4 ms·

Can't reproduce on either Gmail or GSuite, including on webmail (I thought this could be some sort of "you're leaving example.com, do you really want to do that

by oefrha 6y ago

Can't reproduce on either Gmail or GSuite, including on webmail (I thought this could be some sort of "you're leaving example.com, do you really want to do that" thing, but nope). The part about IMAP being affected sounds especially suspicious. Knowing op's track record I'd rather hear from some more impartial sources.

sneak 6y ago
My track record? If you're going to accuse me of lying, I'd prefer that you do so overtly and put your own credibility on the line. https://twitter.com/sneakdotberlin/status/1317838356382797824 https://twitter.com/sneakdotberlin/status/131783835638279782... It says source=gmail-imap right in the URL. Look.
- oefrha 6y ago
  Sorry, you have a history of making wild accusations like this: https://news.ycombinator.com/item?id=21109530 https://news.ycombinator.com/item?id=21109530
  - jollofricepeas 6y ago
    Agreed. His “evidence” means nothing and his background is very shady. Those screenshots could be completely made up. Can someone else verify with raw data?
    - bArray 6y ago
      I've tried from both GMail and Thunderbird, not able to repeat the experiment.
    - megous 6y ago
      Screenshots are not completely made up. At least the `usg` HMAC seems to be valid, and timestamps are recent enough, so the redirector URLs are legit. Of course it's possible to generate the valid redirector URLs in other ways. So if this is a scam it's not a completely stupid scam. Anyway, A/B testing or gradual deoployment is a thing. I'll not turn against a fellow hacker and call him shady, just because a potential A/B gaslighing practice from some megacorp. ;) I'll just wait.
  - sneak 6y ago
    https://twitter.com/tblodt/status/1317875714981416962 https://twitter.com/tblodt/status/1317875714981416962
- defnotashton2 6y ago
  Sorry for us being skeptical of 140 character claims... I don't see how that url means Google is doing this, when none of us have been able to verify. There could be 100 different things touching your email doing this. Pretty sure most hn wants this to be true as a reason to sharpen pitchforks.
  - jollofricepeas 6y ago
    Exactly and the OP has a strong past of making false and misleading claims before.
tcombinator 6y ago
I can and have reproduced this for over a week now and have been hammering google & apple to fix it with no luck. Google says it's an Apple issue and Apple says it's a Google issue. The issue only appears to surface under specific use cases and always requires the user to have setup Mail.app on macOS or iOS with the gsuite account/user set to type "Google" vs. "IMAP". This seems to be the real pickle as all the following use cases below require this to be true for the link manipulation to occur. The same messages viewed in gmail.com or in Mail.app on macOS or iOS with the account type set to "IMAP" have their links left untouched. - Sending a message from a gsuite account user to an external party DOES NOT show the issue - Sending a message from an internal gsuite account user to another user in the same gsuite account + another user outside of the gsuite account DOES show the issue - Sending a message from a gsuite account user to another gsuite user in the same account DOES NOT show the issue - Sending a message from an external account into a gsuite account user DOES SHOW the issue (this might be tied to admin settings in G Suite > Settings for Gmail > Safety - still needs to be tested more) - The same messages that DO SHOW the issue only show it in Mail.app on macOS & iOS when the gsuite user account is setup as "Google" vs. "IMAP". It DOES NOT show up in the GMAIL iOS app nor does it show up in the gmail.com web interface. Google support has been effectively useless. Apple support has honestly done more to shed light on the issue. However, both companies are blaming the other and refusing to escalate to engineering or get on a call with the other company to sort this out together. Of course, Google support claims nobody else is reporting this, while Apple support alerted me to this thread. Super frustrating all around. If you are a Gsuite user please report this so I'm not yelling into the wind here. I can also confirm for my account the issue started on October 6, 2020.

by oefrha 6y ago

sneak 6y ago

My track record? If you're going to accuse me of lying, I'd prefer that you do so overtly and put your own credibility on the line. https://twitter.com/sneakdotberlin/status/1317838356382797824 https://twitter.com/sneakdotberlin/status/131783835638279782... It says source=gmail-imap right in the URL. Look.

oefrha 6y ago
Sorry, you have a history of making wild accusations like this: https://news.ycombinator.com/item?id=21109530 https://news.ycombinator.com/item?id=21109530
- jollofricepeas 6y ago
  Agreed. His “evidence” means nothing and his background is very shady. Those screenshots could be completely made up. Can someone else verify with raw data?
  - bArray 6y ago
    I've tried from both GMail and Thunderbird, not able to repeat the experiment.
  - megous 6y ago
    Screenshots are not completely made up. At least the `usg` HMAC seems to be valid, and timestamps are recent enough, so the redirector URLs are legit. Of course it's possible to generate the valid redirector URLs in other ways. So if this is a scam it's not a completely stupid scam. Anyway, A/B testing or gradual deoployment is a thing. I'll not turn against a fellow hacker and call him shady, just because a potential A/B gaslighing practice from some megacorp. ;) I'll just wait.
- sneak 6y ago
  https://twitter.com/tblodt/status/1317875714981416962 https://twitter.com/tblodt/status/1317875714981416962
defnotashton2 6y ago
Sorry for us being skeptical of 140 character claims... I don't see how that url means Google is doing this, when none of us have been able to verify. There could be 100 different things touching your email doing this. Pretty sure most hn wants this to be true as a reason to sharpen pitchforks.
- jollofricepeas 6y ago
  Exactly and the OP has a strong past of making false and misleading claims before.

tcombinator 6y ago

I can and have reproduced this for over a week now and have been hammering google & apple to fix it with no luck. Google says it's an Apple issue and Apple says it's a Google issue. The issue only appears to surface under specific use cases and always requires the user to have setup Mail.app on macOS or iOS with the gsuite account/user set to type "Google" vs. "IMAP". This seems to be the real pickle as all the following use cases below require this to be true for the link manipulation to occur. The same messages viewed in gmail.com or in Mail.app on macOS or iOS with the account type set to "IMAP" have their links left untouched. - Sending a message from a gsuite account user to an external party DOES NOT show the issue - Sending a message from an internal gsuite account user to another user in the same gsuite account + another user outside of the gsuite account DOES show the issue - Sending a message from a gsuite account user to another gsuite user in the same account DOES NOT show the issue - Sending a message from an external account into a gsuite account user DOES SHOW the issue (this might be tied to admin settings in G Suite > Settings for Gmail > Safety - still needs to be tested more) - The same messages that DO SHOW the issue only show it in Mail.app on macOS & iOS when the gsuite user account is setup as "Google" vs. "IMAP". It DOES NOT show up in the GMAIL iOS app nor does it show up in the gmail.com web interface. Google support has been effectively useless. Apple support has honestly done more to shed light on the issue. However, both companies are blaming the other and refusing to escalate to engineering or get on a call with the other company to sort this out together. Of course, Google support claims nobody else is reporting this, while Apple support alerted me to this thread. Super frustrating all around. If you are a Gsuite user please report this so I'm not yelling into the wind here. I can also confirm for my account the issue started on October 6, 2020.