5 ms·

All URLs sent to any major email provider are "clicked" because they are scanning the page to see if it is phishing or otherwise malicious (desktop antivirus an

by mike_d 5y ago

All URLs sent to any major email provider are "clicked" because they are scanning the page to see if it is phishing or otherwise malicious (desktop antivirus and other things will also prescan URLs). It also protects privacy by defeating click tracking on marketing emails. Google will also pre-load all the images in your email too. You shouldn't take any write action to your database just based on a URL being visited. Take them to the verification page and ask them to sign in or submit a form with the token pre-filled.

dheera 5y ago
> Google will also pre-load all the images in your email too PLEASE disable automatic loading in Gmail settings. Don't let the idiots use unethical, stalkerish e-mail read receipts.
- anamexis 5y ago
  Doesn't automatic loading render those read receipts meaningless?
  - sp332 5y ago
    Gmail only loads the images when you load the message. It's been that way since late 2013. https://arstechnica.com/information-technology/2013/12/dear-gmailer-i-know-what-you-read-last-summer-and-last-night-and-today/ https://arstechnica.com/information-technology/2013/12/dear-...
- rgbrgb 5y ago
  Doesn't gmail's preloading defeat the read receipts? It makes it so every tracking pixel sent to gmail gets loaded (and not by your IP), thereby making it meaningless.
  - dheera 5y ago
    I thought gmail preloads only when the e-mail is opened. I thought it was basically just a proxy.
  - sp332 5y ago
    This was true briefly in 2013. https://arstechnica.com/information-technology/2013/12/gmail-blows-up-e-mail-marketing-by-caching-all-images-on-google-servers/ https://arstechnica.com/information-technology/2013/12/gmail... But they got so much pushback they effectively disabled it. https://arstechnica.com/information-technology/2013/12/dear-gmailer-i-know-what-you-read-last-summer-and-last-night-and-today/ https://arstechnica.com/information-technology/2013/12/dear-... (It's still cached, but not in a privacy-preserving way.)
    - anamexis 5y ago
      It's still more privacy-preserving than not preloading them at all, right? Whoever is serving the images doesn't get your IP addresses, cookies, etc. Not saying Google is virtuous here -- it only serves to enforce their advertising monopoly -- but I don't see how the image caching in itself is a bad thing.
      - sp332 5y ago
        Ok, that's probably true. Still works as a read receipt though.
        graftak 5y ago
        Not if gmail always follows (image) links in emails, regardless of whether the recipient address belongs to anyone. Then it’s all noise.
        account42 5y ago
        But they don't.
  - EMM_386 5y ago
    > Doesn't gmail's preloading defeat the read receipts? It makes it so every tracking pixel sent to gmail gets loaded (and not by your IP), thereby making it meaningless. According to some articles I've read, the marketers can still name the images unique per user. So when Google's caches query for it, they still know it's you. I will keep "always load images" off as usual in Gmail. https://arstechnica.com/information-technology/2013/12/dear-gmailer-i-know-what-you-read-last-summer-and-last-night-and-today/ https://arstechnica.com/information-technology/2013/12/dear-...
    - tgsovlerkhgsel 5y ago
      If Google fetches the images when the mail is delivered (not when it is opened), all the sender learns is that the mail arrived (but not whether the user actually looked at it). I'm not sure if that's the case though.
- jhanschoo 5y ago
  For those confused by this comment, they were referring to automatic loading of images when you open mail.
_wldu 5y ago
True. Phish testing campaigns in companies that send fake phishing emails to employees, are probably full of inaccurate data due to this. "Why did you click that link? But, I didn't."
- mike_d 5y ago
  Many phishing test as a service companies will report clicks vs. people who actually interact with the page.
  - SilverRed 5y ago
    Which is more accurate since clicking a link is not usually an issue while filling out a form on it is the real attack.
    - sodality2 5y ago
      Most companies still trigger whatever action (disciplinary, additional training) upon just clicking the link, though.
  - joering2 5y ago
    Would you mind naming some? I kind of have a hard time finding those, and some time ago I purchased phishingly.com for a side project, but it doesn't seem I will be working on this anytime soon, so I may as well pass it on.
    - inetknght 5y ago
      > Phish testing campaigns in companies that send fake phishing emails to employees, are probably full of inaccurate data due to this. Anecdata: just running curl on one of those test URLs will trigger a failure and can result in a long discussion with HR and IT. > > Many phishing test as a service companies will report clicks vs. people who actually interact with the page. > Would you mind naming some? KnowBe4 is one such company. Their emails are also easy to spot because they'll have an X-PHISH-TEST email header.
munk-a 5y ago
I frequently use depsez[1] for explain analysis and, initially when I'd create a new plan I was sending the delete link alongside in a DM to my coworkers so they could clear the entry when they'd finished with it... until I realized that slack was pre-fetching the link and deleting explains before my coworkers could take a look. This is an interesting case since having the request be a pure `GET` submission is pretty convenient - but yea... there's a good reason to follow the proscribed behaviors for when to use `POST`. 1. https://explain.depesz.com/ https://explain.depesz.com/ great site - I highly recommend it for getting into postgres performance analysis.
ljm 5y ago
You think every email provider crawls links in your email and the inspects the destinations to protect you from spam? That is patently not true, otherwise you would be dealing with utter chaos as you interacted with the internet. If, as the OP claims, Gmail actually _is_ doing this, then that is worrying but it's not the general case. Google pre-loads and caches images, which many people consider problematic, but they're not pre-fetching URLs. Refer to these two incredibly recent posts to understand why: 1. https://news.ycombinator.com/item?id=28192269 https://news.ycombinator.com/item?id=28192269 - How to prevent email spoofing, using an unholy combination of silly standards 2. https://news.ycombinator.com/item?id=28194477 https://news.ycombinator.com/item?id=28194477 - Email Authenticity 101: DKIM, Dmarc, and SPF
- sp332 5y ago
  Well, yes I do believe that. How else do you explain the behavior seen in the article? Outlook.com emails have been doing it for years. https://stackoverflow.com/questions/32851044/how-do-i-stop-outlook-com-from-following-links-in-email https://stackoverflow.com/questions/32851044/how-do-i-stop-o... Microsoft also scans links sent in encrypted Skype messages. https://arstechnica.com/information-technology/2013/05/think-your-skype-messages-get-end-to-end-encryption-think-again/ https://arstechnica.com/information-technology/2013/05/think...
- LegitShady 5y ago
  Office 365 calls this "safe links" and it's a feature in Outlook and teams. They have a page describing it and everything.
deepstack 5y ago
That also include links sent on all major chat, in this day and age, if you not self-hosting, or E2E all your links will be minded by companies.
- mercora 5y ago
  WhatsApp and Signal notably don't do this on their servers for the link preview features they will fetch it locally on your device.
aflag 5y ago
> protects privacy by defeating click tracking on marketing emails. I don't think that's true. It should be pretty trivial to know whether a click came from a user or google.

