3 ms·

Microsoft knows what they're doing. The problem is users dont. I don't know what you care about more, your users convenience, or their safety and security. But

Microsoft knows what they're doing. The problem is users dont. I don't know what you care about more, your users convenience, or their safety and security. But no chance in hell I'd allow MS to dictate the terms of the security of my services. I'd solve this by warning users who attempt to reuse consumed links that the link has been used already, and likely list broken email providers that I suspect are using software that breaks this. And then wait. Let them complain to their IT, or whomever is responsible for picking broken software. If I was feeling really petty, the clown that wrote this link scanning software isn't in charge of the networking, so you could eventually enumerate the subnets that MS uses, and black list them. Then the links might actually get to users connecting from non MS data centers. You could roll over and decrease your security so that MS can claim they increased theirs... But you shouldn't! They can only get away with turning security into a negative sum game if you play along. Please don't?

philipwhiuk 2y ago
That's nice. Here's how that will go: User: Hey IT, a site I'm trying to use says that I can't use Outlook, can we switch provider IT: Heck no. Are there any alternatives User: I guess I'll try to find them.
- grayhatter 2y ago
  That, is only your problem if you make it your problem. Ideally, you wouldn't. But like I already said, it depends on if you're willing to sacrifice the security of all your users because, money I guess? Eventually you have to choose doing what's right, and doing what's expedient. I can't draw your line for you. Thankfully for me I've always been able to always draw mine at protecting users from abuse.
  - lexicality 2y ago
    Users care much more about convenience than security. If you made a phone that wiped itself after 3 incorrect pin attempts then you'd have a lot of very angry users wearing gloves. "It's for your own security!" wouldn't appease them.
    - grayhatter 2y ago
      It's more like if someone tried to delete/hack your account but you send a confirmation email to protect such a thing, and Microsoft clicked on the accept & delete account button in that email. So you deleted the user's account. Do you know what users like less than inconvenient security? It's when "security" deletes all of their important data. Again, still have to draw the line of what's acceptable somewhere. All I'm saying is you don't have to ruin your software because someone else is an idiot. Don't punish everyone because it makes the problem somebody else's to fix... That's what Microsoft is doing here, and it's obviously bad.
      - lexicality 2y ago
        > It's more like if someone tried to delete/hack your account but you send a confirmation email to protect such a thing, and Microsoft clicked on the accept & delete account button in that email. So you deleted the user's account. And then the user says "why did you delete my account?" and you say "well I chose not to support outlook but I didn't tell you that at the start" and the user says "that's stupid, everyone uses outlook" and leaves a bad review
        rixthefox 2y ago
        It is not my job to tell Microsoft to correct their behavior and follow standards. There are standards for a reason [1] and if you break them, no matter how good your intentions you are in the wrong because you've changed the expected behavior. Full stop. The Internet works because everyone has agreed to follow standards. If Google woke up one day and decided that every IP address that ended in an odd number would receive a captcha every time they searched people would understandably get pissed off. Well ISPs have thousands of IP addresses so for the convenience of the user it's the ISPs that need to assign their users IP addresses ending in an even number so that they can search without captchas, right? No! Same thing here. Just because Microsoft and Google benefit from economies of scale and have many users does not give them a pass to break standards whenever they see fit. There is a reason why we have RFCs and mailing lists to have these sorts of discussions. edit: [1] https://datatracker.ietf.org/doc/html/rfc8058 https://datatracker.ietf.org/doc/html/rfc8058
ahoka 2y ago
What prevents bad actors from detecting that the request is coming from MS and returning pictures of kittens, but the most wicked malware otherwise? You don’t actually have to answer.
- richardwhiuk 2y ago
  Microsoft can try quite hard to make their requests look like a user.
  - sidewndr46 2y ago
    Microsoft owns the domain & owns the client. They are the user in this case
NotYourLawyer 2y ago
> enumerate the subnets that MS uses, and black list them. Then the links might actually get to users connecting from non MS data centers. Or Microsoft might start blocking your email altogether for circumventing security procedures or whatever.
diggan 2y ago
> I'd solve this by warning users who attempt to reuse consumed links that the link has been used already, and likely list broken email providers that I suspect are using software that breaks this. And then wait. Let them complain to their IT, or whomever is responsible for picking broken software. The thing is, most websites already know how to workaround that particular issue (https://news.ycombinator.com/item?id=42804447 https://news.ycombinator.com/item?id=42804447), so when users notice that something breaks with just your service and not everyone elses, you can say "Outlook is shit" all you want, the users will blame you for it, since you weren't able to fix what others could, for better or worse. > You could roll over and decrease your security so that MS can claim they increased theirs What part of your security would decrease if you "roll over" and what exactly does "roll over" entail here? Websites who've dealt with this issue implemented what I linked to above, they're no more/less secure than the website who didn't manage to work around this issue, they're just less buggy for Outlook users, if anything.
- grayhatter 2y ago
  Your description isn't a work around, it's the exact same buggy behavior, just implemented in JS, instead of a malware scanner. GET or POST is less important than user action, if your code consumes a token without user action, it doesn't matter if that's server side or client side, GET or POST. If outlook is clicking on links or buttons that generate POST requests, then outlook is broken. If outlook is loading a page, and the page without further interaction is sending a POST, that's just as bad, if not worse than expiring the token on that same GET. I wouldn't call that a work around, would you?
  - diggan 2y ago
    > If outlook is clicking on links or buttons that generate POST requests It isn't though, it's loading URLs it finds in emails, and then runs scripts on those loaded websites, like many "modern" scrapers/crawlers. So if your JavaScript on that URL automatically does POST requests on load, those will happen automatically when their scanner loads the website. But if you instead don't do a POST request on JavaScript load, and do that request when the user presses an actual button on the loaded website, the scanner won't trigger that button automatically (that would be a whole new level of craziness, we're not there (yet)) So yes, it is a workaround. I've implemented this 10s of times already, because it's been an issue for a long time. Edit: The submission article also makes it abundantly clear that this is the very problem they're suffering from: > Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript: The problem is that their JavaScript automatically issues POST request on load, not that Outlook loads and executes JavaScript on the page (although that sucks too, don't get me wrong).
rad_gruchalski 2y ago
> Microsoft knows what they're doing Right. Thanks for consuming my SSO magic links.

