5 ms·

> The use case that this breaks is doing click tracking on links I, personally, would be quite happy for this use case to break.

shkkmo 7y ago
> I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you? I would assume that happiness depends on how this use case is broken. Would you be happy if the email just doesn't show up or gets shunted to spam? Even if it is a password reset email or a email verification email? Would you be happy if the link just failed to open, forcing you to copy and paste the link text manually? Why not just do that on your own anyway? No need to have the email client block this for everyone just to suite your tastes. This leaves us with just the behavior I mentioned above and my argument against it.
- luckylion 7y ago
  > Why? If you don't want to be tracked it is pretty easy to avoid. If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com? And why would the link text look like a URL? I don't see why <a href="https://possiblephishing.com/n1bfsd?j1h7d8Sda">www.ebay.com/viewOrder</a> makes more sense than <a href="https://www.ebay.com/viewOrder">view your order</a> . > Even if it is a password reset email or a email verification email? Why would you want to share password reset info with a third party? I get the "easy tracking" argument for newsletters (but I'm pretty sure most are not GDPR compliant), but for password reset emails? why? > Would you be happy if the link just failed to open Why would it? You can put a working link in the email directly - you've proven that by putting a different link in the email than the one you pretend you're linking to.
  - shkkmo 7y ago
    > If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com? I don't see what relevance a subdomain has here. As the original issue was described, it was blocking any links where the url doesn't match the link text (if the link text is a url). This means that even tracking that is done on the same domain (e.g. example.com/emailTracking/{{unique_string}} redirects to example.com/viewOrder/412) would be blocked. If you start only blocking those links if the domains don't match, things become more complicated to implement and test, especially once you consider subdomains, etc. The question remains, what is the point of this and is it worth it? Are we really promoting good security practices or just adding security theater cruft? > Why would you want to share password reset info with a third party? Who said anything about a third party? As you mention above, this blocks people who are doing their own tracking on the same domain. I don't have any numbers, but I assume that ESPs like MailGun and SendGrid are probably the most common third parties used to track email link clicks (since they will automatically substitute link urls with trackable rediracts if you enable it.) In this case, that third party already has access to the entire content and metadata of the email and giving them link click data is a relatively small addition. > Why would it? You can put a working link in the email directly - you've proven that by putting a different link in the email than the one you pretend you're linking to. Email links already work one way, perhaps if Apple implemented this feature eventually every email sender out there would switch to links that would work in Apple mail again. In the mean time, Apple has to deal with confused and dissatisfied users wondering why links in their emails don't work. How would you implement link url / text mismatch blocking? Have you thought through the consequences for your users and their understanding of security or satisfaction with your product?
    - luckylion 7y ago
