0

Today I noticed something strange.

I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link. However, in plaintext, in 3 out of 4 mails only the a.com was shown

a.com
<b.com>

This makes me a bit worried however, since I only noticed the difference of displayed text and link location once another client answered, that probably had HTML view turned on.

If I switch the view of the message body to Simple HTML, I need to check if the link matches the location visually, which I want to avoid, because that might be error-prone. I do know that I could configure my Thunderbird to simply show me puny-code, but then one unaware click in the wrong moment could be fatal.

What are security-wise recent best practices to both protect yourself from clicking malicious links as well as detecting that someone has sent such a malicious link?

Specifically, is there a way to always get shown

a.com
<b.com>

in plaintext, but with the displayed part only marked as the link's location, whenever the link's text part displays an URL?

0
1

There is not going to be a way to force the link text to be the same as the target URL of the link. Else we couldn't have links.

Since the very beginning, the advice has been to hover over the link to check where it goes. That advice has not gone away, as error-prone as that might be.

To make things easier, you can always turn off HTML-view in your email clients. But that will make HTML-based email very ugly.

Each email client might have tools to make this easier, but that will be up to each email client.

7
  • Thanks for your reply. I already view my mails in plaintext, so I would always have a.com as the link location (the assumably non-malicious link). However, I also want to detect when the location and url text differ. If mail clients do not solve the issue, maybe a mail proxy would that adds a warning to the mail in such cases?
    – kaiya
    May 7 at 17:16
  • How would it know to flag this specific case? That's the point of my first line. How does it tell the difference between a.com and Click here!?
    – schroeder
    May 7 at 17:49
  • I'd say that is what regex is for. I don't see the difficulty, am I missing something?
    – kaiya
    May 10 at 15:46
  • A regex to account for all possible legitimate strings is impossible.
    – schroeder
    May 10 at 15:53
  • 1
    Sure, but only if the link text includes the protocol. But that's a corner case.
    – schroeder
    May 11 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.