4 ms·

I just wish all email clients would stop allowing HTML to hide an actual link. It needs to stop. Anchor tags and any type of onClick/onTouch event in an email s

I just wish all email clients would stop allowing HTML to hide an actual link. It needs to stop. Anchor tags and any type of onClick/onTouch event in an email should not do anything. Just stop letting them obfuscate the freaking address, it’s that simple. Tell the marketing people to go to hell, and no they cannot have their silly nicely printed link. :-)

NikolaNovak 5y ago
This. On phones especially it's getting increasingly hard, as a nerd desiring to do so, to figure out what the sender's email address and link's HTML target are :<
tshaddox 5y ago
Why do you want this specifically for HTML emails and not on actual web sites? Surely it’s just as much of a threat in either place.
- syrrim 5y ago
  Email is push, websites are pull. If you never choose to visit a website, then you'll never see a link on it. Most of the websites you do visit already prevent obfuscating links. Emails just show up in your inbox when an attacker wants them to. We could of course change that, and have people only see emails from known contacts or that they have requested. However, this destroys a major value proposition of email. Instead, it makes sense to limit the ability for senders to obfuscate the contents of email.
  - tshaddox 5y ago
    An attacker could email you an unobfuscated link to a website which contains obfuscated links and the threat model is exactly the same. Both require only that the victim 1) trust an email enough to click a link and then 2) trust the destination of that link enough to do the unsafe thing. Unless your computer propagates the "untrustworthiness" of the link from the email client to the browser and continues to prevent unobfuscated links, it seems like you've gained very little.
    - ipaddr 5y ago
      If you are forced to copy and paste you force the url to be visible. Forced copy and paste increases people just logging on to an existing sute in your hisstory to check notification.. those your netflix is canceled click here to restore service get resolved quickly when you login to netflix directly instead of netflix.d.nowhere.io
tinus_hn 5y ago
You can’t run Javascript in an email.
- shakna 5y ago
  Reality, unfortunately, isn't nearly as definitive as stating this. Several versions of Outlook, still in use, actually do support certain subsets of JavaScript, in email.
Goety 5y ago
That would be nice :)
throwawayboise 5y ago
This is part of why I read my email as text (in emacs, though that's certainly not mandatory).
jonas21 5y ago
If you put your malicious URL behind a URL shortener or a use a subdomain that looks legit, 99% of people are going to click on it anyway.
- millerm 5y ago
  The point would be if it’s from Bank of America they shouldn’t use a URL shortener.

NikolaNovak 5y ago

This. On phones especially it's getting increasingly hard, as a nerd desiring to do so, to figure out what the sender's email address and link's HTML target are :<

tshaddox 5y ago

Why do you want this specifically for HTML emails and not on actual web sites? Surely it’s just as much of a threat in either place.

syrrim 5y ago
Email is push, websites are pull. If you never choose to visit a website, then you'll never see a link on it. Most of the websites you do visit already prevent obfuscating links. Emails just show up in your inbox when an attacker wants them to. We could of course change that, and have people only see emails from known contacts or that they have requested. However, this destroys a major value proposition of email. Instead, it makes sense to limit the ability for senders to obfuscate the contents of email.
- tshaddox 5y ago
  An attacker could email you an unobfuscated link to a website which contains obfuscated links and the threat model is exactly the same. Both require only that the victim 1) trust an email enough to click a link and then 2) trust the destination of that link enough to do the unsafe thing. Unless your computer propagates the "untrustworthiness" of the link from the email client to the browser and continues to prevent unobfuscated links, it seems like you've gained very little.
  - ipaddr 5y ago
    If you are forced to copy and paste you force the url to be visible. Forced copy and paste increases people just logging on to an existing sute in your hisstory to check notification.. those your netflix is canceled click here to restore service get resolved quickly when you login to netflix directly instead of netflix.d.nowhere.io

tinus_hn 5y ago

You can’t run Javascript in an email.

shakna 5y ago
Reality, unfortunately, isn't nearly as definitive as stating this. Several versions of Outlook, still in use, actually do support certain subsets of JavaScript, in email.

Goety 5y ago

That would be nice :)

throwawayboise 5y ago

This is part of why I read my email as text (in emacs, though that's certainly not mandatory).

jonas21 5y ago

If you put your malicious URL behind a URL shortener or a use a subdomain that looks legit, 99% of people are going to click on it anyway.

millerm 5y ago
The point would be if it’s from Bank of America they shouldn’t use a URL shortener.