Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

https://twitter.com/sneakdotberlin/status/1317734739537653760

by sneak • 6 years ago

184 77 6 years ago

sneak2• 6 years ago

This also breaks GPG clearsigned messages that have URLs in the body, as demonstrated in this message I just sent myself:

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256

    Hello, please visit my site at https://www.google.com/url?q=https://sneak.berlin&source=gmail-imap&ust=1603637677000000&usg=AOvVaw2HZaWQujRWlDNrZMKZIsed.

    Best,
    - -jp


    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCAAdFiEEVTmtAN5MQvOv4RV1BSRD9N8qVcIFAl+MVwwACgkQBSRD9N8q
    VcLgzRAAln4mjtvlwqBIDKA8RFfTP/VwX4SuV1n7Ux5FrdNY1htde5Nkxu/wIcE7
    hz5VbdclvUrKP8lpb6LTU7UuV73aaN48QfGKhDmRkokiflR6uoisr9CBnLooD6Iw
    4KpU8Puqh+LgHRbP2AYZ3Qm//g9sJqdziC8/tATizE+yk8wcIqKihXzp+y9fYWNs
    UYv92/k6MivxqvM4r6IELJ8tOBSRu1lYKFsuI4GuYmPlnk2UqodlCUpWByaETezO
    NtkUvOVnIvt02hpliu36LSDeIquVio2eVjYJrvGvMpyWTW3MFG9BI0Tcgxbj3lsS
    DL9wOxhNeRPLYG91DtP+eIYsYZWigkGNQ8PMRfXcpjDN49ei//iN6Pvopn6txSnQ
    u9lELP8Td+tEXAlUnNzlE3d1WAARve9iG1SnAFDk+vfWEaEvEoZl9ZiHuH57jPF2
    9ggAOeGKaEAlF74Ekjs0Xrct5WDzy2FF3d+TE5e1Nzx+vwLBaRuWLVJO+iPUlbLv
    MHAwmCp5zNIB2r8sbBDATBUHaggFXV/k5H+wTjmB2kLALq/OD9tSfjNfjEUKcpM/
    FGK/AOh8NjwR28n9f1uMutYBrs2KPqjZlW88zNu90Wg0OAk91L9jmz3trH2PYrKs
    rlg2hQzBdOIY1/1LeUBoDkcQiqP2neg2ae/XF26qSarUVKcwAhM=
    =jmVc
    -----END PGP SIGNATURE-----

I'm also probably doxxing myself by posting those ust= and usg= values unredacted. :(

abdullahkhalids• 6 years ago

Test messages to myself from Thunderbird and from gmail web interface did not get rewritten.

How can I replicate this?

sneak2• 6 years ago

Send me an email at sneak@sneak.berlin and I'll send you my G Suite address that you can send a test message to that contains a URL, and I'll forward it back to you from my non-G Suite account so you can see what happens.

est312• 6 years ago

Probably an A/B test for now, so only a limited number of people have this issue.

gjvnq• 6 years ago

Maybe you have to write the message in HTML

est312• 6 years ago

Is the Google-provided signature intact at least? IIRC they provide a special header with a signature inside.

megous2• 6 years ago

ust is a timestamp. usg is probably some kind of HMAC (q || ust, secret) so that only google can generate the redirecting urls. If you change the usg, the redirection fails. The same happens if you change ust or q.

djbebs• 6 years ago

How can this be legal?

randomperson3212• 6 years ago

Why wouldn't this be legal?

londons_explore• 6 years ago

It's to protect the privacy of the Gmail user - it means the website doesn't get to know that you came from gmail.com. Google doesn't get any extra info, since they already had all your email contents and you already had a privacy agreement with them.

One could argue that they have to do this to meet the law.

oefrha4• 6 years ago

it means the website doesn't get to know that you came from gmail.com.

That's entirely solved by Referrer-Policy: no-referrer, so no.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

(Unless you're talking about someone using another webmail client that doesn't set the header, which would be a stretch.)

brirec• 6 years ago

This only works for inline images because Google caches them, and then you get the images from Google’s cache. It has nothing to do with external links.

