8 ms·

Shifting Cyber Norms: Microsoft security POST-ing to you

155 points by mschuster91 2y ago

bawolff 2y ago
Does that mean they are automatically pressing the "unsubscribe" link?
- philipwhiuk 2y ago
  Yes.
- lexicality 2y ago
  I suppose that explains why so often I have to click a "yes really unsubscribe" button once the link loads. How annoying.
  - dspillett 2y ago
    Yep, along with many “magic link” emails now going to a stub form where you click a button to continue via POST request, instead of going direct to the target resource. Not that this is effective if the scanners are now submitting POST requests as well as following simple links. Though also the “I'm sure I want to unsubscribe” is in part to deliberately add extra steps to unsubscribing.
    - diggan 2y ago
      > emails now Not sure what time-frames we're talking about here, but I remember having to work around this particular issue more than 4 years ago, I'm sure it was also an issue before too. It's been like this for a long time.
      - dspillett 2y ago
        I've been around long enough that “now” and “recently” is in comparison to times before 2015. Sometimes before 2000… Also, a lot of advice and guidelines you see about email haven't been updated since somewhere between 2000 and 2015, even when they carry more recent dates, so are significantly incorrect.
        diggan 2y ago
        > I've been around long enough that “now” and “recently” is in comparison to times before 2015. Sometimes before 2000… Alright, everyone sees things differently :) I probably programmed professionally since 2012, but I don't think I'll call anything after ~2020 "recent" or happening "now".
    - bawolff 2y ago
      Can't wait to have to fill out a captcha to unsubscribe.
grayhatter 2y ago
Microsoft knows what they're doing. The problem is users dont. I don't know what you care about more, your users convenience, or their safety and security. But no chance in hell I'd allow MS to dictate the terms of the security of my services. I'd solve this by warning users who attempt to reuse consumed links that the link has been used already, and likely list broken email providers that I suspect are using software that breaks this. And then wait. Let them complain to their IT, or whomever is responsible for picking broken software. If I was feeling really petty, the clown that wrote this link scanning software isn't in charge of the networking, so you could eventually enumerate the subnets that MS uses, and black list them. Then the links might actually get to users connecting from non MS data centers. You could roll over and decrease your security so that MS can claim they increased theirs... But you shouldn't! They can only get away with turning security into a negative sum game if you play along. Please don't?
- philipwhiuk 2y ago
  That's nice. Here's how that will go: User: Hey IT, a site I'm trying to use says that I can't use Outlook, can we switch provider IT: Heck no. Are there any alternatives User: I guess I'll try to find them.
  - grayhatter 2y ago
    That, is only your problem if you make it your problem. Ideally, you wouldn't. But like I already said, it depends on if you're willing to sacrifice the security of all your users because, money I guess? Eventually you have to choose doing what's right, and doing what's expedient. I can't draw your line for you. Thankfully for me I've always been able to always draw mine at protecting users from abuse.
    - lexicality 2y ago
      Users care much more about convenience than security. If you made a phone that wiped itself after 3 incorrect pin attempts then you'd have a lot of very angry users wearing gloves. "It's for your own security!" wouldn't appease them.
donatj 2y ago
On our company Slack, we literally had a discussion about this being a problem yesterday. I frankly did not believe it. Security scanners really should not be clicking on things on your behalf. There's a lot worse danger there, like potentially agreeing to things you would never have agreed to.
- inetknght 2y ago
  > There's a lot worse danger there, like potentially agreeing to things you would never have agreed to. If it doesn't have my hand-written signature then it's not an agreement. I can't "agree" to something I haven't read, haven't been notified about, and haven't agreed to. A robot clicking things does not mean I agreed to whatever it clicked it. It means that the the other end of the transaction can't tell the difference between me and a robot.
  - Silhouette 2y ago
