Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

nullcathedral.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#61

Post by 201984 »

teekert wrote: post #59
lyu07282 wrote: post #55

Earlier quoted context omitted.

This could go straight on r/LinkedInLunatics, the PMC is insane

Hmm, never been there, but it never feels good to be lumped in with some group (especially when they have lunatics in the name) instead of receiving feedback that may point at errors in judgement. I'm generally considered knowledgeable and I'm just thinking from the perspective of owning a company and employees taking these actions instead of coming to talk to me, showing evidence of my poor management decisions. Thi…

Professional-Managerial Class, as opposed to working class or proletariat.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#62

Post by teekert »

201984 wrote: post #61
teekert wrote: post #59

Earlier quoted context omitted.

Hmm, never been there, but it never feels good to be lumped in with some group (especially when they have lunatics in the name) instead of receiving feedback that may point at errors in judgement. I'm generally considered knowledgeable and I'm just thinking from the perspective of owning a company and employees taking these actions instead of coming to talk to me, showing evidence of my poor management decisions. Thi…

Professional-Managerial Class, as opposed to working class or proletariat.

Thanx, I don't consider myself PMC, but, I guess that's the internet of today, slap a label onto anyone and anything based on ~160 chars.

I guess lyu07282 is what I have taken to calling a "Judger". Always labeling, always judging, always seeking the moral high-ground, never realizing the lack of nuance that must exist in short texts. Never thinking "what if this was meant in a kind way." Oh, and I see the irony, it is intentional (feels bad right?).

I think it's what tearing the US apart at this very moment. Always Us against Them. Most people are kind you know. I really thought I did my best to add nuance.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#64

Post by Avamander »

bawolff wrote: post #46
Avamander wrote: post #13

SVGs are just the tip of the iceberg of how hard it is to sanitize email content. There aren't any purpose-built good libraries for email sanitization either. Something that would handle SVG, CSS, HTML, everything.

Put it in an iframe with a Content-Security-Policy header?

Some providers do that.

But you still have to dynamically allow or disallow external content such as images. It also makes any operations based on the content more convoluted. Like adding event invites to calendar and so on.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#66

Post by iamacyborg »

RobotToaster wrote: post #49
londons_explore wrote: post #27

Earlier quoted context omitted.

Gmails prefetch is terrible for privacy because it honors http cache headers, which means tracking companies simply use a "no-cache, must-revalidate" header to defeat it.

Which is completely stupid since images in an email should never change.

Why shouldn't they? There's plenty of scenarios where you might want to swap images after a period of time has elapsed, or to fix a mistake.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#67

Post by hvb2 »

RobotToaster wrote: post #49
londons_explore wrote: post #27

Earlier quoted context omitted.

Gmails prefetch is terrible for privacy because it honors http cache headers, which means tracking companies simply use a "no-cache, must-revalidate" header to defeat it.

Which is completely stupid since images in an email should never change.

I know of an invoicing system that updates the image when it's paid. Seems pretty useful to me.

And yes, that means that an image with an amount is publicly accessible, so what, there's no information about the invoice in there as that's in the text of the email.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#68

Post by antonvs »

teekert wrote: post #51
mzi wrote: post #12

Earlier quoted context omitted.

I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malic…

Hmm, mixed feelings. Sure you are being clever, but (and I don't know the state of art science wrt effectivity of these fake phishing emails), you are defying a measure that was taken by management to try to make the company safer. Sure it may feel, and even be, a waste of time. But you are also putting yourself above the rules in a way. Your assumption is that these programs will actually NOT make the company safer,…

> you are defying a measure that was taken by management to try to make the company safer.

> are you 100% free to cheat on cyber security measures?

Why do you think that implementing an email filter like that is "defying a measure" or "cheating"? What value do you think there would be in individually, manually, reviewing each such email, if you've already identified the pattern they all follow and their purpose? You're essentially arguing for wilful inefficiency, which is "cheating" the organization out of useful labor.

The other reply to you may have been less than perfectly polite, but they certainly had a point.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#69

Post by londons_explore »

iamacyborg wrote: post #66
RobotToaster wrote: post #49

Earlier quoted context omitted.

Which is completely stupid since images in an email should never change.

Why shouldn't they? There's plenty of scenarios where you might want to swap images after a period of time has elapsed, or to fix a mistake.

The ability to swap images but not text seems arbitrary.

You could imagine a system more like the notification tray on iOS/Android where at any time a notification can appear, be edited, timeout, or be deleted.

Your email inbox could be like that. The email saying "Your parcel has been dispatched" could be edited to say "Your parcel has been delivered".

When you refund something you've bought, the original purchase receipt could be crossed out or hidden. When you get invited to a wedding but then the wedding is cancelled, the original invite could be deleted, etc.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#70

Post by teekert »

antonvs wrote: post #68
teekert wrote: post #51

Earlier quoted context omitted.

Hmm, mixed feelings. Sure you are being clever, but (and I don't know the state of art science wrt effectivity of these fake phishing emails), you are defying a measure that was taken by management to try to make the company safer. Sure it may feel, and even be, a waste of time. But you are also putting yourself above the rules in a way. Your assumption is that these programs will actually NOT make the company safer,…

> you are defying a measure that was taken by management to try to make the company safer. > are you 100% free to cheat on cyber security measures? Why do you think that implementing an email filter like that is "defying a measure" or "cheating"? What value do you think there would be in individually, manually, reviewing each such email, if you've already identified the pattern they all follow and their purpose? You'…

Come on, certainly the "spirit" of the "training" is to learn to disseminate phishing emails from real ones using subtle ques. Not to learn how to write an email filter.

Nowhere am I saying that I agree with the chosen methods, especially not the part that sounds like punishment. But there are better ways to deal with the disagreement than suggested here.

Post reply on HN