by mike_d 5y ago

dheera 5y ago

> Google will also pre-load all the images in your email too PLEASE disable automatic loading in Gmail settings. Don't let the idiots use unethical, stalkerish e-mail read receipts.

anamexis 5y ago
Doesn't automatic loading render those read receipts meaningless?
- sp332 5y ago
  Gmail only loads the images when you load the message. It's been that way since late 2013. https://arstechnica.com/information-technology/2013/12/dear-gmailer-i-know-what-you-read-last-summer-and-last-night-and-today/ https://arstechnica.com/information-technology/2013/12/dear-...
rgbrgb 5y ago
Doesn't gmail's preloading defeat the read receipts? It makes it so every tracking pixel sent to gmail gets loaded (and not by your IP), thereby making it meaningless.
- dheera 5y ago
  I thought gmail preloads only when the e-mail is opened. I thought it was basically just a proxy.
- sp332 5y ago
  This was true briefly in 2013. https://arstechnica.com/information-technology/2013/12/gmail-blows-up-e-mail-marketing-by-caching-all-images-on-google-servers/ https://arstechnica.com/information-technology/2013/12/gmail... But they got so much pushback they effectively disabled it. https://arstechnica.com/information-technology/2013/12/dear-gmailer-i-know-what-you-read-last-summer-and-last-night-and-today/ https://arstechnica.com/information-technology/2013/12/dear-... (It's still cached, but not in a privacy-preserving way.)
  - anamexis 5y ago
    It's still more privacy-preserving than not preloading them at all, right? Whoever is serving the images doesn't get your IP addresses, cookies, etc. Not saying Google is virtuous here -- it only serves to enforce their advertising monopoly -- but I don't see how the image caching in itself is a bad thing.
    - sp332 5y ago
      Ok, that's probably true. Still works as a read receipt though.
      - graftak 5y ago
        Not if gmail always follows (image) links in emails, regardless of whether the recipient address belongs to anyone. Then it’s all noise.
        account42 5y ago
        But they don't.
- EMM_386 5y ago
  > Doesn't gmail's preloading defeat the read receipts? It makes it so every tracking pixel sent to gmail gets loaded (and not by your IP), thereby making it meaningless. According to some articles I've read, the marketers can still name the images unique per user. So when Google's caches query for it, they still know it's you. I will keep "always load images" off as usual in Gmail. https://arstechnica.com/information-technology/2013/12/dear-gmailer-i-know-what-you-read-last-summer-and-last-night-and-today/ https://arstechnica.com/information-technology/2013/12/dear-...
  - tgsovlerkhgsel 5y ago
    If Google fetches the images when the mail is delivered (not when it is opened), all the sender learns is that the mail arrived (but not whether the user actually looked at it). I'm not sure if that's the case though.
jhanschoo 5y ago
For those confused by this comment, they were referring to automatic loading of images when you open mail.

