite-standard hoops that didn't exist when the email protocols were defined. Google seem fine with discarding the historical standards on which most of the Internet is built in that situation.

In any case, if a communications service is going to snoop on your private communications and take actions that would be impossible without spying on you, I think the burden is 100% on them not to screw anything up for anyone, ever.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#42

Post by sp332 »

rgbrgb wrote: post #18
dheera wrote: post #12

Earlier quoted context omitted.

> Google will also pre-load all the images in your email too PLEASE disable automatic loading in Gmail settings. Don't let the idiots use unethical, stalkerish e-mail read receipts.

Doesn't gmail's preloading defeat the read receipts? It makes it so every tracking pixel sent to gmail gets loaded (and not by your IP), thereby making it meaningless.

This was true briefly in 2013. https://arstechnica.com/information-technology/2013/12/gmail... But they got so much pushback they effectively disabled it. https://arstechnica.com/information-technology/2013/12/dear-... (It's still cached, but not in a privacy-preserving way.)

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#43

Post by sp332 »

anamexis wrote: post #16
dheera wrote: post #12

Earlier quoted context omitted.

> Google will also pre-load all the images in your email too PLEASE disable automatic loading in Gmail settings. Don't let the idiots use unethical, stalkerish e-mail read receipts.

Doesn't automatic loading render those read receipts meaningless?

Gmail only loads the images when you load the message. It's been that way since late 2013. https://arstechnica.com/information-technology/2013/12/dear-...

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#44

Post by sp332 »

hirundo wrote: post #40

Why isn't rel="nofollow" a solution to this? According to the docs [1] Use the nofollow value when other values don't apply, and you'd rather Google not associate your site with, or crawl the linked page from, your site. It seems like crawling a nofollow anchor tag in an email breaks this rule. Am I reading it wrong, is there an exception for emails, or is Google being inconsistent? [1] https://developers.google.com/…

That's for the search engine. This is for malicious link checking. Wouldn't do much good if every spammer could say "please don't look at my malicious web site".

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#45

Post by sp332 »

etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

I thought the "one click" was counted from the web site, not from the email. So the click to get to the unsubscribe page doesn't count, but one click after that should do it.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#46

Post by dragonwriter »

hirundo wrote: post #40

Why isn't rel="nofollow" a solution to this? According to the docs [1] Use the nofollow value when other values don't apply, and you'd rather Google not associate your site with, or crawl the linked page from, your site. It seems like crawling a nofollow anchor tag in an email breaks this rule. Am I reading it wrong, is there an exception for emails, or is Google being inconsistent? [1] https://developers.google.com/…

> It seems like crawling a nofollow anchor tag in an email breaks this rule.

There is no actual rule stated in the quoted material, and it describes it aa a mechanism for specifying a preference for how Google handles the link when Google encounters the tag on the creator’s site, which a user email on Gmail...isn't, even approximately.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#48

Post by dragonwriter »

_wldu wrote: post #3

I built a small Go web app to do some security testing. When a user registers for an account, I generate a 128-bit secure token and email it to the address they provided (as a URL). Token URLs look like this: /validate/email/1d00a5c2648c211befd33f5a8a7cbfab The token is cryptographically strong and disappears after access. It can't be guessed and no one but the email account holder should click it, but I am seeing th…

Yay for building systems that rely on extremely non-idempotent behavior on GET.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#49

Post by justinator »

justinator wrote: post #8
etaioinshrdlu wrote: post #2

I always wondered when single-click unsubscribe was going to be a problem because of exactly this. I mean, how do you expect to give a URL to Google and have them just never crawl it?

You make just visiting the URL not everything that needs to be done. So for example, the URL you visit then also runs a small bit of javascript behind the scenes that does the actual unsub action - or the javascript just does a redirect. Or even simpler, you make it so the user has to click a button to POST the request. You've had to do this for years, now. I would assume though, that Gmail is smart enough to go, "oh…

No need to downvote me - if there's a better practice, I'm absolutely happy to adopt it. Or I can give you the github details and you can send a PR.

Re: Gmail is opening and caching URLs within emails without user intervention (2019)

#50

Post by mike_d »

_wldu wrote: post #13
mike_d wrote: post #6

All URLs sent to any major email provider are "clicked" because they are scanning the page to see if it is phishing or otherwise malicious (desktop antivirus and other things will also prescan URLs). It also protects privacy by defeating click tracking on marketing emails. Google will also pre-load all the images in your email too. You shouldn't take any write action to your database just based on a URL being visited…

True. Phish testing campaigns in companies that send fake phishing emails to employees, are probably full of inaccurate data due to this. "Why did you click that link? But, I didn't."

Many phishing test as a service companies will report clicks vs. people who actually interact with the page.
Post reply on HN