News for hackers. Stuff that matters.
Re:Gmail, Yahoo announce new 2024 authentication requirement... by exabrial on Monday October 30, 2023 @05:27PM (#38076150)
In a previous life, we prevented the GET url problem by having a javascript POST and forward to a secondary URL.

This allows everything to be "one click" (which honestly is a good thing) but prevents crawlers from accidentally triggering the unsubscribe.

Not sure this still works today and obviously this is not legal advice.

Re:Gmail, Yahoo announce new 2024 authentication requirement... by cxr on Monday October 30, 2023 @05:57PM (#38076498)
Not an answer to the question they asked.
Re:Gmail, Yahoo announce new 2024 authentication requirement... by Ensorceled on Monday October 30, 2023 @08:14PM (#38077915)
You could imagine they started their post with "Yes, it's a pretty common problem here's what we did ..." and then it makes sense.
Re:Gmail, Yahoo announce new 2024 authentication requirement... by cxr on Monday October 30, 2023 @11:04PM (#38079741)
No, it doesn't. The original questioner is already aware of the extremely common phenomenon where mail providers scan links in emails. That's not what the question is about. The first comment contains a very specific question about something different. The response is derailing the discussion.
Re:Gmail, Yahoo announce new 2024 authentication requirement... by Zambyte on Monday October 30, 2023 @06:52PM (#38077064)
It seems like the more ideal solution would be to block the malicious IPs instead of lowering the accessibility of your site, no?
Re:Gmail, Yahoo announce new 2024 authentication requirement... by hnick on Monday October 30, 2023 @10:47PM (#38079595)
I think some crawlers run JS, because a lot of the web simply won't work without JS to initialise the page state these days.

You can use captcha or similar, one workaround I've seen has a submit that is hidden so never clicked by real people then a visible submit that sets a hidden input and clicks the other one which requires the hidden input... not foolproof but avoids some accidents.

Re:Gmail, Yahoo announce new 2024 authentication requirement... by 8organicbits on Tuesday October 31, 2023 @10:11AM (#38085115)
A crawler that follows links found in emails and sends POST requests / submits forms will cause so much havoc. It could buy things, validate account sign-ups, delete data, etc. I have a hard time believing the answer isn't to ask users to switch to a normal email provider.
Re:Gmail, Yahoo announce new 2024 authentication requirement... by hnick on Tuesday October 31, 2023 @09:24PM (#38093526)
I know web search at least runs JS to get better results. Not sure about email pre-fetch but I assume they do. I don't think crawlers click buttons though unless they are malicious so it's probably fine for unique email links.