Hacker News Reader

Comment by littlestymaar | Hacker News Reader

> These days there's also to consider that some Mail Threat Protection Tools (at least Microsoft Defender in Exchange Online does this) click links in Mails to check them.

What an insane policy, why am I surprised Microsoft came up with it…

View on HN

It's not actually insane if the application hosting the link follows the principle that GET requests should not mutate state.

This problem is ~20 years old from when CMS platforms had GET links in the UI to delete records and "browsing accelerator" browser extensions came along that pre-fetched links on pages, and therefore deleted resources in the background.

At the time the easiest workaround was to use Javascript to handle the link click and dynamically build a form to make a POST request instead (and update your endpoint to only act on POST requests), before the fetch API came along.

It is insane because it brings literally nothing security-wise (an attacker can easily detect that the link is being opened from something else than an end-user's browser, and not deliver the payload) while actualy compromising the security of their users (by allowing an attacker to know which addresses exist and which do not, which is very useful if you want to attack companies).

The idea is that the pre-fetching is done by an environment that looks similar to the end-user's browser.

It does not only show to attackers that your address exists, it also shows that it is hosted on Microsoft 365 and is ATP is licensed.

Reply on news.ycombinator.com