Testing didtheyreadit.com's Mail-Tracking Claims

iosdaemon writes "didtheyreadit.com claims to be able to track your sent email: "When, exactly, your email was opened. How long your email remained opened. Where, geographically, your email was viewed. DidTheyReadIt works with every single internet provider and e-mail account, including EarthLink, AOL, NetZero, Juno, Netscape, Hotmail, Yahoo, and much more." Read on for more. "This appears to be snake oil. I put it to test just in case someone had come up with some magical code. I sent email from a Yahoo.com account through the service, to an account on a Linux Box. Running tcpdump, I received the email from my pop and let 5 minutes pass before opening it. I left the message open with the cursor in the text for another 5 minutes. Tcpdump revealed absolutely no questionable traffic. And, the service control panel indicated the email had not been viewed. Sending email to a Yahoo.com account results in a 'read' in the service CP. But I had the message open for 10 minutes, and it indicated a 2-minute read......"

The company's "How it works" page explains the system to some degree; it involves redirecting all mail to be tracked through their servers by appending "didtheyreadit.com" to your recipient's email address. I doubt this is mutt-compatible ... Reader xrxzzy points out USAToday's article on the service as well.

Comments

Uh, the link is wrong

[Anonymous Coward]

it needs a http:

Re:Uh, the link is wrong

[Shivantrill]

If you are using IE, it will go right to the webpage. The poster must have been using windows

Re:Uh, the link is wrong

[SuperficialRhyme]

Strange. The links work for me with Mozilla Firefox 0.8 (unless they've been corrected already and I missed the time they didn't work).

Re:Uh, the link is wrong

[Anonymous Coward]

they got corrected

Re:Uh, the link is wrong

[J'raxis]

The browser should take the scheme from the context of the current URL. This is valid according to the definition of a URL in the RFC.

You know that a URL like /foo/bar is evaluated relative to the current server, right? Well, something like //www.foo.com/bar is evaluated relative to the current scheme, i.e., http.

Re:Uh, the link is wrong

[Anonymous Coward]

thete aren't the 2 slashes though, it'd just be href="www.yahoo.com" and that means www.yahoo.com/ as it should.

Link doesn't work

[fatwreckfan]

Here's a working link: http://www.didtheyreadit.com/.

Re:Link doesn't work

[fatwreckfan]

Obviously fixed.

Re:Link doesn't work

[Anonymous Coward]

i can't believe the poster was stupid enough to
break out tcpdump to test this garbage

jesus

Re:Link doesn't work

[Anonymous Coward]

remember how slashdot now runs a few advertisements a day as 'stories'?
i seem to remember this fact more and more often lately....

How it 'works'

[ZiZ]

This is nothing more than off-site image tracking, as has been seen in spam for ages and ages. Here's an example of the image it adds:

<img src="http://didtheyreadit.com/index.php/worker?cod e=2f985e815bd2b46450e 07957611ab6c9" width="1" height="1" /> So not only will it not work in text-based email clients (such as mutt), it won't work in modern versions of Outlook which block inline images by default. (It was nice enough to leave my plain-old-text message - "blah blah blah" - alone in the original format, as well as adding a text/html mangled version.)

Re:How it 'works'

[agm]

Evolution has this feature as well. I'm sure anyone internet savvy and aware of the spam problem would have a mail reader that prevents remote images from being displayed - which renders this service useless.

Re:How it 'works'

[amembleton]

From the 'How It Works' page: Will my recipient know that I am tagging my e-mail?
No. Not unless you want them to know.

As I suspected, they are just using a tracking image, sometimes I look at the source of messages (sad, I know), then I would know if I was being tracked. That saves me opening an account to see how they were going to do this.

I always view my email as Plain Text using Mozilla, so this wouldn't work unless I decided to switch back to HTML. I made some of these tracking images once and tried it out. I found that browsers were cacheing them, so it wouldn't always register if it was viewed in a webmail acount.

Re:How it 'works'

[jacobdp]

This is nothing more than off-site image tracking, as has been seen in spam for ages and ages.

And yet they claim that there's no way the recipient can know that the message is being tracked (see their FAQ) It may not be complete snake oil, but the company is definitely lying about the service's transparency.

And they route all your mail through their servers. I wouldn't be surprised if they soon started selling "pre-confirmed" email address lists.

Re:How it 'works'

[RotJ]

Yahoo! and Hotmail also allow people to block all images until they explicitly approve them, so spammers can't track whether you've opened their spam. Didtheyreadit won't be able to either. So tracking for this service will be very spotty. For messages marked unread, you can NEVER know whether it was opened or not.

Re:How it 'works'

[LiquidCoooled]

I agree with the not switching back to HTML.

But on their site, they indicate the tracking facilities are partially performed by modifying the Recipients mail address before its sent - they nicely show it using hotmail, and the common free mail providers are obviously their targets for this.

they say to track the mails, for each person you want to track, instead of sending to username@hotmail.com, you send it to username@hotmail.com.didtheyreadit.com

This then allows their server to know when the mail was downloaded by the user without having to rely on images.

I dont think I'm gonna be using this anytime soon, but I can think of a few paranoid contacts who might want to.

Re:How it 'works'

[amembleton]

This then allows their server to know when the mail was downloaded by the user without having to rely on images.

Unfortunatelly, I don't think it works like that. Their server will then send it to the users' server, or the mail server of their ISP or the mail sever of a webmail account such as Yahoo!, Gmail or Hotmail. Their server will send the message straight away, without any delay. The end user does not download the message from didtheyreadit.com sever, they download it from their usuall Yahoo! SMTP server or whatever their usuall mail server is.

Re:How it 'works'

[tigress]

Uhh, no. The recipient "downloads" their mail from their ISPs mailserver. There's nothing didtheyreadit.com can do to change that. What the extra ".didtheyreadit.com" does is simply being an email adress that forwards the mail to the recipients server, and adding a tracking-image to the mail.

Of course, if you don't believe me, please feel free to call my free 1-800 number and I'll explain it further. I promise not to redirect your call to an international $9.95/min number.

Re:How it 'works'

[alder]

...unless I decided to switch back to HTML.

Then you'll go to Tools -- Options... -- Advanced -- Privacy and make sure that "Block loading of remote images in mail messages" is checked. You'll gain nicely formatted messages (with images even if they are embedded) yet all remote images, that can track you, will be ignored.

Re:How it 'works'

[BuckaBooBob]

Not to mention if you have didtheyreadit.com in your hostfile with your loopback.

Re:How it 'works'

[Anonymous Coward]

"didtheyreadit.com claims to be able to track your sent email (if you use HTML mail): "When, exactly, your email was opened (if your e-mail programs loads offsite pictures by default). How long your email remained opened (again, if you're using HTML mail). Where, geographically, your email was viewed (assuming that the reverse DNS lookup will be anywhere near accurate, mine was 2000 miles away). DidTheyReadIt works with every single internet provider and e-mail account (assuming that they all have HTML mail enabled by default, which they don't), including EarthLink, AOL, NetZero, Juno, Netscape, Hotmail, Yahoo, and much more."

Re:How it 'works'

[LiquidCoooled]

Oh my, I seem to be shooting myself in the foot at the moment with things. Maybe having a break from work wasn't the best thing for me ;)
Anyway, I'm back in tomorrow lol

Of course you and your peer are absolutely right, the mail address changes are so they can inject the code in.

*runs off looking sheepish*

Re:How it 'works'

[eSavior]

Mozilla Thunderbird has the same feature, 1.tools->options...->advanced->privacy 2.check "Block loading of remote images in mail messages." 3.press okay

Re:How it 'works'

[Christianfreak]

Thunderbird at least (probably in Mozilla as well) has an option to turn off remotely loaded images. So you can keep the HTML formating if you so desire without worrying about being tracked in this fashion.

Re:How it 'works'

[Anonymous Coward]

This then allows their server to know when the mail was downloaded by the user without having to rely on images.

Nice reading comprehension there, Chief. Do you really think people are going to go to a different server for their mail?

