23

Stackexchange started to use URLs in E-Mails, that look like phishing and have nothing to do with the real stackexchange domains.

Example:

<a href="http://sg-links.stackoverflow.email/wf/click?upn=pDzA4vSaPmKy14REDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDPyU-3D">https://stackexchange.com/users/REDACTED?tab=inbox</a>

So the text looks like this:

https://stackexchange.com/users/REDACTED?tab=inbox

And the actual link is:

http://sg-links.stackoverflow.email/wf/click?upn=pDzA4vSaPmKy14REDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDPyU-3D

So it has many signs of a phishing mail:

  • Redirect URLs instead of real URLs
  • Different link text and links
  • Link to a totally different domain
  • Link to a new TLD (.email) with a similar name than the real site
  • Very long URL
  • Tracking parameters in the URL

(The e-mail is probably real and the domain seems to belong to Stack Exchange. But I cannot know this without quite a bit of additional research. This is very bad. Especially when someone starts using another look-alike domain and I am already used to strange links in Stack Exchange E-Mails)

PLEASE STOP DOING THIS!

When you send me a link, please just use a plain link. This does not only apply for links, that have URLs as their link text like the input link, but to the linked question and the links like "Edit email settings" as well.

Regarding the argument that using another domain protects cookies, I would suggest just not to use a redirect URL at all. Sending E-Mails using a third-party service is okay. But you do not need to use the tracking URLs of the third-party service. When it is mandatory for this service, use another provider where it is not mandatory.

  • 1
    your network profile is not a secret as it is 480116 so there was no need to have that part redacted ... – rene Apr 27 at 12:27
  • 1
    fwiw, stackoverflow.email is a domain owned by Stack Exchange. – rene Apr 27 at 12:28
  • 1
    @rene Better one thing too many redacted than one to little. I suspect that the domain belongs to Stack Exchange, but how do I know without quite a bit of research? Stack Exchange is not the only company doing this, but they are a company, that should know better. If you send me a e-mail for something on stackexchange, use the same domain. – allo Apr 27 at 12:29
  • 1
    Yeah, the need from marketeers to collect information about where, when and if we click on things gets a bit of out of hand. You're not the first one to raise this concern. I'm personally indifferent about it but it is fair to raise this issue. I also recall a discussion from one of the SE devs that using a different domain improved security for some scenario's but that wasn't about the newsletter / notification emals f memory serves me right. – rene Apr 27 at 12:35
  • 4
    It'd probably be better if they used the actual SO domain. While SO.email may be owned by SE, it's not really a known domain, and <famous-website>.<different-TLD> is a pretty common way for people to fake affiliation. – TheWanderer Apr 27 at 13:20
  • 2
    @TheWanderer Using stackexchange.com or maybe stackoverflow.com without any subdomains would be a good start. Personally I would keep the links as plain as possible to avoid any confusion. And especially links with a different URL in the link text are a sign of phishing and even earn spam points in some spam filters. For tracking a small &from=email URL parameter would be okay and not looking like phishing. Be careful with using abbreviations, the domain so.email in your comment does not seem to be the same as stackoverflow.email. – allo Apr 27 at 14:31
  • Related on MSO: meta.stackoverflow.com/questions/382899/… – rene Apr 27 at 17:19
  • 1
    I think the explanation here is still correct: meta.stackoverflow.com/q/338332/4548692 – Catija Apr 27 at 18:46
  • 1
    Regardless of the domain used, the text should either be the exact URL or something descriptive, but never a different link. – isanae Apr 28 at 6:27
  • I don't see any problem here. Google also do it, Twitter also do it, it's a standard. And it's not third party email, it's 100% created by Stack Exchange developers. – Shadow The Coffee Wizard Apr 28 at 7:06
  • 1
    @ShadowWizard Why does being standard or common make something acceptable? – forest Apr 28 at 8:35
  • 1
    not an expert, but (or perhaps therefore) i wouldn't click it. additionally, given a link text with a valid address, expect copying that text into a browser to provide the exact same function. – ocæon Apr 28 at 15:48

You must log in to answer this question.

Browse other questions tagged .