3 ms·
The very fact that in HTML, a URL can look like a totally legitimate URL (the part between the > and the <), and yet the "a href=" could be anything, makes
by npsimons 13y ago
The very fact that in HTML, a URL can look like a totally legitimate URL (the part between the > and the <), and yet the "a href=" could be anything, makes HTML a bad idea for email, where headers can be easily forged. Sure people can (and do) copy and paste, but having it in HTML just makes it that much harder to check a URL. Don't even get me started about the "onmouseover" events that can further obscure the true href.
- laumars 13y agoI'd already addressed the hypertext argument in this discussion somewhere. And that point is one of the reasons why I want HTML standardised in e-mails, so we can remove the potentially harmful things like that from the e-mail spec and make it simpler for developers to create formated content (that's also safe for the end users) which will be rendered correctly across the various clients. So yes, I do agree with you that anchor tags are misused in phishing mail, but let's make that a reason to fix the specification rather than just ignoring the issues completely (or worse yet, officially removing HTML and then letting 3rd party developers invent their own broken specs and us ending back exactly where were are now). As for your comment about mouse over events, you can't have Javascript in HTML e-mails so that point is completely irrelevant.