Re:How it 'works'

[Anonymous Coward]

Image tracking works even for people who have caching browsers if there is a ? in the IMG SRC tag, since the IE that comes with XP will query the server to see if the image has changed every time they re-open the email with the tracking image. I've had really good luck with such tracking myself (I use it mainly when emailing girls to see if they're brushing me off or just not reading their email); the only main mass-market email client that it doesn't work with is AOL.

Basically, this is a version of good 'ole image tracking for the masses. Too bad, too, since such tricks will stop working if enough non-geeks use services like this.

Re:How it 'works'

[feargal]

This then allows their server to know when the mail was downloaded by the user without having to rely on images.

Bollocks. Complete and utter bollocks.

Neither you or the moderator who considered this to be insightful have any idea what you're talking about; you clearly were taken in by their marketing material.

When you tack their domain onto the end of the recipient's address the email is delivered to their servers. This allows them to tack on whatever insidious webbug they want to the email, and possibly mine your email for marketing information while they are at it.

The email is then delivered onto the recipient's mailserver, just as if you had sent it directly.

Once it accepts it, they have absolutely no fucking way of knowing what that mailserver does with it. When the user downloads it, they will not receive any special gilt-edged notification of the event which you would normally be denied.

The only trick they rely on is the images thing.

Any claims otherwise are complete and utter lies.

In case I wasn't clear enough, bollocks.

Re:How it 'works'

[dbirchall]

This is nothing more than off-site image tracking, as has been seen in spam for ages and ages.

And, of course, in legitimate email newsletters and such, from lots of entities that actually have to track their ROI on such things. I used 'em about 4-5 years ago when I was doing web dev and DB marketing for a travel dot-com. If someone was signed up for our fare alerts or whatever, they'd get mail with a tag in it; if they clicked through to our site, that tag got tracked as a referrer, and passed along to the e-commerce part. Made it a LOT easier to say to the marketers "yeah, we sent X messages, Y people clicked through, Z people bought, and here's the top-line revenue for this particular fare promo."

This is just to clarify that it's the spam that's evil, not the image tags themselves. ;)

Re:How it 'works'

[Jane_Dozey]

And I suppose, assuming that you don't just download your email and read it while you're offline. All they could really confirm is that the email was delivered.

Re:How it 'works'

[amembleton]

Don't worry, we all have those days. And, I called it an SMTP server when it should have been a POP, ah well.

Re:How it 'works'

[Anonymous Coward]

note mozilla is currently defaulting to load remote images - much to my pissed off ness

Re:How it 'works'

[LiquidCoooled]

Thanks.

I think we already cleared that up about half an hour before you posted.

I KNOW I was wrong, I have been moderated down as such.

Re:How it 'works'

[JanneM]

So does Evolution, by default. The webmail I have for one of my addresses does too. And apparently, so will the next version of Outlook, effectively killing this service.

Re:How it 'works'

[amembleton]

Thunderbird at least (probably in Mozilla as well) has an option to turn off remotely loaded images. So you can keep the HTML formating if you so desire without worrying about being tracked in this fashion.

I can't find such an option in Mozilla. I've googled around but can't find anything on it. Maybe its time for me to switch to Firefox & Thunderbird.

Re:How it 'works'

[antic]

A typical user would not know that a web bug was in place and the typical users are exactly who they're trying to get to buy into the service.

You and I might ignore their attempts, but there are a hell of a lot of people out there who would like the sales pitch, the 5 free samples/tests and spend the money to use the service. For the most part, they'll be emailing people without mutt and the service may just work (more or less) as described.

Where I would have an issue is with the small percentage of emails that they can't track due to clients forcing text only mail. If a user was to build a strong reliance on this service, they would only assume that the receiver had never even read their email when in actual fact they could've opened it in a text-only client and pored over it for days!

And the privacy issues are astounding -- they would essentially get every copy of email sent through their system -- personal information and details, etc. If you care enough about the information you're sending to want to know if the receivee will read it, then you can bet that this company may care enough about the content too...

Re:How it 'works'

[Anonymous Coward]

For turning off remotely loaded images in mozilla (seamonkey) go to preferences.
in Privacy & security go to images
In the Image Acceptance Policy box you have a checkbox for : "Do not load remote image in Mails & and newsgroups messages"
At least in moz 1.6
Yes it's not a really good place
By the way the Accept images that come from the originating sever only (just above) is quite a good ad filter

Re:How it 'works'

[orthogonal]

So not only will it not work in text-based email clients (such as mutt), it won't work in modern versions of Outlook which block inline images by default

Let's be even more sensible: your firewall rules should allow your email client to make connections to your mail server ONLY, and only to its ports 110 and 25 (I'm assuming POP3; IMAP would be other orts).

(Not for linux users: Microsoft Windows firewalls typically allow setting rules separately for separate applications, by associating a process name (and in serious firewalls, the executable's MD5 sum) with the process requesting the connection.)

This takes care of all web bugs, inline images, and javascript pop-ups or Active-x in Microsoft HTML email.

Note that with any sensible email client, this won't block html links, as clicking an html link should invoke a separate browser application, with its own firewall rules.

It will block linked (not inline) images, but only a very small minority of email linked images that are at all useful to view -- in this case I just save the email as html and open in a web browser.

Re:How it 'works'

[darkonc]

I can't find such an option in Mozilla.

Edit ->
Preferences ->
Privacy & Security ->
Images ->
[checkbox] Do not load remote images in Mail and Newsgroup messages

It's probably the fact that it's under 'Privacy and Security', rather than 'Mail and news' that threw you.

Re:How it 'works'

[Anonymous Coward]

Yeah, I noticed the same kind of thing in some recruiter spam sent via this service:
"Track your emails with our proprietary email "beacon" which tells you if your clients have looked at your emails!"

Re:How it 'works'

[jerw134]

Outlook 2003 already has this feature.

Re:How it 'works'

[Anonymous Coward]

Yeah - there is a company advertising on the radio called "bigstring" and they claim to not only be able to tell you when and where your email was read but also the following:

* Prevent other's from getting a copy of it.
* Prevent it from being printed.
* Delete it entirely, even after it has been read.

They use the claim that "it's like having a big string tied onto the envelope that you can yank back whenever you like".

Of course, anyone with even the most rudimentary knowledge of mail protocols knows this is rubbish. Aside from there being no way to accomplish this with the SMTP protocol, there isn't a single way they could prevent a POP user from retaining a copy forever.

Having never looked into the company, I can't think of anyway they could accomplish the things claimed unless they require that you and the recipient use *their* mailservers, *through* webmail only and disable forwarding *and* convert all text into an image to prevent copy & paste. Of course, then you could just save the image(s) or take a screenshot in the most dire situations.

It's unfortunate that company's like this are defrauding joe-average-user with hyperbole and propoganda.

Re:How it 'works'

[Anonymous Coward]

reminds me of a compnay that i worked for that turned off the ability in outlook to NOT send reply receipts. i never understood the rational behind it.

Re:How it 'works'

[Seumas]

(reposted, non-anonymously -- oops!)

Yeah - there is a company advertising on the radio called "bigstring" and they claim to not only be able to tell you when and where your email was read but also the following:

* Prevent other's from getting a copy of it.
* Prevent it from being printed.
* Delete it entirely, even after it has been read.

They use the claim that "it's like having a big string tied onto the envelope that you can yank back whenever you like".

Of course, anyone with even the most rudimentary knowledge of mail protocols knows this is rubbish. Aside from there being no way to accomplish this with the SMTP protocol, there isn't a single way they could prevent a POP user from retaining a copy forever.

Having never looked into the company, I can't think of anyway they could accomplish the things claimed unless they require that you and the recipient use *their* mailservers, *through* webmail only and disable forwarding *and* convert all text into an image to prevent copy & paste. Of course, then you could just save the image(s) or take a screenshot in the most dire situations.

It's unfortunate that company's like this are defrauding joe-average-user with hyperbole and propoganda.

Re:How it 'works'

[photon317]

And offsite imagine tracking is definitely not going to work for recipients like me, who use Mozilla Thunderbird and picked the config option "Block loading of remote images in mail messages".

