Mailspring appears to insert borderline malicious links into emails

[maxf130]

Hi,

I don't use mailspring. I have however just received an email from a collegue who does (I think). The email contained a hyperlink to a hostname, let's call it original_hostname. However instead of it linking plainly to that address, it instead linked to: `link.getmailspring.com/link//0?redirect=original_hostname&

I'm assuming that this is mailspring's doing. Is this intended behaviour? Is this default behaviour? Is this something the user explicitly agrees to?

This looks like something I would expect in a phishing attempt. Had this email not come from a collegue, I probably would have dismissed it as such.

NB: After browsing the mailspring site, it looks like this is as a result of the link tracking feature, so I guess this is intentional. The other questions still remain however. Is this default behaviour? Is it something the user explicitly set up at some point? Did they decide: 'For this particular email I want link tracking'?

Max

[mitchazj]

Hey Max,

I use Mailspring, the link-tracking is entirely optional and I can turn it on/off whenever I want to 😄 The options are made very clear to new users in a guided walk-through when Mailspring is first installed - does that help?

[Burstaholic]

How? I was quite put off to discover this link mangling when trying out MailSpring at work - looked very unprofessional.

Edit: figured it out, by Googling. Quite a thing to be surprised by though.

[maxf130]

trying out MailSpring at work - looked very unprofessional.

This was mostly my concern to be honest. It made me question a legitimate email from a collegue, that's not an ideal situation. Actually, I would think link tracking like this to be inappropriate for anything other than a marketing email.

It certainly didn't reflect positively on Mailspring (hence the title). Had this been an email my collegue had sent to someone outside of the University, it would have reflected badly on the University.

As long as link tracking is not enabled by default, none of these are the fault of Mailspring, but rather the fault of my collegue in this case.

[eliocamp]

Is this default behaviour? Is it something the user explicitly set up at some point? Did they decide: 'For this particular email I want link tracking'?

Yes; probably not; probably not.

Link tracking is on by default and the option of disabling it is somewhat hidden when writing a new email and I don't find any toggle in Preferences. Most users probably don't make the conscious choice of tracking and in my experience, it can be annoying (especially if your mail was sent to a mailing list).

[maxf130]

Link tracking is on by default

If that is the case, that is not exactly ideal. Thanks for answering my questions.

I guess the ideal thing (at least from my point of view) would be for link tracking to be disabled by default. Maybe a confirmation dialogue everytime one sends and email with link tracking. Something like that.

[bengotow]

Hey folks! Thanks for reporting this—read receipts and link tracking are (for better or worse) one of the major selling points of using Mailspring over another email client. We enable them by default to ensure everyone that tries out the app gets introduced to them. I totally agree they're not appropriate for all scenarios—I actually don't use the link/open tracking features myself when I'm emailing with my friends.

During on-boarding, the app explains how to turn these features on and off (there's a flashing dot and a text bubble over the on/off switches in the composer), but I'll see if we can do a bit more to make it clear that you can (and should) decide whether you want them based on the kind of email you're sending. Thanks for the feedback!

[moeffju]

I would greatly appreciate a global toggle. I rarely if ever want this feature to be on; if at all, it should be opt-in for specific emails.