Tell HN: Gmail tampers with incoming email body content

https://news.ycombinator.com/item?id=44766538

by chrisjj • 12 months ago

10 24 12 months ago

news.ycombinator.com

Comparing Gmail page source with message original on for example the latest genuine Amazon scam warning shows linkification of "amazon.co.uk" by Gmail. Quite ironic given the warning about links in scam mails.

Gmail: https://i.imgur.com/MQH1shA.png Fastmail: https://i.imgur.com/tczhO8g.png

Gmail Print likewise: https://i.imgur.com/SWoPXqs.png

God help anyone printing emails to shows tampering or lack of for a legal case. And does Gmail have any "Display un****ed" option?? Er, no.

And Amazon, perhaps check your emails on the world's top web client?

nubg• 12 months ago

I don't get what the problem is? Gmail turns text that looks like a link into a clickable link. What could the negative implications of that be?

john01dav3• 12 months ago

If they have some system to edit emails as they come in, then other less benign editing could be present, either profitable-malicious or from a bug. With no indication of editing and no easy way to view an unedited email this would also fly under the radar in many cases.

jsnell2• 12 months ago

Why in the world are you and the op calling this "editing"?

Like, the OP clearly does not understand the distinction between rendering the email and storing it, given their "evidence". But you do understand the difference. Why take their confusion at face value like that?

chrisjj9• 12 months ago

Facilitating phishers.

VladVladikoff• 12 months ago

I’m so confused. Isn’t Amazon.co.uk their official domain in the UK? How is that link a scam?

endominus• 12 months ago

The OP is not claiming that the link is being changed; the complaint is that a hyperlink is being generated from the plaintext URL. The HTML body of the email is being modified.

chrisjj9• 12 months ago

No-one said that link is a scam. But the next one could be.

john01dav3• 12 months ago

In what client are you viewing this in your screenshots? If their web mail client displays things as links that's much less concerning to me than the SMTP backend tampering. It's expected for an email client to have quality of life features.

chrisjj9• 12 months ago

The client is as per the labels. Gmail, Fastmail.

It's expected for an email client to have quality of life features.

Yup. Phishers deserve quality too!

Consider a phish-warning email saying "genuine emails from us will never contain links"... showing these links.

andylynch• 12 months ago

Outlook’s done this for like a decade? Ditto Apple mail.

I think they do the same with email addresses and phone numbers too, it’s kind of useful and not a big deal.

AlexErrant• 12 months ago

does Gmail have any "Display un**ed" option?? Er, no.

On the email, click the dotdotdot, show original. https://imgur.com/a/ymjtfCI

chrisjj9• 12 months ago

Original HTML/base64 is not useful.

meinersbur2• 12 months ago

GMail (and Fastmail) are rendering the email. It just happens that the email and we webbrowser are both HTML. In no case should they just literally forward the email HTML to the browser. They scrub JavaScript, non-whitelisted HTML elements, rewrite links/external resources including tracking pixels.

You can see the raw email with "show original" in the options

Redoubts• 12 months ago

Meh, macOS’s Mail.app approach of everything-but-the-JavaScript is great and I wish outlook & Gmail did it too

chrisjj9• 12 months ago

They scrub ... non-whitelisted HTML elements

Any documenation on that list?

meinersbur2• 12 months ago

https://help.zapier.com/hc/en-us/articles/8496101927181-What...

I don't think there is an official list. It is security-related and changes over time

beardyw• 12 months ago

I'm afraid my righteous indignation only flickered slightly.

politelemon• 12 months ago

All web clients choose how to render their emails and there will be variations. This is not tampering.

chrisjj9• 12 months ago

It is, where the alteration is unauthorised.

I do not recall the Google terms seeking such authorisation.

Is there even an option to disable?

Tell HN: Gmail tampers with incoming email body content

Related Stories