Re:How it 'works'

[Yjerkle]

From the 'How It Works' page: Will my recipient know that I am tagging my e-mail?
No. Not unless you want them to know.

As I suspected, they are just using a tracking image, sometimes I look at the source of messages (sad, I know), then I would know if I was being tracked.

Or if you use OSX's Mail.app, and turn off auto loading images. Then you get a nice blue bar across the top of the message saying "This message contains unloaded images." If I saw this, and could only find one pixel of gray placeholder (or couldn't find it at all, since it's too small), I think I'd be suspicious.

Re:How it 'works'

[thrillseeker]

Mozilla Thunderbird has the same feature

Mozilla-Thunderbird needs to make their version more like Evolution's, which has the option of allowing inline images from addresses you have put into your address book.

Re:How it 'works'

[ciggieposeur]

I found that browsers were cacheing them, so it wouldn't always register if it was viewed in a webmail acount.

PATENT ALERT

I am about to describe a patented technique. Seriously. If you ever think you're going to implement a web bug, do not read this or IBM will be able to sue you for treble damages.

Since a) I no longer work for IBM, and b) the method is on file in the patent, I am not violating my IP contract with IBM by describing this method.

.
.
.

PATENT ALERT

.
.
.

Method:

The way to defeat browser caching is to make the IMG SRC point to a CGI that returns a REDIRECT (302) that points to the single-pixel image. So you might have IMG SRC="server/path/to/cgi?key1=val1&key2=val2". The browser will have to tick the CGI because it has "dynamic" parameters. However, the CGI has to return a REDIRECT because an intelligent proxy server in the middle might be trying to cache the output too. You don't care if the single-pixel image itself is cached, you just want to capture the CGI hit with all the parameters.

Re:How it 'works'

[jonadab]

You're assuming he would prefer to view the message HTML-formatted rather than
in plaintext, which for most users who know the difference is not the case.

Viewing in plain text has the advantage of providing a consistent look and
feel for every message, always using the reader's preference for fonts and
colors, among other things. (There are a few exceptions, but most people
prefer the fonts and colors *they* like over the ones other people want them
to see, except in special circumstances such as when having a discussion
about fonts and colors.)

It's all moot for me; I use Gnus. Currently I have it set to only display
text/plain parts and show anything else as an attachment, which I can save
and view if I choose. This means HTML mail has the From and Subject fields
to convince me it's not spam. It's been years since I received an HTML
message that wasn't spam, incidentally, and I get a *lot* of mail. I do
sometimes receive multipart/alternative messages that aren't spam, but the
plain text part always shows fine in that case.

I *could* configure Gnus to display HTML parts, using W3, or to launch a
browser, such as Mozilla, but I choose not to configure it that way because
I prefer to view the plaintext alternative, and like I said it's been years
since I received an HTML-only message that wasn't unsolicited bulkmail.

Back to topic, the didtheygetit.com claim that the service works regardless
of what client the recipient uses is obviously not only bogus for their
specific product but in fact a totally impossible thing for any product to
deliver, unless the content is munged into a form that they are *unable*
to view without alerting you, such as an executable that unencrypts and
displays the text after phoning home -- but something like that would be so
odious to so many recipients that the sender would by using it be decreasing
significantly the chances that the message would be read at all, which would
rather defeat the purpose of the whole idea. In other words, it's an utterly
impossible thing to deliver. OTOH, they only claim it works in 98% of cases
and carefully qualify this saying "in our testing", which presumably means
they didn't test with geeks who use carefully selected high-quality mail
readers; they probably tested mostly with Outlook, two or three popular
webmail services, and maybe Eudora or Netscape. I can positively guarantee
that it would never work with Pegasus Mail (though pmail *does* support read
receipts, but only if the user has turned them on in the prefs; they're
off by default), and obviously it doesn't work with my particular config
of Gnus. (I don't know about a default Gnus config, but that's largely not
a significant issue since people who leave settings at their defaults don't
tend to use Gnus in the first place; it's very much geared toward people
who like to change lots of options.) Clearly it also wouldn't work with
mutt or pine or anything like that, and *obviously* it wouldn't work if
the user talks to the POP3 server directly (which I happen to have just
done yesterday, though I only looked at three or four messages that way,
and I'm atypical, being the maintainer of the Net::Server::POP3 module).

I can imagine that it might be useful to some people nonetheless, especially
in a largely homogenous corporate environment wherein it is predictable what
mail client everyone or almost everyone uses. But clearly they're very much
exaggerating (at best) when they claim it works irrespective of the client.

Re:How it 'works'

[scott_evil]

Evolution isn't exactly a stellar email client. How long has it taken to get a function to add return receipts? That's just lazy...

Re:How it 'works'

[wanion]

I don't know about there, but here in New Zealand if someone redirected your call to a $9.95/min number then they would be paying for the cost of that call. Is it different where you are? I just can't see the advantage of costing yourself that much money over this.

Re:How it 'works'

[localhost00]

The way to defeat browser caching is to make the IMG SRC point to a CGI that returns a REDIRECT (302) that points to the single-pixel image. So you might have IMG SRC="server/path/to/cgi?key1=val1&key2=val2". The browser will have to tick the CGI because it has "dynamic" parameters. However, the CGI has to return a REDIRECT because an intelligent proxy server in the middle might be trying to cache the output too. You don't care if the single-pixel image itself is cached, you just want to capture the CGI hit with all the parameters.

Go.com web-email actually throws in an extra parameter, like &r=[some random integer], to each link as a way to get around cache.

Re:How it 'works'

[Sancho]

What are you talking about? This situation is much less snake-oil than the original poster.
It's not a stretch at all to think that they store the text on their server and then send an email including scripting to get that text from their server. That's really the only way I can see that you could make these claims, particularly for "every major mail reader on the market" and "including handhelds". It's actually somewhat more secure this way, too, in that if you are using a mail reader that can't execute scripts, you just can't see the email.
Of course, as you point out, saving a screenshot clearly would work, even if the scripting managed to prevent highlighting the text in order to copy it. Of course, so would opening a text editor and retyping the entire message while you're looking at it. It's silly to claim that you can prevent someone from copying anything these days, but this is enough probably stop your average user from making a copy (how many business majors know that you can make a screenshot in windows?)

Re:How it 'works'

[platipusrc]

I personally like the option in kmail to display all email as plain text. If the email is in html, there is a link right above the message that allows you to view the message as html if you trust the sender. I'm sure the other graphical email readers such as evolution and thunderbird support that, but I haven't really used them.

Note: This is an HTML message. For security reasons, only the raw HTML code is shown. If you trust the sender of this message then you can activate formatted HTML display for this message by clicking here.

Re:How it 'works'

[deranged unix nut]

I knew there was a reason why I still use pine to read my email. :)

Keep software simple!

Re:How it 'works'

[Spacejock]

"Works with all email programs" they say. Bullshit. My email program filters HTML out and displays all inbound mail as plain text. I'd love to see them get around that with this trickery.

By the way, I've seen this stuff before. Before I wrote my email app I started getting regular, everyday emails with little images of postage stamps in them. (About 12-14 months ago) They were also there to confirm receipt of delivery, and since Outlook Express had no way to switch off remote image loading, I switched off Outlook Express.

Re:How it 'works'

[jonadab]

> Their server will then send it to the users' server

Additionally, even the recipient's mail server (at the recipient's ISP,
usually) does not know when (or if) the recipient reads the message. Well,
maybe with IMAP, but not with POP3. The protocol really only handles
retrieval, and almost all mail clients just retrieve all the messages in
batch, and the user can read them whenever: right away, minutes later,
months later, whenever. There is no provision in the POP3 protocol (or
AFAIK any of the various extensions, most of which are in any case not
supported by most servers and many of which are also not supported by most
clients) for the server to be contacted when this happens. I've personally
implemented the server side of the POP3 protocol and can attest that there
is no provision for this.

So even the user's own ISP's mail server only knows when the user's computer
retrieves the message, not when it's read.