philipwhiuk 2y ago

That's nice. Here's how that will go: User: Hey IT, a site I'm trying to use says that I can't use Outlook, can we switch provider IT: Heck no. Are there any alternatives User: I guess I'll try to find them.

grayhatter 2y ago
That, is only your problem if you make it your problem. Ideally, you wouldn't. But like I already said, it depends on if you're willing to sacrifice the security of all your users because, money I guess? Eventually you have to choose doing what's right, and doing what's expedient. I can't draw your line for you. Thankfully for me I've always been able to always draw mine at protecting users from abuse.
- lexicality 2y ago
  Users care much more about convenience than security. If you made a phone that wiped itself after 3 incorrect pin attempts then you'd have a lot of very angry users wearing gloves. "It's for your own security!" wouldn't appease them.
  - grayhatter 2y ago
    It's more like if someone tried to delete/hack your account but you send a confirmation email to protect such a thing, and Microsoft clicked on the accept & delete account button in that email. So you deleted the user's account. Do you know what users like less than inconvenient security? It's when "security" deletes all of their important data. Again, still have to draw the line of what's acceptable somewhere. All I'm saying is you don't have to ruin your software because someone else is an idiot. Don't punish everyone because it makes the problem somebody else's to fix... That's what Microsoft is doing here, and it's obviously bad.
    - lexicality 2y ago
      > It's more like if someone tried to delete/hack your account but you send a confirmation email to protect such a thing, and Microsoft clicked on the accept & delete account button in that email. So you deleted the user's account. And then the user says "why did you delete my account?" and you say "well I chose not to support outlook but I didn't tell you that at the start" and the user says "that's stupid, everyone uses outlook" and leaves a bad review
      - rixthefox 2y ago
        It is not my job to tell Microsoft to correct their behavior and follow standards. There are standards for a reason [1] and if you break them, no matter how good your intentions you are in the wrong because you've changed the expected behavior. Full stop. The Internet works because everyone has agreed to follow standards. If Google woke up one day and decided that every IP address that ended in an odd number would receive a captcha every time they searched people would understandably get pissed off. Well ISPs have thousands of IP addresses so for the convenience of the user it's the ISPs that need to assign their users IP addresses ending in an even number so that they can search without captchas, right? No! Same thing here. Just because Microsoft and Google benefit from economies of scale and have many users does not give them a pass to break standards whenever they see fit. There is a reason why we have RFCs and mailing lists to have these sorts of discussions. edit: [1] https://datatracker.ietf.org/doc/html/rfc8058 https://datatracker.ietf.org/doc/html/rfc8058