      > Are we really promoting good security practices or just adding security theater cruft? We're taking away easy attacks, just like blocking known spammers from delivering emails to your MTA. Yes, it doesn't solve spam completely, but it reduces the amount. Add other things like SPF, DKIM etc and you can identify even more malicious emails and warn the user. And certainly, the OP's description mentioned matching urls (though the text would have to match the href, so "ebay.com" would likely be fine for "https://ebay.com/something" https://ebay.com/something"), but again: what's the harm in linking to the actual URL? Why the need to hide it, IF you already make the link text look like a URL? I'm sure there are also reasons why a site operator wants to avoid SSL, but I do like the fact that many browsers do warn users when (potentially) sensitive data gets transmitted via plain text. > Who said anything about a third party? The super majority of click-tracking runs via third parties. And yes, every additional detail you share with them (PII has gotten a lot of attention lately, and I'm beginning to come around and love GDPR) will put your users more at risk - now it's not just your database that risks exposing your users when a leak/breach happens, it's also your email provider's. > How would you implement link url / text mismatch blocking? Have you thought through the consequences for your users and their understanding of security or satisfaction with your product? I'm sure that it's not trivial, but few things are, so rejecting it for that reason doesn't sound like a good idea to me. "Hey, let's not do SSL, it's not that simple to build and might inconvenience a user that has their clock set 100 years into the future"
- frenchy 7y ago
  > why do you not want those people to have the information they need to refine and improve these emails Well, it comes at the expense of 1) making things slower for me and 2) making it more difficult to discern phishing emails from legitimate ones. I also find it difficult to believe that all of this analytics is actually doing much to inform me about things I care about. > Would you be happy if the email just doesn't show up or gets shunted to spam? It's unfortuate, but I would understand it if it happend. I certainly hope most phishing emails would end up in my spam.
  - shkkmo 7y ago
    > 1) making things slower for me and That is a valid reason, but I suspect the extra delay of 2x your ping when you click on a link and wait for it's target to load is fairly negligible for most people. > 2) making it more difficult to discern phishing emails from legitimate ones You shouldn't be relying on link text to discern phishing emails, that is what the client checking SPF records and the user checking the contents of the url bar are for. > I also find it difficult to believe that all of this analytics is actually doing much to inform me about things I care about. Why is that? I would think it is pretty obvious how A/B testing click-through rates for emails could easily help make those emails more informative and easier to use. If the speed cost and privacy loss is not worth it to you, having the actual (non-tracked) URL available in the link text atleast gives users the option to opt out of that tracking.
- rurp 7y ago
  > why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you? Email A/B testing is always about marketing and trying to manipulate users, in my experience. If the content is the same, but a different button gets more clicks, it's hard for me to believe users are finding a benefit in that. I think it's far more likely that the content isn't all that compelling, but the UI tweaks managed to tickle some part of the reader's subconscious in the right way for them to click. In other words, emails with quality content don't have marketing teams running them. This is pretty much like all targeted advertising. The benefit to the company is very clear, but I don't think I'd be missing much if email analytics went away. Just as a personal opinion that I'm sure plenty of people disagree with, I dislike it when products are hyper-customized based on a lot of analytics. For instance, Netflix has a ton of data on me, but all of their tests and micro optimizations make me use the app less. I would much prefer their product if they threw all of that info in the trash, rolled the UI back 5 years, and showed me more generalized start ratings again.

