[HN Gopher] Gmail is opening and caching URLs within emails with...
___________________________________________________________________
Gmail is opening and caching URLs within emails without user
intervention?
Author : _wldu
Score : 27 points
Date : 2021-08-19 22:43 UTC (17 minutes ago)
(HTM) web link (support.google.com)
(TXT) w3m dump (support.google.com)
| etaioinshrdlu wrote:
| I always wondered when single-click unsubscribe was going to be a
| problem because of exactly this. I mean, how do you expect to
| give a URL to Google and have them just never crawl it?
| Xophmeister wrote:
| Or "click this link to verify your e-mail address"...
| _wldu wrote:
| I built a small Go web app to do some security testing. When a
| user registers for an account, I generate a 128-bit secure token
| and email it to the address they provided (as a URL). Token URLs
| look like this:
|
| /validate/email/1d00a5c2648c211befd33f5a8a7cbfab
|
| The token is cryptographically strong and disappears after
| access. It can't be guessed and no one but the email account
| holder should click it, but I am seeing the URL accessed multiple
| times from multiple IPs, so I investigated.
|
| Turns out, if the user provides a Gmail or Gsuite email account
| during registration, Google clicks the link. I was curious if
| others on HN had encountered this and how they dealt with it. It
| is interfering with user registration and testing.
|
| Edit, if any gmail users wish to try the test app:
| https://gen.go350.com/
| judge2020 wrote:
| This is a good feature in my opinion. Why should I let the sender
| know when I click on tracking links or view the email? If you
| really want to, just filter out clicks from AS15169.
| alpaca128 wrote:
| So this way Google automatically confirms the validity of the
| email to spammers by visiting all their links? Doesn't sound
| great, and people still know when you click on links or view
| the email. They just have to guess a bit better.
| mike_d wrote:
| All URLs sent to any major email provider are "clicked" because
| they are scanning the page to see if it is phishing or otherwise
| malicious (desktop antivirus and other things will also prescan
| URLs). It also protects privacy by defeating click tracking on
| marketing emails.
|
| Google will also pre-load all the images in your email too.
|
| You shouldn't take any write action to your database just based
| on a URL being visited. Take them to the verification page and
| ask them to sign in or submit a form with the token pre-filled.
___________________________________________________________________
(page generated 2021-08-19 23:00 UTC)