If Google redirects you to a website, you’re still going to the website. Unless Google internally follows all the links in emails it won’t do anything to help spam. Not to mention all tracked links I’ve ever seen track primarily based on the URL itself.

Additionally, Google adding a redirection step won’t save anything, except show via HTTP Referer that you were linked to this page by Google. If you clicked the link from a desktop IMAP client you’d have no referer, so this is a net loss for privacy, not a gain.

GuB-42• 6 years ago

Because you agreed to it.

Somewhere in the terms of service:

This license allows Google to [...] modify your content, such as reformatting or translating it

hnarn4• 6 years ago

Because you agreed to it.

Without debating the legality of this, surely you are aware that agreeing to something illegal does not make the thing legal.

stephc_int13• 6 years ago

I've planned to quit using Gmail for a long time now. Any tips on how to do it efficiently?

I would prefer a native email client coupled to a simple hosting solution.

randomperson3212• 6 years ago

I use Tutanota.

devinegan• 6 years ago

I moved to fastmail. Biggest pain was all my filters that I ported to their rule syntax and still manually maintain. I believe they have a better way to do this 5+ years later, but that is my experience.

CitrusFruits• 6 years ago

I moved to fastmail earlier this year. Honestly, it took a full day of updating all my accounts on every site that used my email. It helps to have a password manager to keep track of progress.

Since then it's been pretty good. I keep my old gmail as an additional account on my email client to track things I've missed, but it's been surprisingly little.

jhardy54• 6 years ago

Use your own domain! That way your email address isn't paired with your email host.

nvr219• 6 years ago

1. Get Fastmail 2. Forward all your email from gmail to Fastmail. Use this time to update your contacts, etc. 3. After 30 days disable gmail forward. You will probably keep the email address for spam.

For Calendar - you can have fastmail pull your gmail calendar. Keep that in place to help transition recurring meetings to fastmail, and then eventually you can sunset that too.

Do invest in your own domain name so that if you need to leave fastmail in the future you can do that more easily.

trident10002• 6 years ago

I would definitely recommend using 2 email addresses. Pick one for your important stuff and another for spam (give this out to merchants and what not). Protonmail works but there are others. Also realize that you are not going to self destruct if you miss an email from migrating as long as you cover the most important contacts. It can actually be a good spring cleaning exercise.

oefrha4• 6 years ago

Can't reproduce on either Gmail or GSuite, including on webmail (I thought this could be some sort of "you're leaving example.com, do you really want to do that" thing, but nope). The part about IMAP being affected sounds especially suspicious. Knowing op's track record I'd rather hear from some more impartial sources.

tcombinator5• 6 years ago

I can and have reproduced this for over a week now and have been hammering google & apple to fix it with no luck. Google says it's an Apple issue and Apple says it's a Google issue. The issue only appears to surface under specific use cases and always requires the user to have setup Mail.app on macOS or iOS with the gsuite account/user set to type "Google" vs. "IMAP". This seems to be the real pickle as all the following use cases below require this to be true for the link manipulation to occur. The same messages viewed in gmail.com or in Mail.app on macOS or iOS with the account type set to "IMAP" have their links left untouched.

- Sending a message from a gsuite account user to an external party DOES NOT show the issue

- Sending a message from an internal gsuite account user to another user in the same gsuite account + another user outside of the gsuite account DOES show the issue

- Sending a message from a gsuite account user to another gsuite user in the same account DOES NOT show the issue

- Sending a message from an external account into a gsuite account user DOES SHOW the issue (this might be tied to admin settings in G Suite > Settings for Gmail > Safety - still needs to be tested more)

- The same messages that DO SHOW the issue only show it in Mail.app on macOS & iOS when the gsuite user account is setup as "Google" vs. "IMAP". It DOES NOT show up in the GMAIL iOS app nor does it show up in the gmail.com web interface.

