11 ms·

> However, basically every mail platform creates tailored links to track click engagement. Yep, even financial institutions do this and half of them don’t even

> However, basically every mail platform creates tailored links to track click engagement. Yep, even financial institutions do this and half of them don’t even use domains they own for the tracking links. Years and years of “don’t click on suspicious links” out the window because bank.example.com/creditcard is turned into 4828fjfneo848.totallyfine.adtracker.thirdparty.example.org I hate all of it but nobody seems to give a shit (nor do they care to implement proper 2FA to effectively guard against phishing) so whatever. If people have their accounts drained because marketers gotta get that sweet engagement metric, what does it matter any more?

kergonath 5y ago
> I hate all of it but nobody seems to give a shit I hope this will change. More companies need to make some noise about it.
lttlrck 5y ago
A pet peeve is unsubscribe links are frequently on an obscure domain that has found it's way onto Adblock lists. That's got be by design.
- wlesieutre 5y ago
  If something makes itself difficult to unsubscribe you could always feed it to the spam filter
  - bentcorner 5y ago
    When I unsubscribe from a mailing list I know I didn't sign up for, I'll also hit the report spam button in the hopes it gives them some negative gmail juju.
    - mkr-hn 5y ago
      This does get reported to the sending platform. Stuff like Mailgun and Mailchimp will show you a rate for it, and they do suspend if it gets too high.
    - jtbayly 5y ago
      Depending on where you do it, yeah, it works. In the gmail interface for gmail, but also in the unsubscribe reason box for the sending platform. Both work.
      - eloisius 5y ago
        Do both, but definitely do the spam report via Gmail or your email provider because that dings the platform they use as well. Without a threat to their mailability, they'd have no incentive to keep their customers (the person spamming you) honest.
  - rabuse 5y ago
    I do this if my attempt to unsubscribe fails at all.
  - foxpurple 5y ago
    I mark any newsletter as spam if I didn’t intentionally sign up which is 100% of the time
- ssharp 5y ago
  It's not uncommon for the unsubscribe links to live on the same domain as the link tracking and other features of whatever email or marketing automation platform they are on, so if those are blocked to prevent tracking, the unsubscribe links would be as well.
- nkrisc 5y ago
  If I can't unsubscribe with a single click then it's spam and I report it as spam. They don't give a shit about me, so I don't give a shit about them.
- 3np 5y ago
  And more and more often, unsubscribe links go 403 or even 500 when on Tor or well-known VPNs, while the rest of the site works fine on it. A great way to make me never want to deal with you again is to coerce me to doxx myself to unsubscribe from your newsletter.
  - foxpurple 5y ago
    I find reporting as spam or setting a filter rule is easier than unsubscribing.
- eloisius 5y ago
  It's easy: I set a rule in Mail that flags every email containing "Unsubscribe" or related terms with a red flag, and I review and mark them as junk when they show up. Every newsletter is spam because I would never ever sign up for one, regardless of whether I do business with the sender. Either they are illegally mailing me spam from some list that they purchased, or they hid their "please don't send me bullshit" opt out when I signed up for their services, because I would never ask to receive marketing or product updates. It's all spam.
hsbauauvhabzb 5y ago
MFA won’t protect against phishing.
- techsupporter 5y ago
  The MFA we commonly use right now won't protect against phishing because, as I suspect you mean, the codes are not protected against being entered into the "wrong" site. Proper MFA, like U2F/FIDO2/whatever-it-is-called-today, will protect against phishing because the visited site won't match the hash needed to complete the second-factor-auth-flow.
- gleenn 5y ago
  Yes it does, maybe not directly. Two examples, both 1Password and my Yubikey only autofill passwords based on the domain. I immediately get a tingle when I go to autocomplete a commonly visited website and it doesn't fill ... time to immediately inspect the URL for phishing etc. Those tools have definitely saved me multiple times.
geoduck14 5y ago
My work touts the "look at links before you click!". But they also auto forward all email links to a service that scans the link for malicious stuff. The result is that when I hover over a link, I get a REALLY long url, like: https://urldefense.company.com?link=blablablablablahlablablalba https://urldefense.company.com?link=blablablablablahlablabla...... And I can't actually read it.
- nofunsir 5y ago
  My work actually visits the url ahead of time. This sucks when the link is a one-time-use only code.
  - cimnine 5y ago
    Sounds like a great target for Server Side Request Forgery, https://owasp.org/www-community/attacks/Server_Side_Request_Forgery https://owasp.org/www-community/attacks/Server_Side_Request_.... Could be fun to try if that software also visits links for internal-only applications, should such exist in your corp.
  - smcl 5y ago
    This is pretty common and something that bit us last year - enterprise Outlook 365 (or some extension? idk it was def only O365 though) added some security features that would make a HEAD request to any links contained in an email. This messed up our (admittedly antiquated) process for activating users and resetting passwords as it consumed the one-time code our systems generated for them, as you mentioned. Because the app that handled this was old and in the process of replacement we didn't want to invest too much time in rewriting it all, so a quick and easy fix was to have a handler specifically for HEAD requests to those activation and reset resources. The link protection started issuing GET requests a little while after, so we ended up having to add an extra confirmation step so the user had to click something after the link was followed. To be honest the original process we had maybe wasn't 100% perfect - users can double click links for example, and would see a message that the link had "expired". So from a UX perspective we maybe should've had the extra confirmation step before activation/reset to begin with. But I'm in two minds over email providers following all the links in your emails, it feels a bit creepy
0-_-0 5y ago
Could Apple preload those links too the way they want to preload the tracking pixels? (I don't know much about web tech)
deergomoo 5y ago
> Years and years of “don’t click on suspicious links” out the window because bank.example.com/creditcard is turned into 4828fjfneo848.totallyfine.adtracker.thirdparty.example.org I got an email from my bank (Barclays) a couple of months ago that literally took me several minutes to determine whether or not it was a phishing email. It wasn't, but it used badly compressed jpegs for the Barclays logo and the call-to-action button, the link attached to the button had no verifiable connection to Barclays, and for some reason it used backticks instead of apostrophes in the copy. When I finally did click the link I was half expecting to be taken to a page saying "you moron, this is obviously a scam" in 96pt font.
- dwighttk 5y ago
  I spend about 10 seconds at most thinking about if my bank sent me a spammy looking email and then separately go to the bank site and look for whatever they were supposedly talking about. Rule of thumb: never click on the link.
devoutsalsa 5y ago
I just don’t click on those links, except on accident because some jackass made it impossible to copy/pasta the URL on my mobile device because I couldn’t see what the URL was in a preview window.

