3 ms·

A funny story (well, funny because it didn't happen to me) was chronicled on a recent episode of Corey Quinn's "Whiteboard Confessions" -- https://www.lastweeki

by mikece 6y ago

A funny story (well, funny because it didn't happen to me) was chronicled on a recent episode of Corey Quinn's "Whiteboard Confessions" -- https://www.lastweekinaws.com/podcast/aws-morning-brief/whiteboard-confessional-click-here-to-break-production/ https://www.lastweekinaws.com/podcast/aws-morning-brief/whit... -- where Slackbot's auto URL unfurling feature "clicked" an SNS alert unsubscribe link when a tech posted the a report including that link into a slack channel. If nobody lost their job over this triggering a SEV-1 alert I'm sure they had a laugh about it later. Another issue with auto-unfurling links or generating previews of URLs is the potential for stalking. If I'm hunting my ex and I know their cell phone number AND that they have an iPhone I can simply send a link to a website and let iOS generate the preview... which then pings the URL of the website which I set up and I can now run geo-IP resolution and narrow down where my ex is (and maybe I follow up with a well-crafted PDF exploit when I'm ready to narrow down even more on an area). While systemvoltage was a bit brusque in how the complaint was worded above, these "friendly and helpful" features of Slack, SMS, and other apps can have devastating unforeseen consequences. I question the value of having to opt out of these features instead of making them opt-in instead.

systemvoltage 6y ago
haha, wow. This is some story. Thanks for sharing.
crazygringo 6y ago
That's an interesting idea of a security breach. In practice it's going to be difficult because: 1) You can't do effective geolocation on cell phone IP address, except perhaps at a country level [1] 2) Your ex would need to open your message to trigger the link preview loading. If you're stalking them, they're probably either ignoring you or blocking you 3) At most, if the ex is connected to a Wi-Fi network like Starbucks and opens the message, you'll be able to get the city they're in, maybe. But at the end of the day, what you'd get from link previews is no different from embedding a tracker image in an e-mail. And while it requires someone to suspect they're being stalked, blocking would prevent all of this. [1] http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pdf http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pd...
Nextgrid 6y ago
As far as I know the iOS implementation mitigates that by generating the preview on the sender side. The receiver side will not make a request to the URL unless they manually click on it.
- icebraining 6y ago
  Same for Whatsapp and Wire.

by mikece 6y ago

systemvoltage 6y ago

haha, wow. This is some story. Thanks for sharing.

crazygringo 6y ago

That's an interesting idea of a security breach. In practice it's going to be difficult because: 1) You can't do effective geolocation on cell phone IP address, except perhaps at a country level [1] 2) Your ex would need to open your message to trigger the link preview loading. If you're stalking them, they're probably either ignoring you or blocking you 3) At most, if the ex is connected to a Wi-Fi network like Starbucks and opens the message, you'll be able to get the city they're in, maybe. But at the end of the day, what you'd get from link previews is no different from embedding a tracker image in an e-mail. And while it requires someone to suspect they're being stalked, blocking would prevent all of this. [1] http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pdf http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pd...

Nextgrid 6y ago

As far as I know the iOS implementation mitigates that by generating the preview on the sender side. The receiver side will not make a request to the URL unless they manually click on it.

icebraining 6y ago
Same for Whatsapp and Wire.