The only way the service could work, then, is if the client does something
to let the service know that the message has been read. That absolutely
requires support from the client, support MOST mail clients do not provide.
I imagine they're relying on a feature that is common to Outlook and the
most popular webmail services, but in any case the "works regardless of mail
cient" claim is obviously without any merit.

Re:How it 'works'

[jonadab]

> Where I would have an issue is with the small percentage of emails that they
> can't track due to clients forcing text only mail. If a user was to build a
> strong reliance on this service, they would only assume that the receiver had
> never even read their email when in actual fact they could've opened it in a
> text-only client and pored over it for days!

One imagines the user (if _remotely_ clueful) would be divested of this
misunderstanding after receiving replies to messages that ostensibly were not
read. If they correspond with anyone who's even a little bit choosy about
software, this would happen sooner rather than later. However, if *everyone*
they know uses Outlook or webmail, I can see that some users might remain
unaware for quite some time.

Re:How it 'works'

[MarkGriz]

No need to render it useless. The service seems pretty useless all by itself.

Re:How it 'works'

[amembleton]

Thanks!

I can't believe I haven't found that before!

Re:How it 'works'

[LordHedgehog]

Worth pointing out that my SpamAssassin settings give considerable weight to image trackers. I doubt I'm alone in bumping that test up.

If anyone hear tries to send me a DidTheyReadIt e-mail, be forewarned that not only will my mail client not display inline images, but it'll probably fall in the bit bucket as spam.

Re:How it 'works'

[jonadab]

> For messages marked unread, you can NEVER know whether it was opened or not.

Whether it's marked read or unread is totally irrelevant; the only issue at
stake is whether the recipient's mail client does something that contacts
something on the sender's (or tracking service's) side, such as load linked
remote content. If the client does do that, and then the user marks the
message as unread, the sender will still think they read it. OTOH, if the
client doesn't do anything like that (as most don't), then the user can read
it, mark it as read, print a hard copy, copy and paste the contents into a
weblog, and discuss it on a major mailing list (say, perl6-language), and
the sender has no way to know (unless he visits the recipient's house and
looks in his mailbox, digs through the trash and finds the hard copy, or
reads the weblog or the mailing list).

Re:How it 'works'

[mobets]

Now if only I counld set a list of address that is is ok to get remote pictures for. Outlook can do this. Why not Thunderbird?

Re:How it 'works'

[lrucker]

it won't work in modern versions of Outlook which block inline images by default

Or OS X 10.3 Mail.app - if mail has images, it tells you; you have to choose to load them for each message. There is no option to automatically load them.

Re:How it 'works'

[Cruciform]

there's an annoying bug in the blocking feature on Hotmail.

If you have exclusive settings, and a mail you want gets put in the junk folder, opening that email while in the junk folder, then deleting it when you're done opens the next mail in the folder... and loads the images. I ended up verifying my address to some asshole drug/sex company because of this.

Oh well, their shit will still never make it to my inbox. I only have 3 addresses whitelisted for that account.

Re:How it 'works'

[antic]

Very true, but this company is hardly going to complain if they can get a $49.95 subscription out of these people before they realise that particular short-coming...

I give them credit for the "idea" and definitely the implemention (adding ".didtheyreadit" to the end of a standard email address), so best of luck to them.

And they certainly have achieved fantastic press with this slashdot exposure: suddenly a large group of people know the name, what it does, how it works and how much it costs...

Re:How it 'works'

[Anonymous Coward]

I've had really good luck with such tracking myself (I use it mainly when emailing girls to see if they're brushing me off or just not reading their email);

I'm sure they're brushing you off. Really, that's sad. That your primary connection with girls is via email pretty much says it all. That you use webbugs to spy on them says the rest.

Re:How it 'works'

[letxa2000]

And they certainly have achieved fantastic press with this slashdot exposure: suddenly a large group of people know the name, what it does, how it works and how much it costs...

... And an SMTP server(s) that we can add to our "denied hosts" file to filter all incoming crap from them. If someone cares enough to add a webbug to their emails to violate my privacy, I care enough to filter them.

Re:How it 'works'

[johnnyb]

The only problem with this is that it encourages people to include images already attached - meaning spammers will send images WITH their emails, causing even more bandwidth to be lost even if you don't open it. With remote images, you get the advantage of only sending the images to people who care.

Re:How it 'works'

[Seumas]

I was specifically speaking to the claims of the company I have heard on the radio as I quoted in my post. That is, a company that not only claims to tell you the information the original article's company does - but to allow you to also have full control over your message. Meaning that you could delete the email and any attachments from all mankind with a simple keystroke - which is clearly fraudulent and absurd.

The company is called BigString.com and they claim their email is:

* recallable
* erasable
* changeable
* allow time delay of sending emails
* time out of sent emails
* report of when your messages are opened
* the ability to only alow images to be viewed once and not allowed to be forwarded
* ability to prevent messages from being printed
* ability to prevent messages from being saved

I have not researched the company because it is either entirely bullshit or proprietary as I can clearly access any email, save it and then do whatever I want with it - BigString be damned.

The only way I can see this working is if the sender has to hav an account on their server and the recipient has to have an account on their server and then they employ some form of scripting with custom external (non mailstore) storage of messages and images tied together with a key or webbug/htmlbug.

If you ask me, these claims and offerings are far above and beyond that of the USA Today article or this Slashdot article.

They also claim that the technology is "patent-pending" and that sending email is the same as any regular email.

Bigstring is the sole provider of fully Erasable-Recallable Email. Pioneering the field with our unique patent-pending technology, we empower our users with the ability to take control of their email. The best part is that it is easy to use - in fact there is no difference from regular email.
Three years ago, the Bigstring founders set out to build the best Spam fighting email system on the planet, and then, quite by accident, they invented the world's first fully erasable email and didn't even realize it. A few months ago, one of the founders, Darin, sent an important new client an email with the wrong attachment. Upset, he asked his partners if there was any way that you could recall an email; the immediate answer was "No"!!! Then, Dave scratched his head... and said, "Well, if we modify the new system just a little, you can erase your mail, edit it, change attachments, set it to expire at a certain time and even know when it's been read." Darin said, "So, it's like you have a big string on your email and pull it back"...and Bigstring was born.

Re:How it 'works'

[imroy]

Or you could just arrange to send a Cache-Control: no-cache header. Seriously dude, just read RFC 2616 (HTTP/1.1) and do a search for "no-cache". No need to redirect and waste an HTTP request. And if you don't want the overhead of CGI, just use mod_asis on Apache to send precisely the headers you want.

Re:How it 'works'

[jburroug]

(how many business majors know that you can make a screenshot in windows?)

/me raises hand

Ahem. I happen to have a BBA in Management. I know how to take screen shots under Windows. You just hit "printscreen" and paste, though I prefer to use a nifty little utility called "ScreenHunter" Of course the only time I need to take screenshots in windows is at work, since that's the only time I ever use windows. I'm typing this message in Mozilla, on a Linux box, running GNUStep (nee Window Maker) for my window manager, with xinerama running for dual displays. If someone sent me email through didtheyreadit it wouldn't track me because I use PINE as my MUA, running directly on the FreeBSD server that runs my domain, acerbic.org. The last time I took a screenshot on this setup I used The Gimp to capture VNC screens on an XP box I'd setup for a client to digitize images pulled off an analog MRI unit. I was documenting the system for him.

Don't assume that every business major out there is some noob that couldn't hack it in CS. I chose to major in business because I knew I could learn the tech stuff I wanted to on my own, but for the finer points of business and economics I wanted a formal education in. In fact my first job out of college was as a Unix SysAdmin for an ISP, after that I worked as IT manager for a cancer clinic. A couple of months ago I got out of hands on tech work to take a job as an account manager at an ASP - I wanted a change of pace.

Just like the mythical geek girls and liberty defending geek lawyers there exist geek 'suits' as well, some with more techie experience than most of the posters on /. I get sick of hearing the standard lines reffering to business majors as technological retards spouted off by slashdotters whose only claim to geeks status is using kazaa-lite to download bad music off the 'net. Not that I'm implying that you fall into this catagory, or that you were specifically attacking me or anything, I'm just tired of hearing how dumb business majors are.