kergonath 5y ago

> I hate all of it but nobody seems to give a shit I hope this will change. More companies need to make some noise about it.

lttlrck 5y ago

A pet peeve is unsubscribe links are frequently on an obscure domain that has found it's way onto Adblock lists. That's got be by design.

wlesieutre 5y ago
If something makes itself difficult to unsubscribe you could always feed it to the spam filter
- bentcorner 5y ago
  When I unsubscribe from a mailing list I know I didn't sign up for, I'll also hit the report spam button in the hopes it gives them some negative gmail juju.
  - mkr-hn 5y ago
    This does get reported to the sending platform. Stuff like Mailgun and Mailchimp will show you a rate for it, and they do suspend if it gets too high.
  - jtbayly 5y ago
    Depending on where you do it, yeah, it works. In the gmail interface for gmail, but also in the unsubscribe reason box for the sending platform. Both work.
    - eloisius 5y ago
      Do both, but definitely do the spam report via Gmail or your email provider because that dings the platform they use as well. Without a threat to their mailability, they'd have no incentive to keep their customers (the person spamming you) honest.
- rabuse 5y ago
  I do this if my attempt to unsubscribe fails at all.
- foxpurple 5y ago
  I mark any newsletter as spam if I didn’t intentionally sign up which is 100% of the time
ssharp 5y ago
It's not uncommon for the unsubscribe links to live on the same domain as the link tracking and other features of whatever email or marketing automation platform they are on, so if those are blocked to prevent tracking, the unsubscribe links would be as well.
nkrisc 5y ago
If I can't unsubscribe with a single click then it's spam and I report it as spam. They don't give a shit about me, so I don't give a shit about them.
3np 5y ago
And more and more often, unsubscribe links go 403 or even 500 when on Tor or well-known VPNs, while the rest of the site works fine on it. A great way to make me never want to deal with you again is to coerce me to doxx myself to unsubscribe from your newsletter.
- foxpurple 5y ago
  I find reporting as spam or setting a filter rule is easier than unsubscribing.
eloisius 5y ago
It's easy: I set a rule in Mail that flags every email containing "Unsubscribe" or related terms with a red flag, and I review and mark them as junk when they show up. Every newsletter is spam because I would never ever sign up for one, regardless of whether I do business with the sender. Either they are illegally mailing me spam from some list that they purchased, or they hid their "please don't send me bullshit" opt out when I signed up for their services, because I would never ask to receive marketing or product updates. It's all spam.

