6 ms·

I would consider this innovative, but Office365 has had this built in (and as far as I can tell impossible to turn off) for years. What used to be a sensible li

I would consider this innovative, but Office365 has had this built in (and as far as I can tell impossible to turn off) for years. What used to be a sensible link turns into a vast "safe link honest, guv" mess. I call it "man in the middle attack as a service"

patentatt 4y ago
Same with PayPal. I've received perfectly valid emails direct from PayPal that include random sketchy links from third parties that are obvious phishing expeditions. I reported it to PayPal, but the ability still exists.
- 411111111111111 4y ago
  That's inherent to features that allow user generated content, which is obviously mandatory in the context of PayPals invoicing feature. The only reason why companies don't care about it in the context of mail is because there is no equivalent to safe browsing for mails, so Domains aren't penalized by Google for sending fraudulent messages at small scale. If this was to change, they'd all pivot to using secondary domains for these mails, like GitHub does for GitHub pages. It would also be a pretty pointless feature as you'd probably complain anyway, as the email would still come from a Paypal owned domain. On the same topic: if you've got a Gmail address you're also able to send from @googlemail.com Is this another security issue in your opinion?
  - patentatt 4y ago
    How about disallowing urls or even just vetting urls in the messages sent from your own service? One of the ones I received was a link to a fake PayPal login that was something along the of lines of (making this up) http://login.PayPal.com.somethingsketchy.biz/login.php http://login.PayPal.com.somethingsketchy.biz/login.php and was a replica of the PayPal login screen. It was pretty blatant. Seems like they should figure out a way to avoid that is all, because I know my mother would have put in her PayPal credentials to that site and I'd be hard pressed to fault her for it. We train users to check if it's a valid/real email before clicking on links and this was a perfectly real email sent from PayPal with a malicious link. This seems like PayPal's responsibility to me. I'm shocked they don't care about this.
    - 411111111111111 4y ago
      Vetting is impossible, the scammers can just change the content of the page after the PayPal bot requested the website. Human vetting is even more impossible, invoices will always require unique links for each mail. Nor does it matter wherever it's a clickable link or text in this context. The only way to "solve" your issue is by removing user generated content, which makes the invoicing feature inherently impossible. If you're seriously shocked that PayPal isn't decommissioning a highly profitable feature because a random carebear worries about their family... Then you're honestly out of touch with reality. Most people nowadays know that emails are untrustworthy, and if your family doesn't... Then you should tell them that, as they're bound to get scammed eventually if they click on any links from their inbox.
      - crtasm 4y ago
        http://login.PayPal.com.somethingsketchy.biz/login.php http://login.PayPal.com.somethingsketchy.biz/login.php paypal in a URL pointing to a non-paypal domain, no need to load the webpage to flag that.
ragebol 4y ago
Same for MS Teams. Before, we used Google Meet, which produced 9-letter meeting IDs, that I would be able to remeber if I really wanted to. Teams just generates mile long URLs that encode more information than some of the meetings themselves in the worst case.
- plugin-baby 4y ago
  > URLs that encode more information than some of the meetings themselves in the worst case Sadly this is also possible with a 9-letter code.
  - marcosdumay 4y ago
    Well, in the worst case a single bit is overkill.
  - djbusby 4y ago
    I went to a government committee meeting, first one of the committee to get the ball rolling. 2+ hours of everyone introducing themselves, to folk who already know each other. And we're adjourned. Next month we'll discuss the rules of governance for the committee. That's two of the total 6 meetings the committee has allocated. And all the bureaucrats made plenty of show for the "progress we've made".
    - ryanianian 4y ago
      A lot of bureaucracy at the beginning might not be bad if it's indeed front-loading it for an otherwise successful collaboration.
      - djbusby 4y ago
        What you say true. However, this particular organization has a well documented history of committee without action.
avgcorrection 4y ago
[deleted]
- barelysapient 4y ago
  If they claim it’s virus free, then it must be true!
- lcnPylGDnU4H9OF 4y ago
  I'd be tempted to suggest they include that information in their dating profile.
  - bookofjoe 4y ago
    so great
  - Obscurity4340 4y ago
    [dead]
- tjungblut 4y ago
  I had similar vibes from an email I got from a recruiter stating: > -- all outgoing emails from ACMECORP are virus checked by the newest version of WINDOWS DEFENDER --
  - Obscurity4340 4y ago
    [dead]
mnw21cam 4y ago
I use https://github.com/Dunky13/outlook_unsafelink https://github.com/Dunky13/outlook_unsafelink to fix that. I agree, it's a stupid way of training users to accept dodgy links.
drowsspa 4y ago
I sent a URL through Teams to an Ops guy to put in an Nginx configuration file as an upstream server. He just copied and pasted and it's now a configuration file in production with all of the parameters Teams added.
thomaslord 4y ago
As a G Suite user, my "favorite" (/s) M365 feature is those "WARNING: EXTERNAL EMAIL" banners. Whenever I'm in an email thread with someone whose company adds those banners, it breaks Gmail's ability to collapse the previous messages at the bottom of the email.

patentatt 4y ago

Same with PayPal. I've received perfectly valid emails direct from PayPal that include random sketchy links from third parties that are obvious phishing expeditions. I reported it to PayPal, but the ability still exists.