    If it doesn't have my hand-written signature then it's not an agreement. I wouldn't bet my company on that. If someone sends us an email - probably with legal weasel words included saying it's only for use by the intended recipient - and asks for confirmation of something by following a private link and pressing a confirm button and if as far as that supplier is aware we have then done that and continued accordingly then I would not be at all surprised if a court found that they were acting in good faith and we were not. Similarly if we sent something to a customer and their own IT system actively simulated a sequence of actions the intended recipient would take to confirm something then I would hope that would stand up in court as well. Otherwise we enter a legal climate where no-one in business can ever say or do any little thing without some kind of verified human approval process. It's hard to imagine how annoying and inefficient that might become for everyone. Maybe it would prompt a new generation of electronic communications and record-keeping where authenticity was built in unlike many of today's most common technologies - but it would still be a nightmare to do business until that happened.
    - inetknght 2y ago
      > If someone sends us an email - probably with legal weasel words included saying it's only for use by the intended recipient - and asks for confirmation of something by following a private link and pressing a confirm button and if as far as that supplier is aware we have then done that and continued accordingly then I would not be at all surprised if a court found that they were acting in good faith and we were not. Yes exactly. Given the escalating sophistication of malicious actors and their robots, the scenario you present is viable today. That's dangerous in ways that I cannot even begin to articulate, and I'm not even well-versed in contract law. > if we sent something to a customer and their own IT system actively simulated a sequence of actions the intended recipient would take to confirm something then I would hope that would stand up in court as well. I absolutely hope that would not stand up in court. To my knowledge a contract requires (at a minimum) a meeting of minds and consideration. You cannot agree to something you did not know about. You cannot come to a meeting of minds if you weren't told about it. That payment could be for anything. You might think it's for this one service and I might think it's for all services provided, not just the one I clicked on. Who will a court side with if you cannot prove that I, a human, agreed to it? > Otherwise we enter a legal climate where no-one in business can ever say or do any little thing without some kind of verified human approval process. Yup! And I say that's a good thing given that non-humans cannot enter into agreements, and there are plenty of non-humans who have no idea what they're getting themselves into in the current form of electronic agreements. > It's hard to imagine how annoying and inefficient that might become for everyone. You mean... you might have to actually employ people to verify that your customers are actual humans? That's a good thing all around. Unless you can't afford to employ people, in which case: your business does not have a valid business model.
diggan 2y ago
> Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript: It seems to me that someone misunderstood how to implement the logic on the frontend here. You're not supposed to send off a POST request directly as the page has been loaded to exchange the tokens, but require the user to click on a button to confirm the activity. So the flow would be: - "Send email with url+token > Frontend loads, shows button to user to confirm > User clicks button and exchange happens". Instead, wrong implementations do something like this: - "Send email with url+token > Frontend loads and exchange happens", which we've known for years to not work correctly, because of this very issue. Discourse for example implemented this perfectly, so if you need an example, that would be where I'd go. (I know it sucks that scrapers/crawlers do a lot of horrible shit, it truly does. But we've dealt with this for years now, it's not a new thing and it won't be the last shitty thing they do)
- formerly_proven 2y ago
  What about double opt-in links? What about unsubscribe links? Do these need to be triple opt-in now because of Microsoft?
  - diggan 2y ago
    > now because of Microsoft? I'm not sure why people believe this to be a new issue, I think the first time I myself implemented a work around for this issue was like 4 years ago, and here is a Stackoverflow Question about it from 7 years ago: https://stackoverflow.com/questions/43443947/how-to-stop-e-mail-clients-from-visiting-links-in-e-mail-automatically https://stackoverflow.com/questions/43443947/how-to-stop-e-m... Outlook/Microsoft is not the only ones who do this either, when I first had to work around it myself it was because it was happening in gmail if I remember correctly.
    - formerly_proven 2y ago
      Accessing links (GET), yes, executing JS and POSTing is the new thing. Putting an XHR in DOMContentLoaded was the workaround for the behavior you are talking about.
deleted 2y ago
[deleted]
arkh 2y ago
Wait, from reading the article it looks like the link they send to their users send them to a page with some javascript which automatically POST data for them. Which MS will correctly do: your "POST" is in fact a simple GET for most users with javascript on. What you should do is send your user to a page with a form requiring a manual action from them.