Google support has been effectively useless. Apple support has honestly done more to shed light on the issue. However, both companies are blaming the other and refusing to escalate to engineering or get on a call with the other company to sort this out together. Of course, Google support claims nobody else is reporting this, while Apple support alerted me to this thread. Super frustrating all around. If you are a Gsuite user please report this so I'm not yelling into the wind here. I can also confirm for my account the issue started on October 6, 2020.

ISL• 6 years ago

Is there a reason that this would ever make sense for the end-user?

If I click on a link, my browser opens it. Done, right?

lern_too_spel• 6 years ago

Presumably to hide Gmail as the referer on browsers that don't support it. It doesn't make sense in the IMAP case.

https://caniuse.com/referrer-policy

asdfasgasdgasdg3• 6 years ago

They can also use this for phishing prevention. There are probably other ways to do it -- e.g. you could rewrite the url dynamically at read time if it's been detected as a phishing attack -- but using a redirector is likely simpler.

Tbh I'm struggling a little to understand what the threat model is here. You trust gmail to receive and handle your email. In the vast majority of cases, you're accessing the email through their web frontend, where they could easily detect hovers and clicks and log those with fair reliability, if they had nefarious ends in mind. But them using a redirector is a bridge too far? If you trust them to do the first two items, it seems a little far fetched to distrust the last.

genocidicbunny3• 6 years ago

It makes sense if you remember that ads, not gmail, are Google's main business.

phreack• 6 years ago

This is really urgent if it goes beyond A/B. Possibly even illegal already under some interpretations. It'd finally make me leave Gmail for sure.

tjoff• 6 years ago

Why would the outcome of the A/B matter? The writing is on the wall.

Maybe get out now rather than waiting for the frog to get cooked.

defnotashton23• 6 years ago

Is the another non chromium browser that can handle more than 5 extensions?

Ff extension management is terrible which i find unusable in an age where I need extensions to prevent sites from removing usability features like select, copy, and paste.

I'm using brave but I don't fully understand how it's related to chromium and if it's a true fork that they are going to be able to maintain independently. I have many many extensions in brave and an extension manager that let's me toggle them right from a drop down. Any suggestions?

akerro• 6 years ago

It'd finally make me leave Gmail for sure.

If Snowdens leaks didn't make you leave nothing will.

hnarn4• 6 years ago

I have used Gmail since you needed an invite to use it and I've never had any other assumption than my e-mails being about as safely tucked away as they would be on a public notice board in a town square, and that Google in addition to this is probably scanning them frenetically to figure out what they, or more specifically their advertisers, can try to sell me.

If I need to send something I actually care about I wouldn't use e-mail in the first place. It's a low-effort type of communication with normal people who don't care about security, so I'm not going to waste time making my end of that line of communication an impenetrable bastion.

jgalt212• 6 years ago

The recent actions of Big tech confirms to me that they believe any upcoming anti trust enforcement will have no teeth.

sebbyy• 6 years ago

I can't reproduce this. I tested it on both Gsuite and Gmail account.

jagged-chisel• 6 years ago

"Now?" Has this not always been the case? I tend to use the web UI on my desktop which, IIRC, has always made links bounce through a Google. I use an app on my mobile device so I can't confirm whether links bounce through Google.

Is Google rewriting the links in the message such that if I forward to someone's non-Gmail address, they still bounce through Google?

Or is the client 'rewriting' links dynamically? This same thing happens all over the web. Drop a link in your Medium-hosted blog, and they'll front the link with their own and then redirect.

What's the new, surprising bit here?

jeffbee2• 6 years ago

Can't repro. Links in text/plain, HTML, and mixed survive round trip through Google. Suggests that whatever client the OP is using is confused by the data-saferedirecturl attribute in Gmail's web presentation?

andor• 6 years ago

Yes, I think he is talking about the data-saferedirecturl attribute. He's not wrong though, as the redirect stored in the attribute is loaded when you click a link.

frob• 6 years ago

I'm also unable to reproduce this. This feature could be behind an A/B test, but this is just one additional data point.

easton• 6 years ago

So just like Microsoft has literally done for years?[0] I don't know how many times I've clicked on internal documentation that has a link that went through Outlook at some point and was wrapped in a safe link. It's designed to catch bad links without safe browsing in your browser (which things like IE and old Edge didn't have).

