Slashdot Mirror

I'm surprised the author didn't link to the actual services:

• ReadNotify FAQ - doesn't seem to give too much actual info on how it works, but looks like it's a combination of images hosted on the ReadNotify server with tracked downloads, rewritten links to go through ReadNotify servers to add log entries, and some other things I couldn't guess immediately.
• MessageTag seems to just be an image hosting service which tracks image downloads.

Both seem to be easily defeated; indeed, the ReadNotify FAQ mentions that the "invisible" tracking service (which I assume means that it just includes the tracking images in the message) may be unreliable.

I actually watched the C-SPAN hearings on replay last Saturday (stop looking at me) and they didn't use such a simple technique as an embedded gif in an HTML mail.

They used this company right here. The particular technology that they use is an embedded tracker in a PDF attachment that contains the text the victim wants to see.

This neatly gets around people with email clients that block loading of remote images, or even people who don't allow html mail. (How many people actually have Acrobat Reader blocked from internet access? Damn few I would think.)

I actually watched the C-SPAN hearings on replay last Saturday (stop looking at me) and they didn't use such a simple technique as an embedded gif in an HTML mail.

They used this company right here. The particular technology that they use is an embedded tracker in a PDF attachment that contains the text the victim wants to see.

This neatly gets around people with email clients that block loading of remote images, or even people who don't allow html mail. (How many people actually have Acrobat Reader blocked from internet access? Damn few I would think.)

Or better yet, an embedded <img> tag (or something similar) that is just like what the spammers use for tracking valid email addresses. There are several companies that offer this technology to consumers. Problem is, it doesn't work if you use a mail client capable of blocking "remote" images (which is a feature even webmail providers are starting to offer.

There is another company that claims to do this, ReadNotify.

It looks to be exactly the same kind of service as Didtheyreadit.com.

I first became aware of this company by reading Mozilla's bug report 28327 - http://bugzilla.mozilla.org/show_bug.cgi?id=28327 (cut/paste URL and open in new window).

Mozilla/Thunderbird also has trouble completely blocking all server contact in email, as it evidently doesn't sandbox the email environment enough (images may be blocked, but stylesheets and other external URL's can still leak through, last I checked).

BTW, there is a workaround if you use Mozilla/Thunderbird: set your View/Message Body As settings to "Simple HTML", or better yet, "Plain Text". This works 100%!

One would create a detached signature of the document and mail it to the server (or perhaps the whole signed/encrypted document). The server would sign whatever you sent, then send that back to you.

You could then verify that you signed the document (possibly implying that you wrote it), and then verify the date in which you did so.

I don't know what happend to the service, but there's a for-pay service which is similar. Check out this place.

Or better yet, use a timestamp server.