- badmintonbaseba 2y ago
  This just highlights how the security scanning is just theater though. So bad actors can now just have their evil content behind a form, and users get accustomed to the double opt-in workflow anyway.
  - arkh 2y ago
    Yup, best thing would be to either have a form in your email / SMS or let's get crazy: implement POST links (and maybe DELETE ones too). Your client knows it will change things when followed (so security clients and prefetchers won't open it), the server receive a POST request, and it's a one click action for the user.
pjc50 2y ago
I note this isn't (can't be) a problem in end-to-end encrypted systems.
- diggan 2y ago
  An E2E email client that would do that scanning client-side instead of remotely (like today), would surface exactly the same issue if it goes out and loads up websites for you.
efitz 2y ago
NB: 1. Most “safe browsing” browser features do this to some extent 2. Any browser or mail extension with access to the URL might also do this (1) and (2) might be done by remote servers, even in remote countries. This is one of the reasons why you should avoid magic links (like login links or bearer tokens like S3 signed URLs), because you may inadvertently be handing them to other parties.
michaelt 2y ago
I can see how Microsoft ended up in this position, although it's unfortunate. E-mails show up with obfuscated links all the time; you can't detect phishing just from the URL if legitimate e-mails are using https://us123.list-manage.com/track/click?u=87958734095826 https://us123.list-manage.com/track/click?u=87958734095826 as an URL. You need to load the URL, if you want to check if a fake Google login page shows up or something like that. And the phishers are trying to evade your URL scanner. If your URL scanner has an identifiable user-agent, or doesn't execute javascript, or there's anything else that makes it identifiable, they'll show a boring legitimate page to your scanner and only phish the real users. As I understand it, self-serve ad networks have similar challenges detecting ads placed by scammers.
- rkagerer 2y ago
  This is why I try to only open links with domain names that match the website / provider. If you want to use a third party mailing list, marketing juicer or link tracker, go nuts, but you won't be getting my clicks.
JimDabell 2y ago
If a page contains JavaScript that makes a POST request when the page loads, then it’s the developers of that page that are violating HTTP norms, not the developers of software that loads such pages. POSTs are unsafe requests that should be made as part of a user’s intent. Following a link should always be safe. Microsoft aren’t responsible for this problem – the site developers are. We already went through this with Google Web Accelerator and 37Signals twice. They couldn’t accept that mere links were a bad idea for deleting things, and GWA came along and deleted their users’ data by following links. They tried to detect and block GWA instead of following HTTP rules and it happened again. Links are supposed to be safe. Ignore this at your peril.
- Avamander 2y ago
  Microsoft making this change also rather clearly indicates that malicious actors are actively abusing these spec violations (by walling their phishing pages behind a simple POST on page load).
- superq 2y ago
  Clicking a link signals the user's intent. That's how hypertext works. Click here to agree.
  - JimDabell 2y ago
    Clicking a link indicates the user wants to see something. Clicking a button indicates the user wants to do something. Links shouldn’t change state. This has been an extremely strong convention for several decades. If you write code that changes state when a page is loaded, you are breaking this convention.
ohc 2y ago
I agree that email scanners really shouldn't be sending POST requests... but there is already a solution for this; follow RFC 8058 - https://datatracker.ietf.org/doc/html/rfc8058 https://datatracker.ietf.org/doc/html/rfc8058
raintrees 2y ago
"We may wonder also what fun a determined hacker could have with Microsoft running random bits of JavaScript on their servers and allowing these to talk to the world (or to Microsoft itself even)." So maybe there might be a way to disincentivize this behavior?
JohnMakin 2y ago
Lots of things consume URL’s other than security scanners in similar ways - as smarter people than me have commented, the solution most use (and I did recently myself) is to make the signup/signin link direct to a frontend page which makes them click to confirm. Yea, that still sucks, but you can have fun with things like this - one of my favorite things to do to figure out if an employer is snooping on my private messages in an app like say, slack, is to post a honeypot link in a DM to myself - on slack at least, it will consume the link every time the message thread is opened. So if I know I didnt open it, and I get an alert, I know someone or something has read the message. There’s tons of stuff out there like this, just assume apps are being disrespectful and plan accordingly.
aaronax 2y ago
It is an arms race that will end poorly for everyone. Whatever the legit companies do to make their links work Good guys send out email links -> Bad guys start sending out email links -> Security scanners start checking link contents Good guys hide behind automatic POST -> Bad guys start hiding behind automatic POST -> Security scanners start checking behind automatic POST Good guys hide behind button click (we are here) -> Bad guys start hiding behind button click -> Security scanners start checking behind button click Good guys hide behind link that doesn't work until 10 minutes after sending -> ... Good guys hide behind captcha -> ... Good guys hide behind plain text code that has to be copy/pasted from email -> ... Eventually the security scanners will be indistinguishable in function and intelligence from a human being. Might as well just merge it with your personal AI assistant and it will do everything for you...including getting scammed by the bad guys.
numberless 2y ago
Executing JavaScript on random pages seems like quite a bad idea, spammers could potentially include links to JavaScript which does resource intensive things, like that small and sketchy trend of including Bitcoin miners in websites.
snthd 2y ago
Do headless browsers default to not following javascript POST requests? Do Microsoft devs use Copilot to code?
szundi 2y ago
This already happened when you had a link in for example GMail in iOS, it wanted to open that login link inside its own browser popup (shame) - thus using up the 1x login at once. I jumped out to the Safari browser, my choice, but the login link had been expired by the GMail window.
cess11 2y ago
Wow, that's nasty. I wish for a harsh, comprehensive enforcement of Schrems II sometime soon. Sadly it looks like the EU will instead be bullied into making exceptions to it's own basic data protection regulations and other IT-related laws.
mindcrash 2y ago
[read a bit too fast, my bad]
- bawolff 2y ago
  I was thinking they meant some cloud office 365 thing, so not the local computer. Regardless though, once you have a web browser 0-day its usually not very hard to convince a user to click on a link. Especially for a targeted attack.
  - mindcrash 2y ago
    Yeah, I thought it was running locally but it runs in Microsofts cloud. However, that opens up ANOTHER similar attack vector as Bert is saying: "We may wonder also what fun a determined hacker could have with Microsoft running random bits of JavaScript on their servers and allowing these to talk to the world (or to Microsoft itself even)."
    - bawolff 2y ago
      I feel like not that much. Presumably its something like pupeteer running in a dedicated cloud account with very little access to anything else. Like its possible you could get something there, but i could think of a lot more juicy targets if you have a chrome 0-day.
1vuio0pswjnm7 2y ago
"Some might argue that these confirmation / single-use sign-on links are no good anyhow, but for now, they are what we have to get people to sign up for services." Some users might argue that if they don't "sign up for services", i.e., use other peoples' computers for basic tasks instead of using their own, then many problems caused by so-called "tech" companies never happen to them. That is, "signing up for services" introduces new problems.
FearNotDaniel 2y ago
“Microsoft”, huh? It would be kind of helpful if the author would bother mentioning what particular Microsoft product/service he is talking about and on what platform rather than just a vague reference to a “security scanner”. That’s what makes the difference between actionable content that could help affected people vs “boo evil Microsoft bad, Linux rocks” like it’s still the 1990s.
- catgirlinspace 2y ago
  It happens in a couple of places, Teams, Outlook, and Exchange Online come to mind but it wouldn’t surprise me if it’s in other places like OneDrive links or Word documents.
arielcostas 2y ago
Frankly, I'd prefer the service to include a one-time code instead of a link. Especially since links are often a "to verify your email click here", with "click here" being an Amazon SES, SendGrid or similar tracking URLs, or a super-long URL I can only read, uncomfortably, on the tooltip that my email client shows; or by long-pressing it on my phone. This applies also to the (really annoying) MFA emails (and we really should stop doing this shit, and instead support at the very least TOTP), "magic" links and similar, who also require you to visit the link from the same device, when perhaps I am on a public computer without my email signed in; and getting into gmail or outlook to find your f-ing link would be annoying, because I have 2FA there too. Instead, just send me a code. It can even be in the subject field, like "012345 is your login code for WHATEVER", and I'll see it at a glance on my notifications. Then I'll input it on the device where I'm logging in (such as the public desktop computer) and go on with my day.

