Why does Microsoft block .url attachments and not .htm in Outlook?

Question

Outlook by default blocks .url attachments and not .htm – why?

Any dangerous URL that could be in .url file, could also easily be in a .htm file and could be launched using javascript automatically. I see the same risk with both attachments, but Microsoft treats it differently. Am I missing something here? How is a .htm file safer than .url?

What else could be in .url file that a hacker could not put in .htm file?

Answer 1

You can disable scripts and redirects through browser security settings if you desire to do so.

You'd need to disable .url file support completely for some protection against those.