6 ms·

I'm pretty sure the stated intent of the redirect is to prevent phishing (that is, provide an opportunity for Google to warn users about visiting a known dodgy

I'm pretty sure the stated intent of the redirect is to prevent phishing (that is, provide an opportunity for Google to warn users about visiting a known dodgy site). The ability to track is just an added bonus! Microsoft does this too with Teams. Links that my colleagues and I share with one another to _internal company sites_ get link checked then redirected. Microsoft must have a treasure trove of data about external company employee browsing habits as a result. I would have infinitely more respect for companies that are upfront about their intentions, no matter how nefarious: "we're doing this to help protect you from phishing. But also, 99% of links are probably not phishing. So this feature really enables us to collect data to track what you do, and perform analytics to improve our bottom line". Why sugar-coat it?

diogenes4 3y ago
Why is this added to exported documents tho? It should only add the redirect in the browser.
- hackideiomat 3y ago
  And there it is not needed. You could implement this in JS.
tmpX7dMeXU 3y ago
How does the fact that most links aren’t phishing links play into anything? Maybe we don’t need AV because most files aren’t viruses? You had enough of a point without this.
- TeMPOraL 3y ago
  > Maybe we don’t need AV because most files aren’t viruses? Since you used that example... How would you feel if everyone in their neighborhood got assigned a private security officer that sits in their apartment doorway all day and notes who comes and goes? The company argues that it's to protect from the thieves and fraudsters, and indeed there are always some break-ins or grandparents scammed somewhere. Oh, and everyone gets an officer free of charge - it's paid for by the ads they wear on their vests and that play regularly on their walkie-talkies. Would you trust the security company that all the notes, taken by a person in the privileged position of observing everything in your home, will only be used to prevent crime and nothing else, ever? Back to your example - AV companies are quite shady these days, and their products not all that useful relative to costs/damage and snooping they do.
  - gretch 3y ago
    This is a weird example you posed because it's a real thing. It's called a doorman and it's very popular in new york (it's considered a luxury to have one)
    - salawat 3y ago
      Indeed. Except in that poster's example, imagine the doorman isn't merely looking over the building. Every door in the building has a doorman. The doorman to the building is more palatable because it's beyond their capacity to monitor all activity and movement through the building. The League of Meticulously Documenting Doormen on the other hand is a much greater threat to privacy. We're increasingly in jeopardy with regards to implementing that. The more we don't push back against unnecessary logging, the bigger the problem we're building socio-technically.
- srazzaque 3y ago
  I see your point, but comparing this with an off-line AV scanner with a regularly updated internal database (assuming that's what you meant) is not an apt comparison. The analog would be an AV scanner that sends a list of your files/hashes to a centralised server somewhere, so that the company can target ads related to your file contents (or sell your data...), in addition to warning you about viruses. Agreed that % true positive is not a factor in whether or not to have a given security feature. But it is merely convenient that the vast majority of the usage of this "link protection" feature would benefit Google/MS and not the customer/user (assuming that Google/MS are data mining, which is yet unproven in this use case).
  - freedomben 3y ago
    I largely agree with you, but GP didn't specify they are talking about an off-line AV scanner. In fact Google itself has an online AV scanner that scans attachments in gmail, files downloaded in Drive, etc.
  - autoexec 3y ago
    > The analog would be an AV scanner that sends a list of your files/hashes to a centralised server somewhere, so that the company can target ads related to your file contents (or sell your data...), in addition to warning you about viruses. Is there an antivirus program that doesn't do this? I've been assuming for a very long time that windows defender does, Norton/McAfee/Avast too. I'd be shocked if they didn't
dacryn 3y ago
funny you say that. Google is upfront about their intentions, but nobody believes them that they are not data mining this for behaviour tracking. Can't win in that scenario
- srazzaque 3y ago
  Interesting, I wasn't aware Google had actually stated "we don't use this data for tracking, and we only use it for link protection" (does it?). Assuming true: you are right in that it's basically no-win. The fact that Google draws so much revenue from advertising makes it difficult to reconcile. Nothing short of a third-party code audit of Google's code against their asserted privacy policy would appease everyone. And even then, there would be doubters.
