7 ms·

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an <a> tag was a url, that the text matched the hre

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an <a> tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those who wanted the feature) lost. But I still think that, any web app that shows "http://whatever" http://whatever" in a link field should ensure that the href field is "http://whatever" http://whatever".

username223 7y ago
I also think mail clients should do that, or at least offer it as an option. Most mail readers have an option to disable loading remote content, and this would be another little way to make HTML email less dangerous. I think (or at least hope) that most people are in the habit of hovering over links in email before clicking them. And I really hope that mail readers never start implementing Javascript. As for web apps, that's the Wild West, and a small fix like this isn't going to tame it.
- jdironman 7y ago
  Maybe, quite simple have the option to parse <a> tags down to the format "Text - URL". If I remember correctly, some sites from way back had this sort of format occasionally.
  - tmefq 7y ago
    WordPress does it in the admin interface. A very clever hack. Something like: a:after { content: attr(href); display: inline-block; padding: 0 1ex; }
- scarface74 7y ago
  You give way too much credit to users if you think they hover over links and users can’t hover over links on mobile devices.
shkkmo 7y ago
> the mail client to check that, if the text of an <a> tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them the verify the url in the url bar. The issue, is that doing this selectively teaches the wrong security practice to users: that they can improve their safety by looking at the link text rather than at the url bar after clicking the link.
- vorticalbox 7y ago
  Yeah but that's annoying and almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok. I mean can you honestly tell you read the Google privacy notice or do you just click the down arrow till the ok box appears?
  - shkkmo 7y ago
    > Yeah but that's annoying Yes it is annoying. My point is if you want to be annoying, you should be annoying the user when they visit ANY external links as trusting the link text isn't a practice that should taught/encouraged. > almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok. That depends on how short and well worded the alert is. However, there is certainly an attention budget that can be used up with pointless / low value alerts (which is why I would assume that Apple did not go this route).
- frenchy 7y ago
  > The use case that this breaks is doing click tracking on links I, personally, would be quite happy for this use case to break.
  - shkkmo 7y ago
    > I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you? I would assume that happiness depends on how this use case is broken. Would you be happy if the email just doesn't show up or gets shunted to spam? Even if it is a password reset email or a email verification email? Would you be happy if the link just failed to open, forcing you to copy and paste the link text manually? Why not just do that on your own anyway? No need to have the email client block this for everyone just to suite your tastes. This leaves us with just the behavior I mentioned above and my argument against it.
syn0byte 7y ago
Sounds reasonable only if the text is a URI handler format; http:// http:// file:// ftp:// steam:// etc. But then what about almost-uri text. www.yourbank.com without the https:// https://. Or lookalikes "https:\\" or... what about proxies? does https://l33th4x.com?proxy=www.bank.com https://l33th4x.com?proxy=www.bank.com count if the text is www.bank.com? Filtering crap like this sounds reasonable but very quickly becomes an exercise in what I call "Giving a mouse a cookie." Now you have a huge complex chunk of code to parse and filter URLs/URIs and every look-alike you can think of; Did you remember that automatic deserialization that kicked in when your values were sent to a callback? 2 days of work later, your new build has fancy-pants a tag filtering that contains and unknown number of bugs and phishers just register and use new domains that look kinda legit and follow your new text/link rules. www.security-wellsfargo-audit.com/login looks legit to the mark, your mail client allowed it so it must be OK.
- appleflaxen 7y ago
  uh... ok... I'll bite... why do you call it "giving a mouse a cookie"
  - the_jeremy 7y ago
    Let me google that for you: https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie
  - jamescostian 7y ago
    See https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie "If you give a mouse a cookie, he'll ask for a glass of milk" "If you give a mouse a glass of milk, he'll ask for a straw" And the story keeps going like that, with more and more requests coming in. It's almost like never-ending scope creep, except the book has an infinite loop in it.
    - duxup 7y ago
      There's also an animated series on Amazon now... my youngest loves it.
jlarocco 7y ago
I'm agreeing with the "no" votes here. It's extra work and testing complexity for a one off case that's trivially avoided by spammers. And where do you draw the line? Should it flag a link with text "htp://ebay.com" that goes somewhere else? "ebay" with a href somewhere else? There's no technical workaround to educating users.
- mikeash 7y ago
  Sandboxing to prevent malware installation and password managers to prevent phishing are excellent technical workarounds for this.
  - jlarocco 7y ago
    Except they're not, because a dumb enough user isn't going to think about their password manager, and they'll enter their password anyway.
    - mikeash 7y ago
      They won’t even know what it is.
  - tialaramex 7y ago
    For the latter, as one of my sibling posts points out the user will go "Huh, stupid password manager didn't fill out my password - I'll have to do it manually". Often the password manager even helps them do this in the name of user convenience. Only Brick wall UX works. That's what WebAuthn does here. Don't offer the user a way to "continue anyway", don't ask them confusing questions, just a brick wall and no way forward. The user will probably be emotional. Scammers work hard to make your users afraid, or horny, or confused, and so they really, really want to give their bank credentials to https://honest-this-is-your-bank.not-a-scam.example/tmp/backup/legitimate-sign-in-page.HTM https://honest-this-is-your-bank.not-a-scam.example/tmp/back... and nothing you can tell them is going to make them stop wanting to do that. The brick wall doesn't care about the user's emotional state and will stubbornly resist. Maybe the user will eventually realise it was a scam, maybe they won't, the brick wall doesn't know or care either way. Brick Wall UX even helps the software engineer. When a manager asks if you can't just add a banner that says "Hi, this is our new web site, please continue to use your old credentials" and thus undo every second of training about phishing your users ever got the answer with a Brick Wall UX is that literally can't work. No matter how much they beg and cajole and swear it's just a temporary workaround, it will not work at all, so they're just going to have to go tell the Big Boss that no matter how much was spent on new-brand-name.example the login system will have to remain forever on login3.long-forgotten-brand.example because that's what some idiot picked five years ago then it was set up and too bad.
cesarb 7y ago
At least Thunderbird seems to do that: when an email has an <a> tag with text that looks like a URL but doesn't match the href, it throws the "this email is probably a scam" bar above the message.
- amenod 7y ago
  ...which then marks all these newsletters as scams, since the link usually first points to analytics site?
  - kevin_thibedeau 7y ago
    They should just collect stats on their own servers.
    - Godel_unicode 7y ago
      This might come as a surprise to you, but every company doesn't have infinite developer time to reinvent things which already exist.
      - boomlinde 7y ago
        Then they should be held accountable for their choice not to vet ads they send to their users. If this was enforced legally, a bunch of companies would suddenly be able to invest the "infinite time" required to register a damn click.
        Godel_unicode 7y ago
        That's obviously not the hard part.
        boomlinde 7y ago
        "The hard part" can still be outsourced to a third party without resorting to redirection chains, either by sending the click information to them on the server-side or by sending it client side using a script. Either way, "the hard part" is generally undesirable to users because it compromises their privacy in order to manipulate them.
griffoa 7y ago
> When I worked at Apple I filed a Radar There is your first problem right there. Never have I seen actual incompetence systematically implemented, but Apple managed to do exactly that. And the talking and blabbering and bike shedding culture at Apple to prove you are the smartest person in the room is excruciating.
munk-a 7y ago
The real answer here is that tech companies are trying to solve this problem with tech - in an effort to cheap out on actually hiring some humans to look at the thing and verify that it's safe. My eyeballs are not free. I hate advertising and advertisers. I have no pity for the advertising platform that cheaps out on security just because it's expensive.

