Hacker News Reader

Comment by pjot | Hacker News Reader

I’ve used this to see if my employer was spying on my email. They were.

Spying how?

If you embed a URL in emails then a lot of corporate email gateways will blindly follow the link, trying to check it for malware.

This may or may not be a useful security measure but it has many issues. One of which is that it could look like spying.

Protip, they all are, always, every time, especially if they say they aren't, because they can.

Not because they can, because they must . At least they must in most jurisdictions of most countries, except when the mail's subject is clearly labelled "PERSONAL" or there's some sort of automated classification in place.

If someone receives an email coming from your employer's domain with a virus or a child porn video attached, your employer had better be able to identify the sender account through logs & audit trails.

If a corporation has the technology and the legal room to do so they will, even if not required to. It’s just too much potential leverage and supporting material in case of some sort of litigation.

Are you certain it wasn’t just some gateway that followed the url in the email to give a preview or check for malware?

Pretty certain, yes. Series A startups generally aren’t that sophisticated.

And when the ip address comes from the employers location…

if they have gmail or office 365/outlook with an enterprise license, urls get sandbox detonated. You can tell if it was the sandbox or not by looking at the IP address and user agent fields in the http request of your canary hit. it should be the IP of your startup offices or in the cities your startup operates in, not some random cloud IP.

Or just Apple’s mail.app on iOS and macOS.

Reply on news.ycombinator.com