155 points by mschuster91 2y ago

bawolff 2y ago

Does that mean they are automatically pressing the "unsubscribe" link?

philipwhiuk 2y ago
Yes.
lexicality 2y ago
I suppose that explains why so often I have to click a "yes really unsubscribe" button once the link loads. How annoying.
- dspillett 2y ago
  Yep, along with many “magic link” emails now going to a stub form where you click a button to continue via POST request, instead of going direct to the target resource. Not that this is effective if the scanners are now submitting POST requests as well as following simple links. Though also the “I'm sure I want to unsubscribe” is in part to deliberately add extra steps to unsubscribing.
  - diggan 2y ago
    > emails now Not sure what time-frames we're talking about here, but I remember having to work around this particular issue more than 4 years ago, I'm sure it was also an issue before too. It's been like this for a long time.
    - dspillett 2y ago
      I've been around long enough that “now” and “recently” is in comparison to times before 2015. Sometimes before 2000… Also, a lot of advice and guidelines you see about email haven't been updated since somewhere between 2000 and 2015, even when they carry more recent dates, so are significantly incorrect.
      - diggan 2y ago
        > I've been around long enough that “now” and “recently” is in comparison to times before 2015. Sometimes before 2000… Alright, everyone sees things differently :) I probably programmed professionally since 2012, but I don't think I'll call anything after ~2020 "recent" or happening "now".
  - bawolff 2y ago
    Can't wait to have to fill out a captcha to unsubscribe.

grayhatter 2y ago

Microsoft knows what they're doing. The problem is users dont. I don't know what you care about more, your users convenience, or their safety and security. But no chance in hell I'd allow MS to dictate the terms of the security of my services. I'd solve this by warning users who attempt to reuse consumed links that the link has been used already, and likely list broken email providers that I suspect are using software that breaks this. And then wait. Let them complain to their IT, or whomever is responsible for picking broken software. If I was feeling really petty, the clown that wrote this link scanning software isn't in charge of the networking, so you could eventually enumerate the subnets that MS uses, and black list them. Then the links might actually get to users connecting from non MS data centers. You could roll over and decrease your security so that MS can claim they increased theirs... But you shouldn't! They can only get away with turning security into a negative sum game if you play along. Please don't?

philipwhiuk 2y ago
That's nice. Here's how that will go: User: Hey IT, a site I'm trying to use says that I can't use Outlook, can we switch provider IT: Heck no. Are there any alternatives User: I guess I'll try to find them.
- grayhatter 2y ago
  That, is only your problem if you make it your problem. Ideally, you wouldn't. But like I already said, it depends on if you're willing to sacrifice the security of all your users because, money I guess? Eventually you have to choose doing what's right, and doing what's expedient. I can't draw your line for you. Thankfully for me I've always been able to always draw mine at protecting users from abuse.
  - lexicality 2y ago
    Users care much more about convenience than security. If you made a phone that wiped itself after 3 incorrect pin attempts then you'd have a lot of very angry users wearing gloves. "It's for your own security!" wouldn't appease them.

donatj 2y ago

On our company Slack, we literally had a discussion about this being a problem yesterday. I frankly did not believe it. Security scanners really should not be clicking on things on your behalf. There's a lot worse danger there, like potentially agreeing to things you would never have agreed to.

