undefined | Better HN

0 pointslittlestymaar1y ago0 comments

> These days there's also to consider that some Mail Threat Protection Tools (at least Microsoft Defender in Exchange Online does this) click links in Mails to check them.

What an insane policy, why am I surprised Microsoft came up with it…

0 comments

sbarre1y ago

It's not actually insane if the application hosting the link follows the principle that GET requests should not mutate state.

This problem is ~20 years old from when CMS platforms had GET links in the UI to delete records and "browsing accelerator" browser extensions came along that pre-fetched links on pages, and therefore deleted resources in the background.

At the time the easiest workaround was to use Javascript to handle the link click and dynamically build a form to make a POST request instead (and update your endpoint to only act on POST requests), before the fetch API came along.

littlestymaarOP1y ago

It is insane because it brings literally nothing security-wise (an attacker can easily detect that the link is being opened from something else than an end-user's browser, and not deliver the payload) while actualy compromising the security of their users (by allowing an attacker to know which addresses exist and which do not, which is very useful if you want to attack companies).

ctm921y ago

It does not only show to attackers that your address exists, it also shows that it is hosted on Microsoft 365 and is ATP is licensed.

saagarjha1y ago

The idea is that the pre-fetching is done by an environment that looks similar to the end-user's browser.

j / k navigate · click thread line to collapse