username223 7y ago

I also think mail clients should do that, or at least offer it as an option. Most mail readers have an option to disable loading remote content, and this would be another little way to make HTML email less dangerous. I think (or at least hope) that most people are in the habit of hovering over links in email before clicking them. And I really hope that mail readers never start implementing Javascript. As for web apps, that's the Wild West, and a small fix like this isn't going to tame it.

jdironman 7y ago
Maybe, quite simple have the option to parse <a> tags down to the format "Text - URL". If I remember correctly, some sites from way back had this sort of format occasionally.
- tmefq 7y ago
  WordPress does it in the admin interface. A very clever hack. Something like: a:after { content: attr(href); display: inline-block; padding: 0 1ex; }
scarface74 7y ago
You give way too much credit to users if you think they hover over links and users can’t hover over links on mobile devices.

shkkmo 7y ago

> the mail client to check that, if the text of an <a> tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them the verify the url in the url bar. The issue, is that doing this selectively teaches the wrong security practice to users: that they can improve their safety by looking at the link text rather than at the url bar after clicking the link.

vorticalbox 7y ago
Yeah but that's annoying and almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok. I mean can you honestly tell you read the Google privacy notice or do you just click the down arrow till the ok box appears?
- shkkmo 7y ago
  > Yeah but that's annoying Yes it is annoying. My point is if you want to be annoying, you should be annoying the user when they visit ANY external links as trusting the link text isn't a practice that should taught/encouraged. > almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok. That depends on how short and well worded the alert is. However, there is certainly an attention budget that can be used up with pointless / low value alerts (which is why I would assume that Apple did not go this route).
frenchy 7y ago
> The use case that this breaks is doing click tracking on links I, personally, would be quite happy for this use case to break.
- shkkmo 7y ago
  > I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you? I would assume that happiness depends on how this use case is broken. Would you be happy if the email just doesn't show up or gets shunted to spam? Even if it is a password reset email or a email verification email? Would you be happy if the link just failed to open, forcing you to copy and paste the link text manually? Why not just do that on your own anyway? No need to have the email client block this for everyone just to suite your tastes. This leaves us with just the behavior I mentioned above and my argument against it.