Re:How it 'works'

[Anonymous Coward]

So in your case, DidTheyReadIt will work correctly.

Re:How it 'works'

[imroy]

Not for linux users: Microsoft Windows firewalls typically allow setting rules separately for separate applications, by associating a process name (and in serious firewalls, the executable's MD5 sum) with the process requesting the connection.

You almost had me there. How can a firewall know which program is sending the packets?. Of course, you're talking about a software firewall, running on the same machine. Ho hum, us little Linux hippies have something similar ;)

From the iptables(8) man page:

owner
This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping responses) may have no owner, and hence never match.

--uid-owner userid
Matches if the packet was created by a process with the given effective user id.

--gid-owner groupid
Matches if the packet was created by a process with the given effective group id.

--pid-owner processid
Matches if the packet was created by a process with the given process id.

--sid-owner sessionid
Matches if the packet was created by a process in the given session group.

Ok, so it doesn't match the process name or md5sum. Still usefull though. I use this module to match packets coming from the Freenet daemon (running as a 'freenet' user) on my server and throttle the up-stream bandwidth with the HTB queue discipline. Very important since recent Freenet builds added bidirectional links (and other things?) which means that now even transient nodes service requests.

Re:How it 'works'

[ip_fired]

I don't think they will start sending images with it. It will make their e-mail campaign much less effective. Given that a good sized html message is probably 8Kb, if you add images, it will triple or quadruple the size of the message. This means they will only be able to send a quarter of the normal messages at a time. Remember too that their lists probably aren't "clean". This means that they will be wasting that much more bandwidth and time on invalid e-mails.

So do your part! Enter false information into their database as much as possible! Fill in invalid e-mails on those little "raffle" tickets that you see trying to raffle off a car in the mall. Make sure it's an AOL account or something that delays sending back an error response instead of the instant error notifaction that some mail providers give. That way they have to worry about parsing the e-mail. Perhaps to make it even easier, maybe AOL could start sending randomized text back in their error messages to confuse the spammer's parsers.

Re:How it 'works'

[ip_fired]

There is a problem with SpamAssassin in that you can get around the little web-bug feature with a little setup on the server side. If the spammer were smart, they would use mod_rewrite to change the url from:

http://spammerserver.com/cgi-bin/redirect.pl?id= [m d5sum]

to:

http://spammerserver.com/images/[md5sum]/image.j pg

Apache then takes the a out of the url, rewrites it, and redirects it to a script which then records the hit from the user and notes that this address is valid.

Spam filters out there need to find a good way of detecting unique identifiers that can be used to track a user.

I'm personally moving towards the scorched earth method with my personal e-mail account. Blcok everything that isn't on my whitelist. If I know you, you're on my whitelist. It's certainly not the best method, but I hate spam.

Re:How it 'works'

[Sancho]

My point certainly wasn't that business majors are dumb. The point is that they TEND not to focus on the techier side of things (not that screenshots are particularly techie, but that's another argument entirely). Most of the BANA people I knew in college used computers as little as possible. They pretty much got done what they needed to get done. Office, e-mail when it was absolutely necessary (never for anything other than assignments), and web browsing for doing research. They didn't sit at a computer unless they had to, and certainly never took the time to learn the little tricks that make even Windows a decent operating environment. I could tell them how to do something, and two weeks later, they'd be calling again because they'd forgotten how to do it. Most of them were quite bright, in fact. They just chose to spend their time on something other than the computer, and thus didn't learn or remember how to do many simple tasks, such as taking a screenshot.

And at the risk of coming off as inflamatory, you seem to indicate that the techie-suit is rare, too. So while I understand your frustration at being lumped in with a bunch of non-techies, you surely must understand where the stereotype comes from.

Re:How it 'works'

[johannesg]

So you are telling us IBM has a patent on this part of the HTML specification? How exactly did that come about? Did they invent that little bit of HTML syntax? Or did they dig it from the HTML specification, realize what it can do, and then quickly patent that?

Next up: somebody patents the use of <B> to make a piece of text bold...

Re:How it 'works'

[Phragmen-Lindelof]

I agree completely. With the html code in front of you, you can examine it and decide what you wish to do. (I usually delete it.) The only kmail folder which is automatically viewed as formatted html is the NY Times folder.

Re:How it 'works'

[lostchicken]

Patent law cannot be circumvented with a clean-room designed algorithm. A lack of knowledge of the original source will not get you out of a patent suit, just copyright issues. So, if you are trying to make a web bug, you'd best read this and do something completely different, because no matter what, you can't use the above described technique without being in violation of IBM's patent. Not even if you came up with it all by yourself.

Re:How it 'works'

[Gorgonzola]

Ok, let's bite the bait. I have a MSc in BA and vaguely remember that ctrl-print screen did the trick in earlier versions of Windows. To make me more evil and stupid in the eyes of the slashbots: I have a law degree as well.

Re:How it 'works'

[Anonymous Coward]

Just redirect twice.

Re:How it 'works'

[FLEB]

Not too difficult, except for the screenshot thing, like you said. Just an iframe or an offsite image in an HTML email would work, then make it disappear after a certain amount of time or hits.

Granted, all I'll get is a big gray box I don't care about, but still...

Re:How it 'works'

[okock]

According to Bugzilla entry 28327 this does not seem to block every traffic: A year ago I found, that css stylesheets will still be loaded from remote locations. This bug must be one of the longest-open entries in bugzilla.

Use "View/Message-Body As/Plain Text" to be really sure to cause no hit anywhere.

Re:How it 'works'

[Bob Ince]

Unfortunately, Thunderbird's blocking feature only hits img-tags, leaving eg. table backgrounds, CSS styles, iframes etc. untouched.

I like the 'bird a lot but this *really* has to be fixed for 1.0.

Re:How it 'works'

[91degrees]

Don't they use an as well? I've had a look at either this or another service before, and it had both embedded images and iframes.

Anyone know how to turn off HTML in mozilla?

Re:How it 'works'

[canavan]

That's where the original posters "treble damages" come from. He ment "triple damages", which is what IBM can sue for if you knowingly violated the patent, as opposed to just the damages.

Re:How it 'works'

[feargal]

Yeah, I started the reply before anybody else posted theirs, then got stuck on the phone before I finished it. Sigh.

Re:How it 'works'

[byolinux]

Mail.app under OS X also has this.

Open a Terminal...

defaults write com.apple.mail PreferPlainText -bool TRUE

Voila, any stupid HTML email will be displayed as text only.

Re:How it 'works'

[jafomatic]

According to this terrible windowsXP box I'm posting from, a 1px by 1px transparent gif is 43 bytes. Only those of us that look at the msg source, or prohibit download of remote images, would ever know it was there.

Re:How it 'works'

[jzap]

In Mozilla, look under Edit -> Preferences -> Privacy & Security -> Images
Click the box that says "Do not load remote images in Mail & Newsgroup messages"

Re:How it 'works'

[Lumpy]

or simply put a ? mark at the end of your url.

this defeats mist proxy caches and browser caches.

for example below....

http://www.google.com/images/logo.gif?

alot simpler and uses my patent and copyright on the ? mark in use with computer and internet.

Re:How it 'works'

[the unbeliever]

You can view messages in Thunderbird the same way.

View->Message Body As->Original HTML/Simple HTML/Plain Text

Re:How it 'works'

[nahdude812]

There are some web clients (Particularly on hand-helds) that don't pay attention to this header and cache anyhow. I ran in to this problem while developing a http based game Legend of the Green Dragon. The only way I had to defeat it is to put a unique tag on the end of every link generated by the site. If you go there, you'll see a lot of arguments similar to &c=1-071542 added to the end of most non-form-post links. No matter how I set my headers, people's portable devices were still caching entire pages which had been set to expire already, or had been set to not be cached at all.

The thinking of these clients I guess is that the cost of downloading unneeded data is high enough that it's a more worthwhile risk to present old data even when specifically told that this data is old.

