Hacker News Reader

> I'd solve this by warning users who attempt to reuse consumed links that the link has been used already, and likely list broken email providers that I suspect are using software that breaks this. And then wait. Let them complain to their IT, or whomever is responsible for picking broken software.

The thing is, most websites already know how to workaround that particular issue (https://news.ycombinator.com/item?id=42804447), so when users notice that something breaks with just your service and not everyone elses, you can say "Outlook is shit" all you want, the users will blame you for it, since you weren't able to fix what others could, for better or worse.

> You could roll over and decrease your security so that MS can claim they increased theirs

What part of your security would decrease if you "roll over" and what exactly does "roll over" entail here? Websites who've dealt with this issue implemented what I linked to above, they're no more/less secure than the website who didn't manage to work around this issue, they're just less buggy for Outlook users, if anything.

Your description isn't a work around, it's the exact same buggy behavior, just implemented in JS, instead of a malware scanner. GET or POST is less important than user action, if your code consumes a token without user action, it doesn't matter if that's server side or client side, GET or POST.

If outlook is clicking on links or buttons that generate POST requests, then outlook is broken. If outlook is loading a page, and the page without further interaction is sending a POST, that's just as bad, if not worse than expiring the token on that same GET.

I wouldn't call that a work around, would you?

> If outlook is clicking on links or buttons that generate POST requests

It isn't though, it's loading URLs it finds in emails, and then runs scripts on those loaded websites, like many "modern" scrapers/crawlers.

So if your JavaScript on that URL automatically does POST requests on load, those will happen automatically when their scanner loads the website.

But if you instead don't do a POST request on JavaScript load, and do that request when the user presses an actual button on the loaded website, the scanner won't trigger that button automatically (that would be a whole new level of craziness, we're not there (yet))

So yes, it is a workaround. I've implemented this 10s of times already, because it's been an issue for a long time.

Edit: The submission article also makes it abundantly clear that this is the very problem they're suffering from:

> Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript:

The problem is that their JavaScript automatically issues POST request on load, not that Outlook loads and executes JavaScript on the page (although that sucks too, don't get me wrong).

My point was more, sending a POST request IFF a user interacts isn't a work around, but the expected and desired behavior. It's a bug otherwise. Fixing a bug shouldn't be called a work around. A work around is when you can't fix a bug somewhere else.

> you can say "Outlook is shit" all you want, the users will blame you for it, since you weren't able to fix what others could, for better or worse.

Personally, I'd happily blame Microsoft, but the practical significance of this fact is nil.

I am in the very small minority of users who will sometimes complain to our IT when Microsoft forces shit down our throats. But I do this because it feels good, not because I imagine any realistic probability that doing so will make a difference.

That's nice. Here's how that will go:

User: Hey IT, a site I'm trying to use says that I can't use Outlook, can we switch provider

IT: Heck no. Are there any alternatives

User: I guess I'll try to find them.

That, is only your problem if you make it your problem. Ideally, you wouldn't. But like I already said, it depends on if you're willing to sacrifice the security of all your users because, money I guess?

Eventually you have to choose doing what's right, and doing what's expedient. I can't draw your line for you. Thankfully for me I've always been able to always draw mine at protecting users from abuse.

Users care much more about convenience than security. If you made a phone that wiped itself after 3 incorrect pin attempts then you'd have a lot of very angry users wearing gloves. "It's for your own security!" wouldn't appease them.

It's more like if someone tried to delete/hack your account but you send a confirmation email to protect such a thing, and Microsoft clicked on the accept & delete account button in that email. So you deleted the user's account.

Do you know what users like less than inconvenient security? It's when "security" deletes all of their important data.

Again, still have to draw the line of what's acceptable somewhere. All I'm saying is you don't have to ruin your software because someone else is an idiot. Don't punish everyone because it makes the problem somebody else's to fix... That's what Microsoft is doing here, and it's obviously bad.

> It's more like if someone tried to delete/hack your account but you send a confirmation email to protect such a thing, and Microsoft clicked on the accept & delete account button in that email. So you deleted the user's account.

And then the user says "why did you delete my account?" and you say "well I chose not to support outlook but I didn't tell you that at the start" and the user says "that's stupid, everyone uses outlook" and leaves a bad review

It is not my job to tell Microsoft to correct their behavior and follow standards.

There are standards for a reason [1] and if you break them, no matter how good your intentions you are in the wrong because you've changed the expected behavior. Full stop.

The Internet works because everyone has agreed to follow standards. If Google woke up one day and decided that every IP address that ended in an odd number would receive a captcha every time they searched people would understandably get pissed off. Well ISPs have thousands of IP addresses so for the convenience of the user it's the ISPs that need to assign their users IP addresses ending in an even number so that they can search without captchas, right? No!

Same thing here. Just because Microsoft and Google benefit from economies of scale and have many users does not give them a pass to break standards whenever they see fit. There is a reason why we have RFCs and mailing lists to have these sorts of discussions.

edit:

[1] https://datatracker.ietf.org/doc/html/rfc8058

I'm not arguing that it's good that MS is doing something insane, I'm arguing that you can't take the moral high ground and act as if they're not doing that insane thing.

There may be standards for the internet but people do not implement them correctly or consistently and the internet works because everyone adds workarounds for everyone else until things basically kinda work out.

> and Microsoft clicked on the accept & delete account button

If that happened, could one plausibly make a legal case that Microsoft is "hacking" the sites/users by stealing sensitive security info and making unauthorized actions?

But if we asked users "Choose one: the ideal convenience of being able to log in with just your username (but anyone who knows your username can login as you), or the inconvenience of having to enter username plus a secret password?" almost all users would choose the security over convenience, because they would understand the risk/reward. I think users care more about convenience than _theoretical_ security, and that we owe them education on how security impacts them directly.

What prevents bad actors from detecting that the request is coming from MS and returning pictures of kittens, but the most wicked malware otherwise? You don’t actually have to answer.

Microsoft can try quite hard to make their requests look like a user.

Microsoft owns the domain & owns the client. They are the user in this case

> enumerate the subnets that MS uses, and black list them. Then the links might actually get to users connecting from non MS data centers.

Or Microsoft might start blocking your email altogether for circumventing security procedures or whatever.

> Microsoft knows what they're doing

Right. Thanks for consuming my SSO magic links.