0: https://docs.microsoft.com/en-us/microsoft-365/security/offi...

greatgib• 6 years ago

It is already annoying that they do that with search results. Does anyone know a good/open source extension for chrome and Firefox that de-google the link before you click on it?

edoceo• 6 years ago

I saw something like this recently. I right-clicked to copy a link in a message, pasted to chat and it was google.com/url?url= like link.

I'm not able to repro at the moment. I manage a few domains in G, I'll keep poking.

tcombinator5• 6 years ago

See my longer replies in the thread, I've tested this extensively and can reproduce it reliably. Please report this to google to help back my claim which they of course are casting doubts on left right and center.

nashashmi• 6 years ago

https://stackoverflow.com/questions/5172168/why-do-links-in-...

Why do links in gmail redirect?

aimor• 6 years ago

I hate the Google redirects because they are noticeably slow. They did more to move me off Hangouts than anything else. They also plague Google News, but AMP is slowly "fixing" that problem.

megous2• 6 years ago

Me too. Noticeably slow is a bit of understatement. Often times, I have to wait >4s for a redirect, which is kinda infuriating, given that I know it's not the issue of the actual website, just google messing with the URLs.

Why does all the SPDY nonsense matter when Google adds huge latency in other ways.

trident10002• 6 years ago

Its been a long run with gmail but I'm going to make the full leap to protonmail pretty soon. It takes a little work to migrate things but I just cant stand gmail for so many reasons now.

And after Google pay thought it was a good idea to send my phone number out to every online merchant (I now get nonstop spam texts and calls) I've had it with the company.

woodruffw• 6 years ago

I can't reproduce this either, so I'll ask maybe a simple question: how does URL-rewriting benefit Google in this situation?

Google already knows the bodies of emails and can do whatever analytics they please on them. The vast majority of users are also using it via their web client, meaning that Google can put arbitrary JavaScript on the page to record which links are being clicked on. They already have most of the metadata that they could scrape from a rewritten URL, since you're already on their property. It's possible that I'm missing something, but it feels like it's a lot of effort for information that Google already possesses.

berkes2• 6 years ago

how does URL-rewriting benefit Google in this situation?

When I use, say, thunderbird, Google does not know whether I opened an email, interacted with links on them or downloaded images/external resources in them.

With link-rewriting, when I click on e.g. shopping.example.com/product/1337 and not on shopping.example.com/product/42 in an email, google now knows that "berkes, thunderbird-user is more likely to like product 1337" and can offer that data to advertisers.

TooCreative2• 6 years ago

I can reproduce it on gmail.com

Google seems to hide this via Javascript.

To reproduce in Chromium:

Enable dev tools, enable "Preserve log", go to settings and enable "Auto-open DevTools for popups".

Then click on a link in a mail.

Now you can see under the Network tab, that the new window did not go to the link you clicked but to a Google redirect url.

I guess Google outputs a normal link in the html but then intercepts the click and sends you to their tracking url.

As nobody seems to be able to reproduce it for IMAP, I guess that either A) the author is in an a/b test group that got targeted with the tracking links or B) he uses an email client that uses some other protocol or C) He is outright lying or D) Something else.

My money is on B. The author says on Twitter he uses mail.app on a Mac. I would not be surprised if the developer of a hip shiny Mac app happily used the newest shiny API from Google.

Can someone with a Mac and that app reproduce it?

jeffbee2• 6 years ago

Google has been rewriting the click target in gmail's web presentation for years. That is not the same, or even related, to changing the URL in the email itself (as presented by SMTP or IMAP).

oefrha4• 6 years ago

Google seems to hide this via Javascript.

I'm like 200% sure Google can't "hide this via JavaScript" (whatever "this" means) in my native mail client if they have actually rewritten the URLs, which is the accusation here.

