iOS zero-day let SolarWinds hackers compromise fully updated iPhones
The big takeaway I have here is that security is a balance between usability and safety. In this case by having malicious links that were obfuscated (behind HTML?) to appear as legitimate LinkedIn links, the target clicking them was compromised.<p>If mail clients were to open a modal for each link and say "Are you sure you want to go to <a href="https://LinkMeIn.com/totally-legit?email=victim123@gmail.com" rel="nofollow">https://LinkMeIn.com/totally-legit?email=victim123@gmail.com</a>" would this cut down on these attacks?<p>Taking the idea too far: A system like this would probably link to some sort of cloud database eventually to catch "emerging threats" (novel URLs that look malicious) but then would that in turn threaten end-to-end encryption of email by sending links in emails to a cloud tracker?