Re:How it 'works'

[fuzzix]

From the site:

"Are you as sick of getting the "I never got your email." line as I was? This will eliminate that excuse completely. It really lets you know whom you're dealing with."
Scott Polevy -Investment Funds Manager

I know who he's dealing with too - those idiots who enable HTML and inline images on their mail clients... I guess he's trying to weed out savvy people for some reason....

Re:How it 'works'

[johnnyb]

Actually, if you want to give false data to the true spammers, just stick false email addresses on you website, or, better yet, email addresses of known spammers. That way you aren't doing anything unethical yourself, and someone else would have to be doing something unethical to get those addresses..

Re:How it 'works'

[tigress]

Actually, I was refering to the myth that someone can have you call a 1-800 number and then "secretly" redirect you to somewhere else.

Re:How it 'works'

[ciggieposeur]

Correct, you cannot circumvent a lawsuit over a patent unless you reach a license agreement before the suit starts. If you go to court, it's basically a toss-up whether you'll win or lose. If you lose you pay damages. But if you lose AND the judge thinks you did so deliberately then you pay triple damages.

You may read all the patents that you *think* cover similar techniques, but there's another one out there that's been filed but not yet issued so you don't see it, then you get sued, and simply because you were trying to be vigilant against stepping on anyone's patent you pay three times. If you are small-to-medium sized you've just gone out of business.

Many software companies on the "innovative" side have a policy in place forbidding employees to read any patents at all to avoid this possibility. As in if you read patents for "fun" you'll get fired, because the risk is too great: if a single employee of your firm has read a patent at the time you lose the suit, you pay triple.

Re:How it 'works'

[OhHellWithIt]

That's where the original posters "treble damages" come from. He ment "triple damages",

There should be no confusion with this.

From Merriam-Webster Ninth New Collegiate Dictionary
treble adj. [ME, fr. MF, fr. L triplus -- more at TRIPLE] ... 1 b: triple in number or amount.

Re:How it 'works'

[Goo.cc]

I wonder how much of a problem this is for other e-mail programs. I never even considered style sheets until your post.

Re:How it 'works'

[Anonymous Coward]

I assume he meant if their service marked it as read or not.

Re:How it 'works'

[Anonymous Coward]

Title 35 U.S. Code
U.S. Patent Act ...Part III. Patents and Protection of Patent Rights ....Chapt. 29. Remedies for Infringement .....Sect. 284. Damages

Upon finding for the claimant the court shall award the claimant damages adequate to compensate for the infringement, but in no event less than a reasonable royalty for the use made of the invention by the infringer, together with interest and costs as fixed by the court.

When the damages are not found by a jury, the court shall assess them. In either event the court may increase the damages up to three times the amount found or assessed.

The court may receive expert testimony as an aid to the determination of damages or of what royalty would be reasonable under the circumstances.

Re:How it 'works'

[tagish]

It's not HTML, it's HTTP. And they haven't patented part of the specification they've patented a use of the specification.

Re:How it 'works'

[KlomDark]

Haha, I figured out the trick in a cleaner fashion on my version of the same game. :)

Re:How it 'works'

[nahdude812]

Care to elaborate? I tried a wide variety of options, and most worked on 95% or 99% of the platforms out there, but only an essentially non-repeating URL completely defeated the most aggressive caching platforms.

Re:How it 'works'

[nahdude812]

You might be cautious, you fell in to the same trap that I did ~3 years ago the first time I tried to web-ify LoRD. In the middle of a fight, you can put in
http://klomdark.servebeer.com:8081/ROTFOH/Heal All. asp
to get healed, then put in
http://klomdark.servebeer.com:8081/ROTFOH/atta ck.a sp?MonsterNum=1
to return to the fight.

Re:How it 'works'

[LordHedgehog]

No, it still wouldn't. My mail client won't show inline images by default. The only difference this would make is whether or not it is marked as spam or makes it to my Inbox.

Unfortunately, I don't think there is a way to detect tracking URLs the with the key embedded in the path of the image. MD5 hashes may be recognizable, but with the size of an unabridged dictionary, spammers could simply assign words to each and every mail sent. Run out of words? Use two!

http://images.tracking.com/flabbergasted/duck/go tc ha.jpg

Re:How it 'works'

[antic]

So, say your mother or your girlfriend/boyfriend or less-techy individual sees this pitch from didtheyreadit, likes the potential offering and implements it, you don't want to read what they're sending you?

Look at it as though that certain someone cares not about webbugs (they know nothing about them) but about wanting to know if you read their email.

Of course, this is all assuming that you have a partner and/or mother...

Re:How it 'works'

[Anonymous Coward]

If it's marked as spam you won't read it, and if images are blocked DidTheyReadIt won't report that you read it, so it works.

Re:How it 'works'

[letxa2000]

So, say your mother or your girlfriend/boyfriend or less-techy individual sees this pitch from didtheyreadit, likes the potential offering and implements it, you don't want to read what they're sending you?

Well, they're whitelisted anyway. I don't actually mean preventing the server from connecting to you. I would just consider it a good candidate for blacklisting, subject to any whitelists that would override it.

Look at it as though that certain someone cares not about webbugs (they know nothing about them) but about wanting to know if you read their email.Of course, this is all assuming that you have a partner and/or mother...

I have both, neither of which would be interested in this "technology." In fact, I think the only one really interested in this technology would be marketers--i.e., the marketing department of some company trying to keep track of what their contacts are doing. If that's the case, no, I don't want to hear from them, either. :)

Definitely snake oil.

[jcr]

All I have to do is read my mail when I'm not on line.

Nothing to see here, nothing at all.

-jcr

Re:Definitely snake oil.

[E_elven]

There's a way to go off line? What does one do in this 'off-line' state?

Re:Definitely snake oil.

[plankers]

You call your broadband company/ISP and have them fix the situation.

Re:Definitely snake oil.

[Sime208]

Yup, this DidTheyReadIt looks like a load of rubbish.

For those users on dialup that'll be 'compatible' with it (e.g., those who's MUA's are set to download images automatically etc.), they'll be kinda alerted to this covert tracking thing when their machines try to dial out whenever a certain email is read.

And I can't see it doing any tracking to the folks working in our office (and most offices) when SQUID stamps out all those HTTP requests.

Re:Definitely snake oil.

[System.out.println()]

Give me your IP address, and I'll make it happen.

Re:Definitely snake oil.

[V.P.]

127.0.0.1 -- There you go!

Re:Definitely snake oil.

[System.out.println()]

Thanks, I'm pingflooding you now. Your internet should go away in just a BUFFERING....

Re:Definitely snake oil.

[Anonymous Coward]

There's a way to go off line? What does one do in this 'off-line' state?

Simple. Post a URL to your biggest jpeg onto Slashdot!

this is cool

[quelrods]

Well, it will tell you when they opened the email/how many times/etc. (assuming they have an html enabled email client.) It works w/ yahoo mail but not with pine. The infinite refresh to tell how long they read the email for is annoying in that it makes it look like the email never finished loading. Can someone see how outlook responds to this? (I haven't a windows box)

Re:this is cool

[quelrods]

woops forgot to add it's direction finding skills are weak. Apparantly I'm in Michigan? I'm in Austin,TX and my POP is chicago. It appears to try to get information via one of the upstream links which is horribly inaccurate.

Re:this is cool

[madprof]

So, in fact, this is not cool at all then.

Re:this is cool

[Anonymous Coward]

The infinite refresh to tell how long they read the email for is annoying in that it makes it look like the email never finished loading. Can someone see how outlook responds to this?

I'm just guessing here, but, based upon my previous experiences with Outhouse, it probably downloads an activeX script from a site in Korea and promptly reboots. But then again, that's the default behavior.

Re:this is cool

[quelrods]

except I'm not running windows/ie so activex doesn't work here.

Re:this is cool

[Anonymous Coward]

Doesnt like outlook 2003, as outlook2003 doesnt load the images it wont record a hit, I have tested this myself, works great with hotmail but not with outlook.

Its a fairly Lame idea as in the near future most e-mail clients wont work with it.
Can anyone say .com ?

Re:this is cool

[Technician]

woops forgot to add it's direction finding skills are weak.