TooCreative2• 6 years ago

That is why I said "on gmail.com" which is Googles web interface. I don't use a local mail software.

soraminazuki2• 6 years ago

But you said in another comment that you couldn't reproduce the OP's accusation "including on webmail." Gmail has been rewriting links in the web interface for all users using JavaScript for years now.

jpp• 6 years ago

I can confirm I'm seeing this -- I just noticed, searched Google, and ended up ... here.

I have an email generated by one of our internal systems with a link to it, fetched via IMAP using Apple Mail, and the link is edited to be like so:

https://www.google.com/url?q=<ORIGINAL-URL>&source=gmail...

We're on GSuite Business, and under "Spoofing and Authentication", have "Apply future recommended settings automatically." enabled. Probably some other options, too. I happen to have "Advanced Protection Program" enabled for my account; so this may be happening because of that.

Given the phishing attempts I've seen in my career, having this as an opt-in option for certain users ... well, let's just say I've personally had users I would have had this turned this on for and we would all be happier. I can also see the privacy concerns.

Perhaps we'll learn more about the opt-in / opt-out details in the coming days, so that users can make the appropriate choices for themselves?

tcombinator5• 6 years ago

Can you confirm you account is actually set to "IMAP" and not "Google" in macOS? See my other comments in the thread where this only happens for me under that condition. Downloading the messages via pure IMAP produces unmodified links.

tcombinator5• 6 years ago

- Sending a message from a gsuite account user to an external party DOES NOT show the issue

- Sending a message from an internal gsuite account user to another user in the same gsuite account + another user outside of the gsuite account DOES show the issue

- Sending a message from a gsuite account user to another gsuite user in the same account DOES NOT show the issue

Do you have a link to that twitter?

hnarn4• 6 years ago

This doesn't seem to be new, there's a Medium post from a year ago[1] talking about how the "data-saferedirecturl" attribute is used by Google to track clicks with Javascript, there's a question on support.google.com[2] with 100+ upvotes and no response asking what this attribute is for and how to disable it, and it even shows up in an internal (at least, targeted towards internal readers) U.S. Department of the Interior page which explicitly states that employees should not paste links from Google[3].

It's worth noting that this also happens on the "HTML version" of Gmail.

[1] https://medium.com/@ohadinho25/googles-gmail-tracks-link-cli...

[2] https://support.google.com/mail/thread/12875647

[3] https://www.doi.gov/employees/drupal/links

justaj• 6 years ago

This was already happening in the HTML version of Gmail, like well a couple of years before as I remember.

anjbe• 6 years ago

Nobody here has mentioned that sneak is using Google’s “Advanced Protection” feature: https://twitter.com/sneakdotberlin/status/131787094505949593...

Advanced Protection is that ultra‐secure mode that requires hardware security keys to login and prevents third‐party apps. Here’s a quote from its advertising copy:

Protection against malware is built into Google Chrome, but Advanced Protection performs even more stringent checks before each download. It flags, or even blocks you from downloading files that may be harmful.

Sounds an awful lot like what’s going on here. It would explain why nobody’s been able to reproduce it—almost nobody has AP turned on. I imagine the number of people

1) with AP turned on

2) using a third‐party mail client (mail.app)

3) viewing plaintext mails instead of HTML mail where the link rewriting is less obvious

must be close to zero.

tcombinator5• 6 years ago

I can confirm this has nothing to do with that as I do not have it enabled on my account and can reliably reproduce the issue. See my other replies in the thread for more details.

rhabarba• 6 years ago

"Google Mail Considered Harmful"

tbodt• 6 years ago

https://support.google.com/mail/answer/10173182

brodyerik• 6 years ago

https://try10.com/cheapest-4k-graphics-card/ https://try10.com/how-to-unblock-adobe-flash-player/ https://try10.com/best-motherboard-for-i9-9900k/ https://try10.com/best-gpu-for-ryzen-7-2700x/

Gmail/G Suite now editing URLs in mail message bodies to use Google URL redirect

Related Stories