Hacker News Reader

Comment by millerm | Hacker News Reader

I just wish all email clients would stop allowing HTML to hide an actual link. It needs to stop. Anchor tags and any type of onClick/onTouch event in an email should not do anything. Just stop letting them obfuscate the freaking address, it’s that simple. Tell the marketing people to go to hell, and no they cannot have their silly nicely printed link. :-)

View on HN

This. On phones especially it's getting increasingly hard, as a nerd desiring to do so, to figure out what the sender's email address and link's HTML target are :<

If you put your malicious URL behind a URL shortener or a use a subdomain that looks legit, 99% of people are going to click on it anyway.

The point would be if it’s from Bank of America they shouldn’t use a URL shortener.

Why do you want this specifically for HTML emails and not on actual web sites? Surely it’s just as much of a threat in either place.

Email is push, websites are pull. If you never choose to visit a website, then you'll never see a link on it. Most of the websites you do visit already prevent obfuscating links. Emails just show up in your inbox when an attacker wants them to. We could of course change that, and have people only see emails from known contacts or that they have requested. However, this destroys a major value proposition of email. Instead, it makes sense to limit the ability for senders to obfuscate the contents of email.

An attacker could email you an unobfuscated link to a website which contains obfuscated links and the threat model is exactly the same. Both require only that the victim 1) trust an email enough to click a link and then 2) trust the destination of that link enough to do the unsafe thing. Unless your computer propagates the "untrustworthiness" of the link from the email client to the browser and continues to prevent unobfuscated links, it seems like you've gained very little.

If you are forced to copy and paste you force the url to be visible. Forced copy and paste increases people just logging on to an existing sute in your hisstory to check notification.. those your netflix is canceled click here to restore service get resolved quickly when you login to netflix directly instead of netflix.d.nowhere.io

This is part of why I read my email as text (in emacs, though that's certainly not mandatory).

You can’t run Javascript in an email.

Reality, unfortunately, isn't nearly as definitive as stating this.

Several versions of Outlook, still in use, actually do support certain subsets of JavaScript, in email.

That would be nice :)

Reply on news.ycombinator.com