This could be fun. My mail account is in another country (DL from POP3 or webmail) and my ISP rents POP's, so who has any idea where I'll show up. Would it be the CO-LO POP, the ISP home, or the webmail out of country?

How good are their webservers

[Anonymous Coward]

Although we have to get the link correct in the first place.

Do you think they'll be able to read their site in the next hour... I hope not :-)

OE read receipts

[gbjbaanb]

considering the non-friendly hack that you need to go through to get this working, wouldn't it be better to capture the data sent by Outlook and OE's read receipts and implement something compatible in Mozilla and other email clients.

I only say use the Outlook 'standard' because it doesn't seem there's any others, and it'd be a bit useless if we had multiple versions.

If we want read receipts, that is. Personally I turn them off, and don't send them.

Re:OE read receipts

[Ryquir]

Uhmm... you do understand that Mozilla and other E-mail client do actually have read receipts and that this isn't a "MS" standard?

The only difference in clients abilities with regards to read receipts is how they present you the uninformed user the dialog box saying "Sender has requested you inform them that you have read this message".

Re:OE read receipts

[IncohereD]

Weren't read receipts 'invented' by Netscape 4.x?? That's the first time I remember seeing them. And the functionality is still in Mozilla, one of my friends requests them, and I get a box asking if I want to send it or not.

Re:OE read receipts

[Anonymous Coward]

Or you could simply read the RFC. Seems a lot less trouble than packet sniffing and reverse engineering.

Re:OE read receipts

[jonadab]

> wouldn't it be better to capture the data sent by Outlook and OE's read
> receipts and implement something compatible in Mozilla and other email
> clients.

You do realise that read receipts were standard before there was any such
thing as Microsoft Outlook, right? Almost all mail clients support them,
but almost all mail clients have the feature turned off or severely limited
by default. These days the reason to turn them off would be spam, but at
the time that was pretty much a non-issue, but nevertheless by 1995 almost
all mail clients had the feature turned off by default because of privacy
concerns; a lot of people didn't *want* the sender to know when they read
the message, since sometimes they might read it hurriedly once but not have
time to respond, and come back and answer later, and they didn't want the
sender to think they were just being rude. This used to be a hot debate
topic on the internet circa 1994, but once spam became common the debate
faded into obscurity; today almost nobody wants the sender to automatically
know when or whether they read the message.

Re:OE read receipts

[LoisMustDie]

There were return receipts on a Data General system we used in the late 80's. They called it "Certified Mail."

How it works

[Matt2k]

I'm assuming it works by appending an invisible image that references back to their servers. Spammers do this often to verify if an account is "live".

Most e-mail and webmail clients do not have any functionality for disabling remote images, so that would explain how it works "most of the time". Mozilla thunderbird, among others, allows you to disable remote image loading. Of course a text-based client running on any Linux system is not going to be succeptable to this method of tracking either.

Re:How it works

[avdp]

Most email and webmail clients DO have this functionality. Yahoo, Hotmail, SquirrelMail even Outlook can block remote images (I am sure there are more, but those are the ones I have used - the most popular ones I would say). It may not be the default setting though.

Lets Implement a Similar System

[KhalidBoussouara]

To see if people read the article before posting on Slashdot.

This post is a joke so don't moderate down. Also I am aware that this wouldn't be really effective.

Re:Lets Implement a Similar System

[Anonymous Coward]

MOD PARENT DOWN. This wouldn't be effective mea...
aww crap.

This could be annoying

[thedogcow]

The nice thing about email is that the user doesn't have to respond. This would "force" the user to correspond with the person who sent the email.

Hell, its fun to get an email and deleting it without responding.

Single pixel gif?

[ilikejam]

Sounds to me like they just embed a simgle pixel gif in the message, and monitor when they recieve the request for it.
How they monitor the length of time the mail stays open is a bit of a mystery.
Turn off 'Download images' and I'd imagine their system becomes useless.
Wasn't there a scare about spam merchants doing this once?

Re:Single pixel gif?

[octalc0de]

Perhaps the single pixel gif never finishes loading. That way, as long as the connection remains open, the web server clocks how long you're on the image.

Re:Single pixel gif?

[nslu]

two options -- iether the server never closes connection when feeding the gif image, so it would be open until email's browser timeout or until email message is closed, or - i think this one is more likely - they trap onUnload() event and send some request to their server.

Re:Single pixel gif?

[Neon Spiral Injector]

The time is probably calculated by not actually sending the image file, or sending it very slowly. So they just keep the HTTP session open, then note when the client closes. That would limit the tracking time to when the connection times out. Like the author said, he left the Yahoo mail open for 10 minutes and it only reported 2.

An additional note, Yahoo does have an option to disable remote images, which would also break this.

Seems this company is too late to the party. Almost all current e-mail clients now don't or have an option to not to load remote images.

Re:Single pixel gif?

[ilikejam]

Yup. Confirmed.
At the bottom of the mail is:

<img src="http://didtheyreadit.com/index.php/worker?cod e=xxxxxxxxxxxxxxxxxxxxx" width="1" height="1" />

Oh well. Should prove very effective against those without the sense to turn off images anyway. Lets hear it for making money from people's ignorance!

Re:Single pixel gif?

[tigress]

Server-push. Very simple.

Re:Single pixel gif?

[5E-0W2]

Could be animated gifs sent slowly? I remember back in the days of netscape 3 iirc netscape had an aquarium webcam that worked by having an animated gif and new frames getting sent as they were generated. Or perhaps it was server push (multipart mime content). It was something like that which would work for this anyway. 1996 was a long time ago.

Re:Single pixel gif?

[xrxzzy]

Is it possible to block or reroute their IP?

Re:Single pixel gif?

[Neon Spiral Injector]

I just tested, they send an image/jpeg with a header not specifying the length at 1 byte/second. But it is only 302 bytes long, so they can't track for more than 5 minutes. It is a real JPEG, 1x1 pixels, created with an Adobe product.

Re:Single pixel gif?

[ilikejam]

Yup.

Re:Single pixel gif?

[Neon Spiral Injector]

That was indeed server push for the fish cam. Only worked with Netscape. I don't think Mozilla even supports multipart mime.

I tested with one of the links provided here. It is just a 302 byte JPEG sent 1 byte per second. So max tracking time is 5 minutes.

Re:Single pixel gif?

[Anonymous Coward]

Lets hear it for making money from people's ignorance!

Yeah! Go Microsoft!

Re:Single pixel gif?

[Anonymous Coward]

That used to be a single-pixel transparent offsite served gif with a unique URL. Then various spam-detectors started looking for this, so now, the spammers are manipulating the ways of writing the URL to avoid your detecting it.

But yeah, it's a web bug.

Re:Single pixel gif?

[Anonymous Coward]

Just add the site that serves the image to your DNS block list or to your hosts file and make it point to 127.0.0.1.

Re:Single pixel gif?

[kimmerin]

Sounds like a big machine being able to keep open a lot of sessions at the same time or this is a self-constructed tarpit.

Both sounds quite unlikely so the paranoic theory of an address-collector with PEBKAC-verifyer comes up to mind.

Re:Single pixel gif?

[Rich0]

Actually, while it doesn't look like they're doing it, if they directed the traffic to a customized web server it should be quite practical. The web server doesn't need to know anything about cookies, html, php, server-side includes, or just about anything except how to listen on port 80, log the incoming request to a database, send out 1 byte per second data, and log the connection close with the database.

A program capable of doing this could probably be written in a few kilobytes of C. A decent server could probably run thousands of threads for such a program. It doesn't have to keep track of any state except the ID of the message it is tracking, so it would use almost no RAM per thread. And you just schedule it to wake up once a second (that's what, every 2 billion instruction cycles - to send one more byte, which is probably a few hundred instructions?).

Sure, if you do this with apache/modphp it will probably soak up RAM like crazy spawning thousands of httpd processes. But apache has a LOT of overhead that you don't need for this application.

Re:Single pixel gif?

