News for hackers. Stuff that matters.
Re:Gmail is opening and caching URLs within emails without u... by miken123 on Friday August 20, 2021 @06:18AM (#28244500)
You should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.
Re:Gmail is opening and caching URLs within emails without u... by toshk on Friday August 20, 2021 @08:46AM (#28245359)
We've done this for over 2 years now, and over 200k users never ran into this. Also not within government users.
Re:Gmail is opening and caching URLs within emails without u... by miken123 on Friday August 20, 2021 @10:35AM (#28246502)
It could very well be that your specific Javascript does not run automatically or does not run correctly. I see the same with one of our auto-submitting forms. I do not know whether or not that is intentional on Microsoft's part. But other users have had different experiencies, so be aware that Microsoft may 'fix' their issue on some day and all of a sudden all your users will start clicking/unsubscribing/whatevering automatically.

See https://blog.healthchecks.io/2019/12/preventing-office-365-a... for someone who did have this experience.

Re:Gmail is opening and caching URLs within emails without u... by bombcar on Friday August 20, 2021 @09:28AM (#28245673)
Turn on O365 “link scanning for malware” and Salesforce onetime links for password resets etc stop working.
Re:Gmail is opening and caching URLs within emails without u... by addingnumbers on Friday August 20, 2021 @11:25AM (#28247124)
How do you know your users have never run into this?

People don't tend to report problems like "my account was activated sooner than I expected"

Re:Gmail is opening and caching URLs within emails without u... by toshk on Saturday August 21, 2021 @04:30AM (#28255247)
We use it to log in users. We quickly get complaints if something doesn't work well.
Re:Gmail is opening and caching URLs within emails without u... by addingnumbers on Monday August 23, 2021 @03:07PM (#28280523)
But your users ought to believe it works well to have google's servers respond to the activation link instead of requiring them to click it themselves, so no complaints.

The verification process serves only you, the administrator. To everyone else it's a tedious obstacle.

Nobody will reach out to you to say "I made it through the registration process just fine but it was slightly less burdensome than I expected, is everything OK?"

If you want to know if Google is hitting your activation URLs, check your access logs. Your users will almost certainly not realize it happened. Even if they do notice it, there is no impact on them and no motivation to inform you. You would have to be extremely lucky to hear about it from a user.

Re:Gmail is opening and caching URLs within emails without u... by clusterfish on Friday August 20, 2021 @10:30AM (#28246445)
Half of unsubscribe links seem to auto-submit. Are they all broken in O365?