790532 - Visually mark links in emails where displayed HTTP address != actual HTTP address

Status: UNCONFIRMED

(MailNews Core :: Backend, defect)

Description

[clemens]

Attachment: The fishing email as .eml in a ZIP file

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

Steps to reproduce:

I received an email in which Thunderbird displayed this text excerpt:

### PASTE START ###
I’d like to keep in touch and see if Confio could be of help in the future. For now, you can get the freeware version of Ignite at www.ignitefree.com, and let me know if you have any questions.
### PASTE END ###

Copying the link location reveal this:

### PASTE START ###
http://mkto-f0116.com/track?type=click&enid=bWFpbGluZ2lkPWNvbmZpb0JldGFjdXN0LTIwNjktNzQ4Ni0wLTEzMzYtcHJvZC0yMzI2Jm1lc3NhZ2VpZD0wJmRhdGFiYXNlaWQ9MjMyNiZzZXJpYWw9MTI2NTI2MzE5NSZlbWFpbGlkPWNsZW1lbnNAZnJvZ2xvZ2ljLmNvbSZ1c2VyaWQ9Njc2OTc5LTEmZXh0cmE9JiYm&&&http://www.ignitefree.com?mkt_tok=3RkMMJWWfF9wsRoku6rAZKXonjHpfsX%2B7OokXq6g38431UFwdcjKPmjr1YICT8R0dvycMRAVFZl5nQ9XFOaccw%3D%3D
### PASTE END ###



Actual results:

Thunderbird displays the "bogus" link without any warning and leaves it up to the user to realize that it is a fishing link.

The email did not get marked as a fishing or spam email.



Expected results:

Thunderbird should display the "bogus" link with a very prominent warning and not allow to open the link without yet another security reminder (to avoid accidentally clicking on the link, too!).

The email should get marked as a fishing or spam email.

The definition of a fishing link is debatable I guess. While the above seems like an "indirect" link with the "target" information contained in it, like it is often provided on the internet (last but not least in Google results), it would be safer to mark all of these as possibly bogus and dangerous rather than to be sorry once the damage is done.

And for non fishing users it should typically be possible to provide links that do not have this kind of suspicious indirection.

Comment 1

[Ludovic Hirlimann [:Usul]]

Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.

Comment 2

[clemens]

A bit sad that such a phishing/security/privacy related issue gets no attention. Perhaps kill Thunderbird (or donate, for example to Apache Foundation) instead of hibernating it like you did in the past years.