411111111111111 4y ago
That's inherent to features that allow user generated content, which is obviously mandatory in the context of PayPals invoicing feature. The only reason why companies don't care about it in the context of mail is because there is no equivalent to safe browsing for mails, so Domains aren't penalized by Google for sending fraudulent messages at small scale. If this was to change, they'd all pivot to using secondary domains for these mails, like GitHub does for GitHub pages. It would also be a pretty pointless feature as you'd probably complain anyway, as the email would still come from a Paypal owned domain. On the same topic: if you've got a Gmail address you're also able to send from @googlemail.com Is this another security issue in your opinion?
- patentatt 4y ago
  How about disallowing urls or even just vetting urls in the messages sent from your own service? One of the ones I received was a link to a fake PayPal login that was something along the of lines of (making this up) http://login.PayPal.com.somethingsketchy.biz/login.php http://login.PayPal.com.somethingsketchy.biz/login.php and was a replica of the PayPal login screen. It was pretty blatant. Seems like they should figure out a way to avoid that is all, because I know my mother would have put in her PayPal credentials to that site and I'd be hard pressed to fault her for it. We train users to check if it's a valid/real email before clicking on links and this was a perfectly real email sent from PayPal with a malicious link. This seems like PayPal's responsibility to me. I'm shocked they don't care about this.
  - 411111111111111 4y ago
    Vetting is impossible, the scammers can just change the content of the page after the PayPal bot requested the website. Human vetting is even more impossible, invoices will always require unique links for each mail. Nor does it matter wherever it's a clickable link or text in this context. The only way to "solve" your issue is by removing user generated content, which makes the invoicing feature inherently impossible. If you're seriously shocked that PayPal isn't decommissioning a highly profitable feature because a random carebear worries about their family... Then you're honestly out of touch with reality. Most people nowadays know that emails are untrustworthy, and if your family doesn't... Then you should tell them that, as they're bound to get scammed eventually if they click on any links from their inbox.
    - crtasm 4y ago
      http://login.PayPal.com.somethingsketchy.biz/login.php http://login.PayPal.com.somethingsketchy.biz/login.php paypal in a URL pointing to a non-paypal domain, no need to load the webpage to flag that.

ragebol 4y ago

Same for MS Teams. Before, we used Google Meet, which produced 9-letter meeting IDs, that I would be able to remeber if I really wanted to. Teams just generates mile long URLs that encode more information than some of the meetings themselves in the worst case.

plugin-baby 4y ago
> URLs that encode more information than some of the meetings themselves in the worst case Sadly this is also possible with a 9-letter code.
- marcosdumay 4y ago
  Well, in the worst case a single bit is overkill.
- djbusby 4y ago
  I went to a government committee meeting, first one of the committee to get the ball rolling. 2+ hours of everyone introducing themselves, to folk who already know each other. And we're adjourned. Next month we'll discuss the rules of governance for the committee. That's two of the total 6 meetings the committee has allocated. And all the bureaucrats made plenty of show for the "progress we've made".
  - ryanianian 4y ago
    A lot of bureaucracy at the beginning might not be bad if it's indeed front-loading it for an otherwise successful collaboration.
    - djbusby 4y ago
      What you say true. However, this particular organization has a well documented history of committee without action.

avgcorrection 4y ago

[deleted]

barelysapient 4y ago
If they claim it’s virus free, then it must be true!
lcnPylGDnU4H9OF 4y ago
I'd be tempted to suggest they include that information in their dating profile.
- bookofjoe 4y ago
  so great
- Obscurity4340 4y ago
  [dead]
tjungblut 4y ago
I had similar vibes from an email I got from a recruiter stating: > -- all outgoing emails from ACMECORP are virus checked by the newest version of WINDOWS DEFENDER --
- Obscurity4340 4y ago
  [dead]

mnw21cam 4y ago

I use https://github.com/Dunky13/outlook_unsafelink https://github.com/Dunky13/outlook_unsafelink to fix that. I agree, it's a stupid way of training users to accept dodgy links.

drowsspa 4y ago

I sent a URL through Teams to an Ops guy to put in an Nginx configuration file as an upstream server. He just copied and pasted and it's now a configuration file in production with all of the parameters Teams added.

thomaslord 4y ago

As a G Suite user, my "favorite" (/s) M365 feature is those "WARNING: EXTERNAL EMAIL" banners. Whenever I'm in an email thread with someone whose company adds those banners, it breaks Gmail's ability to collapse the previous messages at the bottom of the email.