  - TeMPOraL 3y ago
    If they did state that, this would probably be legally binding in the EU under GDPR.
- glimshe 3y ago
  They can't win as a result of their own actions. Once you lose trust, it's hard to regain it.
- nerdponx 3y ago
  Why would anyone believe that they aren't? Or that they won't start doing it?
  - sneak 3y ago
    More importantly: Google is in a jurisdiction that can mandate warrantless surveillance orders that require realtime surveillance of given selectors (i.e. IPs or users). They comply or they go to jail. Even if the stated and official policy of Google is to never track these, and everyone at Google is 100% on board with this and will never change, they are subject to being Agent Smith'd at any time by the FBI/DHS and NSA and CIA and the rest of the US IC, critically: without probable cause or a search warrant. The US has abandoned the rule of law and the constitutional protections against unreasonable search. This applies to every single US-managed services vendor. The decision to track or not track is simply not in their hands. If they get handed an NSL, a FISA order, or a regular old search warrant, they have to start turning over everything they have.
agluszak 3y ago
> I'm pretty sure the stated intent of the redirect is to prevent phishing (that is, provide an opportunity for Google to warn users about visiting a known dodgy site). The ability to track is just an added bonus! How do you know it's not the other way round?
userbinator 3y ago
I encounter similar annoyances with things like "link previews" (impossible for an internal site, or one which requires authentication), and as a result have come to slightly "obfuscate" all links I send through such software. Sometimes I just don't send any links at all --- something like "HN item 37776492" suffices.
- jabroni_salad 3y ago
  Where I work the onboarding sheet instructs you to make a custom search engine for servicenow because it's way faster to bang in the record number than to use a link in Teams.
nerdjon 3y ago
I DESPISE these links from Outlook and Teams (not sure if it is specifically the teams implementation or something else). I don't know about your company but mine has us do these phishing tests and training videos all the time and then we get rid of one of the safety features that they keep hammering us about. I can't just look at the URL before clicking it. I once "fell victim" to one of our phishing tests because I clicked the link in the email. And its like... well we have been trained by our own email system that the only way to actually see the validity of the link is to click it.
- isoprophlex 3y ago
  lol yeah. I curled the url in a suspicious email once, to investigate what it was. YOU FAILED THE TEST. ugh...
  - mnw21cam 3y ago
    In their defence, curl isn't completely benign in this case. You just confirmed to the person who sent you the link that your email address is valid and reaches a person.
    - Ferret7446 3y ago
      Not necessarily? What's stopping an email server from probing links in all incoming emails regardless of valid recipient for malware analysis purposes? In fact, I would be surprised if, e.g., Gmail, does not do this.
    - saalweachter 3y ago
      Also, there's no reason to believe that you're curling the same redirect as you get from clicking the link. There's this thing compromised webservers do where, if you type in www.example.com into your browser, and go straight there, you get the normal web page. If you click a link from Google, and have a google.com referrer in your request, you get a little bit of JavaScript included that that redirects you to another site to buy herbal remedies or fake watches or whatever. If you are the business owner and go directly to your home page to see what's what, you think everything is fine; if you are a tech trying to debug it and you curl the webpage, everything looks fine [unless you curl with a referrer set]. You probably think Google has the wrong URL or something. Likewise -- I don't know what a click-through from an email client looks like, but it wouldn't surprise me if there's an identifiable header or referrer or something. If that's the case, you could write your malicious URL shortener to redirect you to www.example.com/ if you curl it bare, or www.exam.ple.co/m/ if you have the redirect header. Curling the URL in question doesn't necessarily prove it's safe to click on.
deleted 3y ago
[deleted]
hnburnsy 3y ago
Safelinks in Teams is a policy that your administrators can manage... https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide#safe-links-settings-for-microsoft-teams https://learn.microsoft.com/en-us/microsoft-365/security/off...
JKCalhoun 3y ago
Since U.S. public school districts and students under the age of 18 use Google Docs pretty much exclusively these days, this seems like a privacy lawsuit waiting to happen.
- callalex 3y ago
  I’m sure they can just print out a little pamphlet to shove in the Chromebook box that says “by being in the same room as this computer you agree to blah blah blah”. US consumer protection laws are worthless.

