Hacker News Reader

Comment by er4hn | Hacker News Reader

The big takeaway I have here is that security is a balance between usability and safety. In this case by having malicious links that were obfuscated (behind HTML?) to appear as legitimate LinkedIn links, the target clicking them was compromised.

If mail clients were to open a modal for each link and say "Are you sure you want to go to https://LinkMeIn.com/totally-legit?email=victim123@gmail.com" would this cut down on these attacks?

Taking the idea too far: A system like this would probably link to some sort of cloud database eventually to catch "emerging threats" (novel URLs that look malicious) but then would that in turn threaten end-to-end encryption of email by sending links in emails to a cloud tracker?

View on HN

I just wish all email clients would stop allowing HTML to hide an actual link. It needs to stop. Anchor tags and any type of onClick/onTouch event in an email should not do anything. Just stop letting them obfuscate the freaking address, it’s that simple. Tell the marketing people to go to hell, and no they cannot have their silly nicely printed link. :-)

This. On phones especially it's getting increasingly hard, as a nerd desiring to do so, to figure out what the sender's email address and link's HTML target are :<

Why do you want this specifically for HTML emails and not on actual web sites? Surely it’s just as much of a threat in either place.

Email is push, websites are pull. If you never choose to visit a website, then you'll never see a link on it. Most of the websites you do visit already prevent obfuscating links. Emails just show up in your inbox when an attacker wants them to. We could of course change that, and have people only see emails from known contacts or that they have requested. However, this destroys a major value proposition of email. Instead, it makes sense to limit the ability for senders to obfuscate the contents of email.

An attacker could email you an unobfuscated link to a website which contains obfuscated links and the threat model is exactly the same. Both require only that the victim 1) trust an email enough to click a link and then 2) trust the destination of that link enough to do the unsafe thing. Unless your computer propagates the "untrustworthiness" of the link from the email client to the browser and continues to prevent unobfuscated links, it seems like you've gained very little.

If you are forced to copy and paste you force the url to be visible. Forced copy and paste increases people just logging on to an existing sute in your hisstory to check notification.. those your netflix is canceled click here to restore service get resolved quickly when you login to netflix directly instead of netflix.d.nowhere.io

You can’t run Javascript in an email.

Reality, unfortunately, isn't nearly as definitive as stating this.

Several versions of Outlook, still in use, actually do support certain subsets of JavaScript, in email.

That would be nice :)

This is part of why I read my email as text (in emacs, though that's certainly not mandatory).

If you put your malicious URL behind a URL shortener or a use a subdomain that looks legit, 99% of people are going to click on it anyway.

The point would be if it’s from Bank of America they shouldn’t use a URL shortener.

This would generate a ton of "false positives" (go look at a link in a random email newsletter and see what the actual URL is). People who do a lot of email stuff on their phone would be trained to click Yes a hundred times a day.

Meanwhile it seems very unlikely to stop such a determined attacker. They just need to compromise a site that you might plausibly want to visit, or create a convincing enough lookalike. The URL need not look suspicious.

IMHO expecting users to be able to discern "safe" from "unsafe" links by just looking at them represents a failure of our infosec systems.

For regular users, the answer to any question "Are you sure..." is always yes.

Everyone is always sure. If they aren't the first few times then they quickly get in the habit of just clicking "okay".

Sigh. We had to disable Windows Scripting Engine company-wide because someone complained that his invoice won't download no matter how many times he tried. His invoice in this case was a ransomware payload that the browser was fortunately stopping. Some people care, some care some of the time, and some just don't care.

so, why was it disabled then?

Chrome identified the ZIP download as malicious. It was sheer luck, otherwise the user would have opened the ZIP and executed the obfuscated VBS inside.

Few years ago I almost self-signed Transmission-bt app bundle via Xcode CLI tools because OSX falsely detected some KeRanger malware in it and tried to remove the app. And I was committed to run it by any means, cause I was tired of uTorrent.

Turned out it wasn’t a false positive, their dist site got pwned. Other than that, I’m very careful with pc security.

"Of course I'm sure I want to open this link."

and yet the gunfighter did not know where the link actually led to

You shouldn't get compromised just clicking a link. There's generally multiple levels of isolation to allow running untrusted code (websites) on your machine/device and being able to break through this is a serious failing

Have you seen an link in outlook? This safelink feature? You have almost no idea where you will go.

Security is largely not a balance between usability and safety at the levels most companies operate at. Both usability and safety could have been achieved in this case by just not being vulnerable to the attack as was the case for many other browsers. Then you could click the link and still be safe without any usability tradeoff in this specific case.

Obviously, there are ways to sacrifice usability to gain security, but it is by no means required or sufficient to do so. There are plenty of ways to completely demolish usability without gaining any safety. And even in cases where it is necessary to tradeoff, most problems are so far from the actual edge of what is possible that you only need to sacrifice a negligible amount of usability to gain order of magnitude improvements in safety if you are working with someone who knows what they are doing.

No it wouldn’t because so long as the bulk of emails hold valid links the users will on average be conditioned to click. Sometimes all it takes is for one insider to click to take down an organization.

My email client definitely does this. Called FairEmail, available for Android.

Reply on news.ycombinator.com