syn0byte 7y ago

Sounds reasonable only if the text is a URI handler format; http:// http:// file:// ftp:// steam:// etc. But then what about almost-uri text. www.yourbank.com without the https:// https://. Or lookalikes "https:\\" or... what about proxies? does https://l33th4x.com?proxy=www.bank.com https://l33th4x.com?proxy=www.bank.com count if the text is www.bank.com? Filtering crap like this sounds reasonable but very quickly becomes an exercise in what I call "Giving a mouse a cookie." Now you have a huge complex chunk of code to parse and filter URLs/URIs and every look-alike you can think of; Did you remember that automatic deserialization that kicked in when your values were sent to a callback? 2 days of work later, your new build has fancy-pants a tag filtering that contains and unknown number of bugs and phishers just register and use new domains that look kinda legit and follow your new text/link rules. www.security-wellsfargo-audit.com/login looks legit to the mark, your mail client allowed it so it must be OK.

appleflaxen 7y ago
uh... ok... I'll bite... why do you call it "giving a mouse a cookie"
- the_jeremy 7y ago
  Let me google that for you: https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie
- jamescostian 7y ago
  See https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie "If you give a mouse a cookie, he'll ask for a glass of milk" "If you give a mouse a glass of milk, he'll ask for a straw" And the story keeps going like that, with more and more requests coming in. It's almost like never-ending scope creep, except the book has an infinite loop in it.
  - duxup 7y ago
    There's also an animated series on Amazon now... my youngest loves it.

jlarocco 7y ago

I'm agreeing with the "no" votes here. It's extra work and testing complexity for a one off case that's trivially avoided by spammers. And where do you draw the line? Should it flag a link with text "htp://ebay.com" that goes somewhere else? "ebay" with a href somewhere else? There's no technical workaround to educating users.

mikeash 7y ago
Sandboxing to prevent malware installation and password managers to prevent phishing are excellent technical workarounds for this.
- jlarocco 7y ago
  Except they're not, because a dumb enough user isn't going to think about their password manager, and they'll enter their password anyway.
  - mikeash 7y ago
    They won’t even know what it is.
- tialaramex 7y ago
  For the latter, as one of my sibling posts points out the user will go "Huh, stupid password manager didn't fill out my password - I'll have to do it manually". Often the password manager even helps them do this in the name of user convenience. Only Brick wall UX works. That's what WebAuthn does here. Don't offer the user a way to "continue anyway", don't ask them confusing questions, just a brick wall and no way forward. The user will probably be emotional. Scammers work hard to make your users afraid, or horny, or confused, and so they really, really want to give their bank credentials to https://honest-this-is-your-bank.not-a-scam.example/tmp/backup/legitimate-sign-in-page.HTM https://honest-this-is-your-bank.not-a-scam.example/tmp/back... and nothing you can tell them is going to make them stop wanting to do that. The brick wall doesn't care about the user's emotional state and will stubbornly resist. Maybe the user will eventually realise it was a scam, maybe they won't, the brick wall doesn't know or care either way. Brick Wall UX even helps the software engineer. When a manager asks if you can't just add a banner that says "Hi, this is our new web site, please continue to use your old credentials" and thus undo every second of training about phishing your users ever got the answer with a Brick Wall UX is that literally can't work. No matter how much they beg and cajole and swear it's just a temporary workaround, it will not work at all, so they're just going to have to go tell the Big Boss that no matter how much was spent on new-brand-name.example the login system will have to remain forever on login3.long-forgotten-brand.example because that's what some idiot picked five years ago then it was set up and too bad.

cesarb 7y ago

At least Thunderbird seems to do that: when an email has an <a> tag with text that looks like a URL but doesn't match the href, it throws the "this email is probably a scam" bar above the message.

amenod 7y ago
...which then marks all these newsletters as scams, since the link usually first points to analytics site?
- kevin_thibedeau 7y ago
  They should just collect stats on their own servers.
  - Godel_unicode 7y ago
    This might come as a surprise to you, but every company doesn't have infinite developer time to reinvent things which already exist.
    - boomlinde 7y ago
      Then they should be held accountable for their choice not to vet ads they send to their users. If this was enforced legally, a bunch of companies would suddenly be able to invest the "infinite time" required to register a damn click.
      - Godel_unicode 7y ago
        That's obviously not the hard part.
        boomlinde 7y ago
        "The hard part" can still be outsourced to a third party without resorting to redirection chains, either by sending the click information to them on the server-side or by sending it client side using a script. Either way, "the hard part" is generally undesirable to users because it compromises their privacy in order to manipulate them.

griffoa 7y ago

> When I worked at Apple I filed a Radar There is your first problem right there. Never have I seen actual incompetence systematically implemented, but Apple managed to do exactly that. And the talking and blabbering and bike shedding culture at Apple to prove you are the smartest person in the room is excruciating.

munk-a 7y ago

The real answer here is that tech companies are trying to solve this problem with tech - in an effort to cheap out on actually hiring some humans to look at the thing and verify that it's safe. My eyeballs are not free. I hate advertising and advertisers. I have no pity for the advertising platform that cheaps out on security just because it's expensive.