diogenes4 3y ago

Why is this added to exported documents tho? It should only add the redirect in the browser.

hackideiomat 3y ago
And there it is not needed. You could implement this in JS.

tmpX7dMeXU 3y ago

How does the fact that most links aren’t phishing links play into anything? Maybe we don’t need AV because most files aren’t viruses? You had enough of a point without this.

TeMPOraL 3y ago
> Maybe we don’t need AV because most files aren’t viruses? Since you used that example... How would you feel if everyone in their neighborhood got assigned a private security officer that sits in their apartment doorway all day and notes who comes and goes? The company argues that it's to protect from the thieves and fraudsters, and indeed there are always some break-ins or grandparents scammed somewhere. Oh, and everyone gets an officer free of charge - it's paid for by the ads they wear on their vests and that play regularly on their walkie-talkies. Would you trust the security company that all the notes, taken by a person in the privileged position of observing everything in your home, will only be used to prevent crime and nothing else, ever? Back to your example - AV companies are quite shady these days, and their products not all that useful relative to costs/damage and snooping they do.
- gretch 3y ago
  This is a weird example you posed because it's a real thing. It's called a doorman and it's very popular in new york (it's considered a luxury to have one)
  - salawat 3y ago
    Indeed. Except in that poster's example, imagine the doorman isn't merely looking over the building. Every door in the building has a doorman. The doorman to the building is more palatable because it's beyond their capacity to monitor all activity and movement through the building. The League of Meticulously Documenting Doormen on the other hand is a much greater threat to privacy. We're increasingly in jeopardy with regards to implementing that. The more we don't push back against unnecessary logging, the bigger the problem we're building socio-technically.
srazzaque 3y ago
I see your point, but comparing this with an off-line AV scanner with a regularly updated internal database (assuming that's what you meant) is not an apt comparison. The analog would be an AV scanner that sends a list of your files/hashes to a centralised server somewhere, so that the company can target ads related to your file contents (or sell your data...), in addition to warning you about viruses. Agreed that % true positive is not a factor in whether or not to have a given security feature. But it is merely convenient that the vast majority of the usage of this "link protection" feature would benefit Google/MS and not the customer/user (assuming that Google/MS are data mining, which is yet unproven in this use case).
- freedomben 3y ago
  I largely agree with you, but GP didn't specify they are talking about an off-line AV scanner. In fact Google itself has an online AV scanner that scans attachments in gmail, files downloaded in Drive, etc.
- autoexec 3y ago
  > The analog would be an AV scanner that sends a list of your files/hashes to a centralised server somewhere, so that the company can target ads related to your file contents (or sell your data...), in addition to warning you about viruses. Is there an antivirus program that doesn't do this? I've been assuming for a very long time that windows defender does, Norton/McAfee/Avast too. I'd be shocked if they didn't

dacryn 3y ago

funny you say that. Google is upfront about their intentions, but nobody believes them that they are not data mining this for behaviour tracking. Can't win in that scenario