inetknght 2y ago
> There's a lot worse danger there, like potentially agreeing to things you would never have agreed to. If it doesn't have my hand-written signature then it's not an agreement. I can't "agree" to something I haven't read, haven't been notified about, and haven't agreed to. A robot clicking things does not mean I agreed to whatever it clicked it. It means that the the other end of the transaction can't tell the difference between me and a robot.
- Silhouette 2y ago
  If it doesn't have my hand-written signature then it's not an agreement. I wouldn't bet my company on that. If someone sends us an email - probably with legal weasel words included saying it's only for use by the intended recipient - and asks for confirmation of something by following a private link and pressing a confirm button and if as far as that supplier is aware we have then done that and continued accordingly then I would not be at all surprised if a court found that they were acting in good faith and we were not. Similarly if we sent something to a customer and their own IT system actively simulated a sequence of actions the intended recipient would take to confirm something then I would hope that would stand up in court as well. Otherwise we enter a legal climate where no-one in business can ever say or do any little thing without some kind of verified human approval process. It's hard to imagine how annoying and inefficient that might become for everyone. Maybe it would prompt a new generation of electronic communications and record-keeping where authenticity was built in unlike many of today's most common technologies - but it would still be a nightmare to do business until that happened.
  - inetknght 2y ago
    > If someone sends us an email - probably with legal weasel words included saying it's only for use by the intended recipient - and asks for confirmation of something by following a private link and pressing a confirm button and if as far as that supplier is aware we have then done that and continued accordingly then I would not be at all surprised if a court found that they were acting in good faith and we were not. Yes exactly. Given the escalating sophistication of malicious actors and their robots, the scenario you present is viable today. That's dangerous in ways that I cannot even begin to articulate, and I'm not even well-versed in contract law. > if we sent something to a customer and their own IT system actively simulated a sequence of actions the intended recipient would take to confirm something then I would hope that would stand up in court as well. I absolutely hope that would not stand up in court. To my knowledge a contract requires (at a minimum) a meeting of minds and consideration. You cannot agree to something you did not know about. You cannot come to a meeting of minds if you weren't told about it. That payment could be for anything. You might think it's for this one service and I might think it's for all services provided, not just the one I clicked on. Who will a court side with if you cannot prove that I, a human, agreed to it? > Otherwise we enter a legal climate where no-one in business can ever say or do any little thing without some kind of verified human approval process. Yup! And I say that's a good thing given that non-humans cannot enter into agreements, and there are plenty of non-humans who have no idea what they're getting themselves into in the current form of electronic agreements. > It's hard to imagine how annoying and inefficient that might become for everyone. You mean... you might have to actually employ people to verify that your customers are actual humans? That's a good thing all around. Unless you can't afford to employ people, in which case: your business does not have a valid business model.

diggan 2y ago

> Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript: It seems to me that someone misunderstood how to implement the logic on the frontend here. You're not supposed to send off a POST request directly as the page has been loaded to exchange the tokens, but require the user to click on a button to confirm the activity. So the flow would be: - "Send email with url+token > Frontend loads, shows button to user to confirm > User clicks button and exchange happens". Instead, wrong implementations do something like this: - "Send email with url+token > Frontend loads and exchange happens", which we've known for years to not work correctly, because of this very issue. Discourse for example implemented this perfectly, so if you need an example, that would be where I'd go. (I know it sucks that scrapers/crawlers do a lot of horrible shit, it truly does. But we've dealt with this for years now, it's not a new thing and it won't be the last shitty thing they do)

formerly_proven 2y ago
What about double opt-in links? What about unsubscribe links? Do these need to be triple opt-in now because of Microsoft?
- diggan 2y ago
  > now because of Microsoft? I'm not sure why people believe this to be a new issue, I think the first time I myself implemented a work around for this issue was like 4 years ago, and here is a Stackoverflow Question about it from 7 years ago: https://stackoverflow.com/questions/43443947/how-to-stop-e-mail-clients-from-visiting-links-in-e-mail-automatically https://stackoverflow.com/questions/43443947/how-to-stop-e-m... Outlook/Microsoft is not the only ones who do this either, when I first had to work around it myself it was because it was happening in gmail if I remember correctly.
  - formerly_proven 2y ago
    Accessing links (GET), yes, executing JS and POSTing is the new thing. Putting an XHR in DOMContentLoaded was the workaround for the behavior you are talking about.

deleted 2y ago

[deleted]

arkh 2y ago

Wait, from reading the article it looks like the link they send to their users send them to a page with some javascript which automatically POST data for them. Which MS will correctly do: your "POST" is in fact a simple GET for most users with javascript on. What you should do is send your user to a page with a form requiring a manual action from them.