hsbauauvhabzb 5y ago

MFA won’t protect against phishing.

techsupporter 5y ago
The MFA we commonly use right now won't protect against phishing because, as I suspect you mean, the codes are not protected against being entered into the "wrong" site. Proper MFA, like U2F/FIDO2/whatever-it-is-called-today, will protect against phishing because the visited site won't match the hash needed to complete the second-factor-auth-flow.
gleenn 5y ago
Yes it does, maybe not directly. Two examples, both 1Password and my Yubikey only autofill passwords based on the domain. I immediately get a tingle when I go to autocomplete a commonly visited website and it doesn't fill ... time to immediately inspect the URL for phishing etc. Those tools have definitely saved me multiple times.

geoduck14 5y ago

My work touts the "look at links before you click!". But they also auto forward all email links to a service that scans the link for malicious stuff. The result is that when I hover over a link, I get a REALLY long url, like: https://urldefense.company.com?link=blablablablablahlablablalba https://urldefense.company.com?link=blablablablablahlablabla...... And I can't actually read it.

nofunsir 5y ago
My work actually visits the url ahead of time. This sucks when the link is a one-time-use only code.
- cimnine 5y ago
  Sounds like a great target for Server Side Request Forgery, https://owasp.org/www-community/attacks/Server_Side_Request_Forgery https://owasp.org/www-community/attacks/Server_Side_Request_.... Could be fun to try if that software also visits links for internal-only applications, should such exist in your corp.
- smcl 5y ago
  This is pretty common and something that bit us last year - enterprise Outlook 365 (or some extension? idk it was def only O365 though) added some security features that would make a HEAD request to any links contained in an email. This messed up our (admittedly antiquated) process for activating users and resetting passwords as it consumed the one-time code our systems generated for them, as you mentioned. Because the app that handled this was old and in the process of replacement we didn't want to invest too much time in rewriting it all, so a quick and easy fix was to have a handler specifically for HEAD requests to those activation and reset resources. The link protection started issuing GET requests a little while after, so we ended up having to add an extra confirmation step so the user had to click something after the link was followed. To be honest the original process we had maybe wasn't 100% perfect - users can double click links for example, and would see a message that the link had "expired". So from a UX perspective we maybe should've had the extra confirmation step before activation/reset to begin with. But I'm in two minds over email providers following all the links in your emails, it feels a bit creepy

0-_-0 5y ago

Could Apple preload those links too the way they want to preload the tracking pixels? (I don't know much about web tech)

deergomoo 5y ago

> Years and years of “don’t click on suspicious links” out the window because bank.example.com/creditcard is turned into 4828fjfneo848.totallyfine.adtracker.thirdparty.example.org I got an email from my bank (Barclays) a couple of months ago that literally took me several minutes to determine whether or not it was a phishing email. It wasn't, but it used badly compressed jpegs for the Barclays logo and the call-to-action button, the link attached to the button had no verifiable connection to Barclays, and for some reason it used backticks instead of apostrophes in the copy. When I finally did click the link I was half expecting to be taken to a page saying "you moron, this is obviously a scam" in 96pt font.

dwighttk 5y ago
I spend about 10 seconds at most thinking about if my bank sent me a spammy looking email and then separately go to the bank site and look for whatever they were supposedly talking about. Rule of thumb: never click on the link.

devoutsalsa 5y ago

I just don’t click on those links, except on accident because some jackass made it impossible to copy/pasta the URL on my mobile device because I couldn’t see what the URL was in a preview window.