0

I'm terrified of clicking on links in emails, and yet a colleague insists I do.

When I receive an email in my gmail account that contains links of the form http://gofile.me/xxxxx/yyyyyyyyy along with its password, apparently sent from someone I know and expect it from, and who has supplied the password for the link to their NAS right next to it, should I try to overcome my fear of clicking on links in emails and consider clicking on it as at least fairly safe? Should I instead copy it paste it in a new tab?

The idea is that the document is evolving so the link will provide the latest version, but should I insist the colleague email me the document directly?

tl;dr: Should I

  1. click url
  2. copy/paste url in new tab
  3. balk, request document be emailed each time

If possible, can an answer be written in simple language?

Cropped, blanked out screenshot from email I received in my gmail:

partial screenshot of emailed urls

2 Answers 2

1

The idea is that the document is evolving so the link will provide the latest version, but should I insist the colleague email me the document directly?

Having a link or having the file directly does not actually make much of a difference. The link can point to some malicious file or to some phishing page (i.e. stealing of passwords) but an attached file can actually be malicious too - especially Office documents with macros enabled. And such malicious links and attachments are unfortunately fairly common today.

The question is thus if you trust the sender and if the sender is actually the one you think it is. Unfortunately the sender of an email can be easily spoofed, similar on how could simply write a faked sender on the envelope when using snail mail. Or the sender might also be hacked and the trusted account used to send mails.

Thus, when in doubt about the origin and intend of the mail, better contact the sender to confirm that the mail was actually send by them. Such contact can be using a different communication channel (phone, messaging, asking personally, ...). If you can be sure that the sender was not hacked you might also ask for confirmation by email. In the latter case you should make sure though that the address you reply to is actually the email address you know from the sender, and not the address of an attacker.

1

If you have reasons not to trust the communication, then you shouldn't click any links of open attachments. To make communication safer, you should consider the introduction of email encryption, and signing. This is the cleanest solution. Using other channels to communicate the origin of the email is not a good solution. The email could be hijacked and tampered with if it is not signed and encrypted. Use of arbitrary service for sharing the files always comes with a risk, generally, when I'm sharing stuff with my colleagues and acquaintances I tend to use cloud storage that is linked to my identity (eg. OneDrive, GoogleDrive) those have a safe way of link sharing built-in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .