3 ms·
Tell HN: Gmail tampers with incoming email body content
Comparing Gmail page source with message original on for example the latest genuine Amazon scam warning shows linkification of "amazon.co.uk" by Gmail. Quite ironic given the warning about links in scam mails.
Gmail: https://i.imgur.com/MQH1shA.png https://i.imgur.com/MQH1shA.png
Fastmail: https://i.imgur.com/tczhO8g.png https://i.imgur.com/tczhO8g.png
Gmail Print likewise: https://i.imgur.com/SWoPXqs.png https://i.imgur.com/SWoPXqs.png
God help anyone printing emails to shows tampering or lack of for a legal case. And does Gmail have any "Display un****ed" option?? Er, no.
And Amazon, perhaps check your emails on the world's top web client?
- nubg 1y agoI don't get what the problem is? Gmail turns text that looks like a link into a clickable link. What could the negative implications of that be?
- john01dav 1y agoIf they have some system to edit emails as they come in, then other less benign editing could be present, either profitable-malicious or from a bug. With no indication of editing and no easy way to view an unedited email this would also fly under the radar in many cases.
- jsnell 1y agoWhy in the world are you and the op calling this "editing"? Like, the OP clearly does not understand the distinction between rendering the email and storing it, given their "evidence". But you do understand the difference. Why take their confusion at face value like that?
- john01dav 1y agoI was answering the question about why it would be a problem if the evidence is correct. If the evidence is valid is a separate issue which I made a separate comment about.
- chrisjj 1y agoThe OP is not calling editing. And storing? How is that in any way relevant?
- jsnell 1y agoFair enough, sorry about that. You called it "tampering" and "alteration". But honestly I don't see any distinction to "editing". All of those imply that the email is being changed. It isn't. The email is stored on disk just like it was sent, and that is observable in a number of ways (show original, fetch it with imap, forward the email). And that's why storage is relevant. Your complaint was apparently just about how the email is rendered. There is no standard for how that should be done. Like, did you complain that your emails were being tampered with back in the day when you wrote them in a terminal with a fixed width font but someone viewed them in Outlook with a variable width font? I'd like to say that of course you didn't, because what would be a totally absurd complaint, but then again so is your actual complaint as well.
- chrisjj 1y ago> You called it "tampering" Yes. > and "alteration" No. > But honestly I don't see any distinction to "editing". All of those imply that the email is being changed. It isn't. The email is stored on disk This isn't about stored form. It is about displayed form - which is all that most users get. > Your complaint was apparently just about how the email is rendered. There is no standard for how that should be done. The standard is the expectation it is faithful to the sent form. This case fails that. > Like, did you complain that your emails were being tampered with back in the day when you wrote them in a terminal with a fixed width font but someone viewed them in Outlook with a variable width font? No. But someone did complain "Why are the tables messed up?" :) Fortunately that wasn't a security issue.
- chrisjj 1y agoFacilitating phishers.
- andylynch 1y agoOutlook’s done this for like a decade? Ditto Apple mail. I think they do the same with email addresses and phone numbers too, it’s kind of useful and not a big deal.
- VladVladikoff 1y agoI’m so confused. Isn’t Amazon.co.uk their official domain in the UK? How is that link a scam?
- john01dav 1y agoIn what client are you viewing this in your screenshots? If their web mail client displays things as links that's much less concerning to me than the SMTP backend tampering. It's expected for an email client to have quality of life features.
- chrisjj 1y agoThe client is as per the labels. Gmail, Fastmail. > It's expected for an email client to have quality of life features. Yup. Phishers deserve quality too! Consider a phish-warning email saying "genuine emails from us will never contain links"... showing these links.
- AlexErrant 1y ago> does Gmail have any "Display un**ed" option?? Er, no. On the email, click the dotdotdot, show original. https://imgur.com/a/ymjtfCI https://imgur.com/a/ymjtfCI
- chrisjj 1y agoOriginal HTML/base64 is not useful.
- meinersbur 1y agoGMail (and Fastmail) are rendering the email. It just happens that the email and we webbrowser are both HTML. In no case should they just literally forward the email HTML to the browser. They scrub JavaScript, non-whitelisted HTML elements, rewrite links/external resources including tracking pixels. You can see the raw email with "show original" in the options
- Redoubts 1y agoMeh, macOS’s Mail.app approach of everything-but-the-JavaScript is great and I wish outlook & Gmail did it too
- chrisjj 1y ago> They scrub ... non-whitelisted HTML elements Any documenation on that list?
- meinersbur 1y agohttps://help.zapier.com/hc/en-us/articles/8496101927181-What-HTML-tags-are-supported-in-Gmail#h_01HYDQPW4SHJVT7HMZDACEEV2B https://help.zapier.com/hc/en-us/articles/8496101927181-What... I don't think there is an official list. It is security-related and changes over time
- chrisjj 1y agoThanks. > It is security-related and changes over time That would explain why new prints of an old message don't match old.
- qunt 1y ago[flagged]
- beardyw 1y agoI'm afraid my righteous indignation only flickered slightly.
- politelemon 1y agoAll web clients choose how to render their emails and there will be variations. This is not tampering.
- chrisjj 1y agoIt is, where the alteration is unauthorised. I do not recall the Google terms seeking such authorisation. Is there even an option to disable?