shkkmo 7y ago

> I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you? I would assume that happiness depends on how this use case is broken. Would you be happy if the email just doesn't show up or gets shunted to spam? Even if it is a password reset email or a email verification email? Would you be happy if the link just failed to open, forcing you to copy and paste the link text manually? Why not just do that on your own anyway? No need to have the email client block this for everyone just to suite your tastes. This leaves us with just the behavior I mentioned above and my argument against it.

luckylion 7y ago
> Why? If you don't want to be tracked it is pretty easy to avoid. If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com? And why would the link text look like a URL? I don't see why <a href="https://possiblephishing.com/n1bfsd?j1h7d8Sda">www.ebay.com/viewOrder</a> makes more sense than <a href="https://www.ebay.com/viewOrder">view your order</a> . > Even if it is a password reset email or a email verification email? Why would you want to share password reset info with a third party? I get the "easy tracking" argument for newsletters (but I'm pretty sure most are not GDPR compliant), but for password reset emails? why? > Would you be happy if the link just failed to open Why would it? You can put a working link in the email directly - you've proven that by putting a different link in the email than the one you pretend you're linking to.
- shkkmo 7y ago
  > If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com? I don't see what relevance a subdomain has here. As the original issue was described, it was blocking any links where the url doesn't match the link text (if the link text is a url). This means that even tracking that is done on the same domain (e.g. example.com/emailTracking/{{unique_string}} redirects to example.com/viewOrder/412) would be blocked. If you start only blocking those links if the domains don't match, things become more complicated to implement and test, especially once you consider subdomains, etc. The question remains, what is the point of this and is it worth it? Are we really promoting good security practices or just adding security theater cruft? > Why would you want to share password reset info with a third party? Who said anything about a third party? As you mention above, this blocks people who are doing their own tracking on the same domain. I don't have any numbers, but I assume that ESPs like MailGun and SendGrid are probably the most common third parties used to track email link clicks (since they will automatically substitute link urls with trackable rediracts if you enable it.) In this case, that third party already has access to the entire content and metadata of the email and giving them link click data is a relatively small addition. > Why would it? You can put a working link in the email directly - you've proven that by putting a different link in the email than the one you pretend you're linking to. Email links already work one way, perhaps if Apple implemented this feature eventually every email sender out there would switch to links that would work in Apple mail again. In the mean time, Apple has to deal with confused and dissatisfied users wondering why links in their emails don't work. How would you implement link url / text mismatch blocking? Have you thought through the consequences for your users and their understanding of security or satisfaction with your product?
  - luckylion 7y ago
    > Are we really promoting good security practices or just adding security theater cruft? We're taking away easy attacks, just like blocking known spammers from delivering emails to your MTA. Yes, it doesn't solve spam completely, but it reduces the amount. Add other things like SPF, DKIM etc and you can identify even more malicious emails and warn the user. And certainly, the OP's description mentioned matching urls (though the text would have to match the href, so "ebay.com" would likely be fine for "https://ebay.com/something" https://ebay.com/something"), but again: what's the harm in linking to the actual URL? Why the need to hide it, IF you already make the link text look like a URL? I'm sure there are also reasons why a site operator wants to avoid SSL, but I do like the fact that many browsers do warn users when (potentially) sensitive data gets transmitted via plain text. > Who said anything about a third party? The super majority of click-tracking runs via third parties. And yes, every additional detail you share with them (PII has gotten a lot of attention lately, and I'm beginning to come around and love GDPR) will put your users more at risk - now it's not just your database that risks exposing your users when a leak/breach happens, it's also your email provider's. > How would you implement link url / text mismatch blocking? Have you thought through the consequences for your users and their understanding of security or satisfaction with your product? I'm sure that it's not trivial, but few things are, so rejecting it for that reason doesn't sound like a good idea to me. "Hey, let's not do SSL, it's not that simple to build and might inconvenience a user that has their clock set 100 years into the future"
frenchy 7y ago
> why do you not want those people to have the information they need to refine and improve these emails Well, it comes at the expense of 1) making things slower for me and 2) making it more difficult to discern phishing emails from legitimate ones. I also find it difficult to believe that all of this analytics is actually doing much to inform me about things I care about. > Would you be happy if the email just doesn't show up or gets shunted to spam? It's unfortuate, but I would understand it if it happend. I certainly hope most phishing emails would end up in my spam.
- shkkmo 7y ago
  > 1) making things slower for me and That is a valid reason, but I suspect the extra delay of 2x your ping when you click on a link and wait for it's target to load is fairly negligible for most people. > 2) making it more difficult to discern phishing emails from legitimate ones You shouldn't be relying on link text to discern phishing emails, that is what the client checking SPF records and the user checking the contents of the url bar are for. > I also find it difficult to believe that all of this analytics is actually doing much to inform me about things I care about. Why is that? I would think it is pretty obvious how A/B testing click-through rates for emails could easily help make those emails more informative and easier to use. If the speed cost and privacy loss is not worth it to you, having the actual (non-tracked) URL available in the link text atleast gives users the option to opt out of that tracking.
rurp 7y ago
> why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you? Email A/B testing is always about marketing and trying to manipulate users, in my experience. If the content is the same, but a different button gets more clicks, it's hard for me to believe users are finding a benefit in that. I think it's far more likely that the content isn't all that compelling, but the UI tweaks managed to tickle some part of the reader's subconscious in the right way for them to click. In other words, emails with quality content don't have marketing teams running them. This is pretty much like all targeted advertising. The benefit to the company is very clear, but I don't think I'd be missing much if email analytics went away. Just as a personal opinion that I'm sure plenty of people disagree with, I dislike it when products are hyper-customized based on a lot of analytics. For instance, Netflix has a ton of data on me, but all of their tests and micro optimizations make me use the app less. I would much prefer their product if they threw all of that info in the trash, rolled the UI back 5 years, and showed me more generalized start ratings again.