badmintonbaseba 2y ago
This just highlights how the security scanning is just theater though. So bad actors can now just have their evil content behind a form, and users get accustomed to the double opt-in workflow anyway.
- arkh 2y ago
  Yup, best thing would be to either have a form in your email / SMS or let's get crazy: implement POST links (and maybe DELETE ones too). Your client knows it will change things when followed (so security clients and prefetchers won't open it), the server receive a POST request, and it's a one click action for the user.

pjc50 2y ago

I note this isn't (can't be) a problem in end-to-end encrypted systems.

diggan 2y ago
An E2E email client that would do that scanning client-side instead of remotely (like today), would surface exactly the same issue if it goes out and loads up websites for you.

efitz 2y ago

NB: 1. Most “safe browsing” browser features do this to some extent 2. Any browser or mail extension with access to the URL might also do this (1) and (2) might be done by remote servers, even in remote countries. This is one of the reasons why you should avoid magic links (like login links or bearer tokens like S3 signed URLs), because you may inadvertently be handing them to other parties.

michaelt 2y ago

I can see how Microsoft ended up in this position, although it's unfortunate. E-mails show up with obfuscated links all the time; you can't detect phishing just from the URL if legitimate e-mails are using https://us123.list-manage.com/track/click?u=87958734095826 https://us123.list-manage.com/track/click?u=87958734095826 as an URL. You need to load the URL, if you want to check if a fake Google login page shows up or something like that. And the phishers are trying to evade your URL scanner. If your URL scanner has an identifiable user-agent, or doesn't execute javascript, or there's anything else that makes it identifiable, they'll show a boring legitimate page to your scanner and only phish the real users. As I understand it, self-serve ad networks have similar challenges detecting ads placed by scammers.

rkagerer 2y ago
This is why I try to only open links with domain names that match the website / provider. If you want to use a third party mailing list, marketing juicer or link tracker, go nuts, but you won't be getting my clicks.

JimDabell 2y ago

If a page contains JavaScript that makes a POST request when the page loads, then it’s the developers of that page that are violating HTTP norms, not the developers of software that loads such pages. POSTs are unsafe requests that should be made as part of a user’s intent. Following a link should always be safe. Microsoft aren’t responsible for this problem – the site developers are. We already went through this with Google Web Accelerator and 37Signals twice. They couldn’t accept that mere links were a bad idea for deleting things, and GWA came along and deleted their users’ data by following links. They tried to detect and block GWA instead of following HTTP rules and it happened again. Links are supposed to be safe. Ignore this at your peril.

Avamander 2y ago
Microsoft making this change also rather clearly indicates that malicious actors are actively abusing these spec violations (by walling their phishing pages behind a simple POST on page load).
superq 2y ago
Clicking a link signals the user's intent. That's how hypertext works. Click here to agree.
- JimDabell 2y ago
  Clicking a link indicates the user wants to see something. Clicking a button indicates the user wants to do something. Links shouldn’t change state. This has been an extremely strong convention for several decades. If you write code that changes state when a page is loaded, you are breaking this convention.

ohc 2y ago

I agree that email scanners really shouldn't be sending POST requests... but there is already a solution for this; follow RFC 8058 - https://datatracker.ietf.org/doc/html/rfc8058 https://datatracker.ietf.org/doc/html/rfc8058

raintrees 2y ago

"We may wonder also what fun a determined hacker could have with Microsoft running random bits of JavaScript on their servers and allowing these to talk to the world (or to Microsoft itself even)." So maybe there might be a way to disincentivize this behavior?

JohnMakin 2y ago

Lots of things consume URL’s other than security scanners in similar ways - as smarter people than me have commented, the solution most use (and I did recently myself) is to make the signup/signin link direct to a frontend page which makes them click to confirm. Yea, that still sucks, but you can have fun with things like this - one of my favorite things to do to figure out if an employer is snooping on my private messages in an app like say, slack, is to post a honeypot link in a DM to myself - on slack at least, it will consume the link every time the message thread is opened. So if I know I didnt open it, and I get an alert, I know someone or something has read the message. There’s tons of stuff out there like this, just assume apps are being disrespectful and plan accordingly.