ahoka 2y ago

What prevents bad actors from detecting that the request is coming from MS and returning pictures of kittens, but the most wicked malware otherwise? You don’t actually have to answer.

richardwhiuk 2y ago
Microsoft can try quite hard to make their requests look like a user.
- sidewndr46 2y ago
  Microsoft owns the domain & owns the client. They are the user in this case

NotYourLawyer 2y ago

> enumerate the subnets that MS uses, and black list them. Then the links might actually get to users connecting from non MS data centers. Or Microsoft might start blocking your email altogether for circumventing security procedures or whatever.

diggan 2y ago

> I'd solve this by warning users who attempt to reuse consumed links that the link has been used already, and likely list broken email providers that I suspect are using software that breaks this. And then wait. Let them complain to their IT, or whomever is responsible for picking broken software. The thing is, most websites already know how to workaround that particular issue (https://news.ycombinator.com/item?id=42804447 https://news.ycombinator.com/item?id=42804447), so when users notice that something breaks with just your service and not everyone elses, you can say "Outlook is shit" all you want, the users will blame you for it, since you weren't able to fix what others could, for better or worse. > You could roll over and decrease your security so that MS can claim they increased theirs What part of your security would decrease if you "roll over" and what exactly does "roll over" entail here? Websites who've dealt with this issue implemented what I linked to above, they're no more/less secure than the website who didn't manage to work around this issue, they're just less buggy for Outlook users, if anything.

grayhatter 2y ago
Your description isn't a work around, it's the exact same buggy behavior, just implemented in JS, instead of a malware scanner. GET or POST is less important than user action, if your code consumes a token without user action, it doesn't matter if that's server side or client side, GET or POST. If outlook is clicking on links or buttons that generate POST requests, then outlook is broken. If outlook is loading a page, and the page without further interaction is sending a POST, that's just as bad, if not worse than expiring the token on that same GET. I wouldn't call that a work around, would you?
- diggan 2y ago
  > If outlook is clicking on links or buttons that generate POST requests It isn't though, it's loading URLs it finds in emails, and then runs scripts on those loaded websites, like many "modern" scrapers/crawlers. So if your JavaScript on that URL automatically does POST requests on load, those will happen automatically when their scanner loads the website. But if you instead don't do a POST request on JavaScript load, and do that request when the user presses an actual button on the loaded website, the scanner won't trigger that button automatically (that would be a whole new level of craziness, we're not there (yet)) So yes, it is a workaround. I've implemented this 10s of times already, because it's been an issue for a long time. Edit: The submission article also makes it abundantly clear that this is the very problem they're suffering from: > Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript: The problem is that their JavaScript automatically issues POST request on load, not that Outlook loads and executes JavaScript on the page (although that sucks too, don't get me wrong).

rad_gruchalski 2y ago

> Microsoft knows what they're doing Right. Thanks for consuming my SSO magic links.