_wldu 5y ago

True. Phish testing campaigns in companies that send fake phishing emails to employees, are probably full of inaccurate data due to this. "Why did you click that link? But, I didn't."

mike_d 5y ago
Many phishing test as a service companies will report clicks vs. people who actually interact with the page.
- SilverRed 5y ago
  Which is more accurate since clicking a link is not usually an issue while filling out a form on it is the real attack.
  - sodality2 5y ago
    Most companies still trigger whatever action (disciplinary, additional training) upon just clicking the link, though.
- joering2 5y ago
  Would you mind naming some? I kind of have a hard time finding those, and some time ago I purchased phishingly.com for a side project, but it doesn't seem I will be working on this anytime soon, so I may as well pass it on.
  - inetknght 5y ago
    > Phish testing campaigns in companies that send fake phishing emails to employees, are probably full of inaccurate data due to this. Anecdata: just running curl on one of those test URLs will trigger a failure and can result in a long discussion with HR and IT. > > Many phishing test as a service companies will report clicks vs. people who actually interact with the page. > Would you mind naming some? KnowBe4 is one such company. Their emails are also easy to spot because they'll have an X-PHISH-TEST email header.

munk-a 5y ago

I frequently use depsez[1] for explain analysis and, initially when I'd create a new plan I was sending the delete link alongside in a DM to my coworkers so they could clear the entry when they'd finished with it... until I realized that slack was pre-fetching the link and deleting explains before my coworkers could take a look. This is an interesting case since having the request be a pure `GET` submission is pretty convenient - but yea... there's a good reason to follow the proscribed behaviors for when to use `POST`. 1. https://explain.depesz.com/ https://explain.depesz.com/ great site - I highly recommend it for getting into postgres performance analysis.

ljm 5y ago

You think every email provider crawls links in your email and the inspects the destinations to protect you from spam? That is patently not true, otherwise you would be dealing with utter chaos as you interacted with the internet. If, as the OP claims, Gmail actually _is_ doing this, then that is worrying but it's not the general case. Google pre-loads and caches images, which many people consider problematic, but they're not pre-fetching URLs. Refer to these two incredibly recent posts to understand why: 1. https://news.ycombinator.com/item?id=28192269 https://news.ycombinator.com/item?id=28192269 - How to prevent email spoofing, using an unholy combination of silly standards 2. https://news.ycombinator.com/item?id=28194477 https://news.ycombinator.com/item?id=28194477 - Email Authenticity 101: DKIM, Dmarc, and SPF

sp332 5y ago
Well, yes I do believe that. How else do you explain the behavior seen in the article? Outlook.com emails have been doing it for years. https://stackoverflow.com/questions/32851044/how-do-i-stop-outlook-com-from-following-links-in-email https://stackoverflow.com/questions/32851044/how-do-i-stop-o... Microsoft also scans links sent in encrypted Skype messages. https://arstechnica.com/information-technology/2013/05/think-your-skype-messages-get-end-to-end-encryption-think-again/ https://arstechnica.com/information-technology/2013/05/think...
LegitShady 5y ago
Office 365 calls this "safe links" and it's a feature in Outlook and teams. They have a page describing it and everything.

deepstack 5y ago

That also include links sent on all major chat, in this day and age, if you not self-hosting, or E2E all your links will be minded by companies.

mercora 5y ago
WhatsApp and Signal notably don't do this on their servers for the link preview features they will fetch it locally on your device.

aflag 5y ago

> protects privacy by defeating click tracking on marketing emails. I don't think that's true. It should be pretty trivial to know whether a click came from a user or google.