aaronax 2y ago

It is an arms race that will end poorly for everyone. Whatever the legit companies do to make their links work Good guys send out email links -> Bad guys start sending out email links -> Security scanners start checking link contents Good guys hide behind automatic POST -> Bad guys start hiding behind automatic POST -> Security scanners start checking behind automatic POST Good guys hide behind button click (we are here) -> Bad guys start hiding behind button click -> Security scanners start checking behind button click Good guys hide behind link that doesn't work until 10 minutes after sending -> ... Good guys hide behind captcha -> ... Good guys hide behind plain text code that has to be copy/pasted from email -> ... Eventually the security scanners will be indistinguishable in function and intelligence from a human being. Might as well just merge it with your personal AI assistant and it will do everything for you...including getting scammed by the bad guys.

numberless 2y ago

Executing JavaScript on random pages seems like quite a bad idea, spammers could potentially include links to JavaScript which does resource intensive things, like that small and sketchy trend of including Bitcoin miners in websites.

snthd 2y ago

Do headless browsers default to not following javascript POST requests? Do Microsoft devs use Copilot to code?

szundi 2y ago

This already happened when you had a link in for example GMail in iOS, it wanted to open that login link inside its own browser popup (shame) - thus using up the 1x login at once. I jumped out to the Safari browser, my choice, but the login link had been expired by the GMail window.

cess11 2y ago

Wow, that's nasty. I wish for a harsh, comprehensive enforcement of Schrems II sometime soon. Sadly it looks like the EU will instead be bullied into making exceptions to it's own basic data protection regulations and other IT-related laws.

mindcrash 2y ago

[read a bit too fast, my bad]

bawolff 2y ago
I was thinking they meant some cloud office 365 thing, so not the local computer. Regardless though, once you have a web browser 0-day its usually not very hard to convince a user to click on a link. Especially for a targeted attack.
- mindcrash 2y ago
  Yeah, I thought it was running locally but it runs in Microsofts cloud. However, that opens up ANOTHER similar attack vector as Bert is saying: "We may wonder also what fun a determined hacker could have with Microsoft running random bits of JavaScript on their servers and allowing these to talk to the world (or to Microsoft itself even)."
  - bawolff 2y ago
    I feel like not that much. Presumably its something like pupeteer running in a dedicated cloud account with very little access to anything else. Like its possible you could get something there, but i could think of a lot more juicy targets if you have a chrome 0-day.

1vuio0pswjnm7 2y ago

"Some might argue that these confirmation / single-use sign-on links are no good anyhow, but for now, they are what we have to get people to sign up for services." Some users might argue that if they don't "sign up for services", i.e., use other peoples' computers for basic tasks instead of using their own, then many problems caused by so-called "tech" companies never happen to them. That is, "signing up for services" introduces new problems.

FearNotDaniel 2y ago

“Microsoft”, huh? It would be kind of helpful if the author would bother mentioning what particular Microsoft product/service he is talking about and on what platform rather than just a vague reference to a “security scanner”. That’s what makes the difference between actionable content that could help affected people vs “boo evil Microsoft bad, Linux rocks” like it’s still the 1990s.

catgirlinspace 2y ago
It happens in a couple of places, Teams, Outlook, and Exchange Online come to mind but it wouldn’t surprise me if it’s in other places like OneDrive links or Word documents.

arielcostas 2y ago

Frankly, I'd prefer the service to include a one-time code instead of a link. Especially since links are often a "to verify your email click here", with "click here" being an Amazon SES, SendGrid or similar tracking URLs, or a super-long URL I can only read, uncomfortably, on the tooltip that my email client shows; or by long-pressing it on my phone. This applies also to the (really annoying) MFA emails (and we really should stop doing this shit, and instead support at the very least TOTP), "magic" links and similar, who also require you to visit the link from the same device, when perhaps I am on a public computer without my email signed in; and getting into gmail or outlook to find your f-ing link would be annoying, because I have 2FA there too. Instead, just send me a code. It can even be in the subject field, like "012345 is your login code for WHATEVER", and I'll see it at a glance on my notifications. Then I'll input it on the device where I'm logging in (such as the public desktop computer) and go on with my day.