srazzaque 3y ago
Interesting, I wasn't aware Google had actually stated "we don't use this data for tracking, and we only use it for link protection" (does it?). Assuming true: you are right in that it's basically no-win. The fact that Google draws so much revenue from advertising makes it difficult to reconcile. Nothing short of a third-party code audit of Google's code against their asserted privacy policy would appease everyone. And even then, there would be doubters.
- TeMPOraL 3y ago
  If they did state that, this would probably be legally binding in the EU under GDPR.
glimshe 3y ago
They can't win as a result of their own actions. Once you lose trust, it's hard to regain it.
nerdponx 3y ago
Why would anyone believe that they aren't? Or that they won't start doing it?
- sneak 3y ago
  More importantly: Google is in a jurisdiction that can mandate warrantless surveillance orders that require realtime surveillance of given selectors (i.e. IPs or users). They comply or they go to jail. Even if the stated and official policy of Google is to never track these, and everyone at Google is 100% on board with this and will never change, they are subject to being Agent Smith'd at any time by the FBI/DHS and NSA and CIA and the rest of the US IC, critically: without probable cause or a search warrant. The US has abandoned the rule of law and the constitutional protections against unreasonable search. This applies to every single US-managed services vendor. The decision to track or not track is simply not in their hands. If they get handed an NSL, a FISA order, or a regular old search warrant, they have to start turning over everything they have.

agluszak 3y ago

> I'm pretty sure the stated intent of the redirect is to prevent phishing (that is, provide an opportunity for Google to warn users about visiting a known dodgy site). The ability to track is just an added bonus! How do you know it's not the other way round?

userbinator 3y ago

I encounter similar annoyances with things like "link previews" (impossible for an internal site, or one which requires authentication), and as a result have come to slightly "obfuscate" all links I send through such software. Sometimes I just don't send any links at all --- something like "HN item 37776492" suffices.

jabroni_salad 3y ago
Where I work the onboarding sheet instructs you to make a custom search engine for servicenow because it's way faster to bang in the record number than to use a link in Teams.

nerdjon 3y ago

I DESPISE these links from Outlook and Teams (not sure if it is specifically the teams implementation or something else). I don't know about your company but mine has us do these phishing tests and training videos all the time and then we get rid of one of the safety features that they keep hammering us about. I can't just look at the URL before clicking it. I once "fell victim" to one of our phishing tests because I clicked the link in the email. And its like... well we have been trained by our own email system that the only way to actually see the validity of the link is to click it.

isoprophlex 3y ago
lol yeah. I curled the url in a suspicious email once, to investigate what it was. YOU FAILED THE TEST. ugh...
- mnw21cam 3y ago
  In their defence, curl isn't completely benign in this case. You just confirmed to the person who sent you the link that your email address is valid and reaches a person.
  - Ferret7446 3y ago
    Not necessarily? What's stopping an email server from probing links in all incoming emails regardless of valid recipient for malware analysis purposes? In fact, I would be surprised if, e.g., Gmail, does not do this.
  - saalweachter 3y ago
    Also, there's no reason to believe that you're curling the same redirect as you get from clicking the link. There's this thing compromised webservers do where, if you type in www.example.com into your browser, and go straight there, you get the normal web page. If you click a link from Google, and have a google.com referrer in your request, you get a little bit of JavaScript included that that redirects you to another site to buy herbal remedies or fake watches or whatever. If you are the business owner and go directly to your home page to see what's what, you think everything is fine; if you are a tech trying to debug it and you curl the webpage, everything looks fine [unless you curl with a referrer set]. You probably think Google has the wrong URL or something. Likewise -- I don't know what a click-through from an email client looks like, but it wouldn't surprise me if there's an identifiable header or referrer or something. If that's the case, you could write your malicious URL shortener to redirect you to www.example.com/ if you curl it bare, or www.exam.ple.co/m/ if you have the redirect header. Curling the URL in question doesn't necessarily prove it's safe to click on.

deleted 3y ago

[deleted]

hnburnsy 3y ago

Safelinks in Teams is a policy that your administrators can manage... https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide#safe-links-settings-for-microsoft-teams https://learn.microsoft.com/en-us/microsoft-365/security/off...

JKCalhoun 3y ago

Since U.S. public school districts and students under the age of 18 use Google Docs pretty much exclusively these days, this seems like a privacy lawsuit waiting to happen.

callalex 3y ago
I’m sure they can just print out a little pamphlet to shove in the Chromebook box that says “by being in the same room as this computer you agree to blah blah blah”. US consumer protection laws are worthless.