[kimmerin]

The problem is the number of ports that can be used for doing the communication. With a real successful service the number of users reading email at the same time will easily extend the number of ports being available for this kind of thing (~65000).

get your privacy back easily

[xlyz]

just set your mail client to not download images

Re:get your privacy back easily

[Pike65]

How do I do that in pine?

Re:get your privacy back easily

[Anonymous Coward]

Of course, this implies you use a mail client, not Outlook.

Re:get your privacy back easily

[MntlChaos]

it's the default. so just type pine and it's set up to not download images

Re:get your privacy back easily

[Anonymous Coward]

It's easy - in fact, I've just done it for you.

You can send me a case of beer for my time...

Re:get your privacy back easily

[VGPowerlord]

Control-Alternate-Delivery

Re:get your privacy back easily

[Anonymous Coward]

wow silly mods. INFORMATIVE!?!? that was an obvious joke. ::sigh::

Re:get your privacy back easily

[SmittyTheBold]

Those other guys are just trying to get something out of you. In reality, Pine's too old of a mail client. It has no setting to disable HTML images, so you need to upgrade to a mail client that does. Even better, you could go for the feature-packed client that is Outlook! It even has a datebook built in, and scripting for your whole system!

No good

[martingunnarsson]

If you can't trust the service, and you obviously can't, I don't think there's a very good reason to use it. Unless it works for every single message it's no good. It is a pretty neat idea, but the tinfoil hat crowd will most likely scream and shout about their privacy being invaded.

Re:No good

[Z-MaxX]

Probably the biggest problem isn't a violation of privacy (spammers are are using this same technique all the time anyhow, you REALLY should disable the loading of images in your mail client) is the fact that is does not and *cannot* work for all email providers and clients.

Even Yahoo! webmail allows you to disable image loading. Furthermore, I always set my mail client to only show the plain text message, and not display any HTML at all. I don't need hypertext markup in my email messages.

Re:No good

[Z-MaxX]

Unless it works for every single message it's no good.

So true. And this is straight from their main page:

"Are you as sick of getting the "I never got your email." line as I was? This will eliminate that excuse completely. It really lets you know whom you're dealing with."

Now you simply say, "My spam filter blocks images." And you may have a reason then to think that the person who sent you the message doesn't trust you.

You can't solve a people problem with technology.

Re:No good

[Anonymous Coward]

"You can't solve a people problem with technology."

That's what guns are for.

Re:No good

[Anonymous Coward]

You can't solve a people problem with technology.

Oh ho! You say that now, but just wait till my orbital mind control lasers are active!

Re:No good

[mandalayx]

You can't solve a people problem with technology.

You're joking, right? That "telephone" thing seems to be working pretty well, as well as my "computer" and "car".

Just because social engineering may be the best way to solve a number of problems doesn't mean that technology can't help. (or hurt!)

Re:No good

[Z-MaxX]

You're joking, right? That "telephone" thing seems to be working pretty well, as well as my "computer" and "car".

In this case, I use "problem" to mean "there is something truly wrong," as opposed to "X could be more easily accomplished with Y." Cars and telephones and computers are tools that are useful, but there is nothing "wrong" about walking or talking face to face. In the case of the email bug, when someone is lazy, has their priorities out of whack, or just doesn't care, the real problem isn't whether they read your email.

Just because social engineering may be the best way to solve a number of problems doesn't mean that technology can't help. (or hurt!)

Agreed. Technology can help but it cannot be the solution itself to a people problem. It's kind of like Digital Rights Management. DRM is a technological solution that is completely doomed to failure if it's the primary component of the music industry's solution.

The "solution" in question here for an interpersonal communications problem will simply create new problems. The quote says, " This will eliminate that excuse completely." But there will be new, creative, and exciting excuses to hear.

Re:No good

[thrillseeker]

the tinfoil hat crowd will most likely scream and shout about their privacy being invaded.

They do that because their privacy is being invaded.

Re:No good

[MntlChaos]

but the tinfoil hat crowd will most likely scream and shout about their privacy being invaded.

As the spokesperson for the tinfoil hat crowd... "OUR PRIVACY IS BEING INVADED!!!!!!!"

Re:No good

[fermion]

A while back I blocked all email with embedded HTML. For a month there were a few people who I could never get email from. I eventually learned that the free Yahoo et al email, as well as outlook, embedded HTML in every messege, whether it was needed or not.

So, I had to block this nearly perfect spam filter techique just because a few ignorant people sent me HTML.

Re:No good

[dbc]

I've been filtering HTML mail into a folder and only a few people that I actually want mail from have ever sent me random HTML mail. I usully tell them nicely that any HTML is binned as spam in my system, and I may or may not get around to reading it. So far, 100% of my correspondents have gotten the clue and switched to plain text.

For Yahoo groups where I actually want the mail, I white list. For my sister, who can't figure out how to send plain text, and whose mail I don't really want but need to read anyway... I whitelist.

Big fat band-aid. But, by and large, HTML filtering is surprisingly effective at reducing spam.

Re:No good

[addaon]

The pill?

Re:No good

[Anonymous Coward]

damn you. Beat me to it.

Re:No good

[Reziac]

Actually, it sounds to me like this technology DOES solve a "people problem" -- it gives you a good clue about when you may have a potential "problem person" (such as someone who doesn't trust you).

Think of it as social engineering in reverse :)

Re:No good

[Q Who]

So true. And this is straight from their main page:

"Are you as sick of getting the "I never got your email." line as I was? This will eliminate that excuse completely. It really lets you know whom you're dealing with."

If you get the excuse while the system shows they read the message, it really does.

Re:No good

[Anonymous Coward]

That's what guns are for.

But guns are technology too!

Re:No good

[stienman]

You can't solve a people problem with technology

It's called a BFG9000.

-Adam

Why not do it yourself

[Crashmarik]

If the recipient is using a text based email program theres no way in heck anything is going to track whether the mail was opened or read. If its an HTML reader like Outlook just pop a web beacon and let your server monitor it. If you can't figure out how to make this work yourself, you probably shouldn't be allowed to go spying on others anyway.

Re:Why not do it yourself

[jcuervo]

If the recipient is using a text based email program theres no way in heck anything is going to track whether the mail was opened or read. If its an HTML reader like Outlook just pop a web beacon and let your server monitor it. If you can't figure out how to make this work yourself, you probably shouldn't be allowed to go spying on others anyway.

That's great and all, but what happened to the Disposition-Notification-To header? Personally, I'm inclined to respect peoples' privacy. Especially people I'm sending mail to.

Re:fp!

[TheViciousOverWind]

Nothing special, just "Webbug" images, which spamfilters such as SpamAssasin (in the default setting) adds point to as more likely to be spam, so using DidTheyReadIt users mail is more likely to end up in a spamfolder than any other type of mail.

On another note, I find it's walking on the thin red line of immoral behavior, and I know here in Denmark there've been several companies who've got bad publicity because of using said method.

Not very useful!

[edoc]

This is not very useful as it is only tracking the images that are being loaded when the email is being viewed. However, most email clients now block these inline images from being loaded so this software will not function. In text based email clients it also will not function at all. These features have already been included in such email clients as evolution.

Who is 'They'??

[DraKKon]

Is 'they' the person that you are emailing.. or is 'They' didtheyreadit.com?

In Soviet Russia

[martingunnarsson]

In Soviet Russia e-mail monitors YOU!

*ducks*

It's an animated GIF!

[Anonymous Coward]

It embeds a single pixel image, but it appears to keep feeding you the image forever, at a rate of a byte a second. Thus, if you use an HTML image reader that loads embedded graphics from random servers, they will know how long you had it open for.

Of course, if you use an email program that's that, umm, "open", they could just embed a trojan in it and add features like listening to what you say when you open the mail, and pictures of you reading it. :)

Re:It's an animated GIF!

[Seumas]

What's pathetic is that the USA Today technical writer Kevin Maney wasn't smart enough to really investigate the product/technology he was reporting on. Not a shred of investigative reporting or critical thinking in the entire article.

Even my grandmother would have to sense to do more investigating and be more doubtful about the claims of the product than this guy.

Re:It's an animated GIF!

[ewg]

Even if they can tell how long you had it open, they can't tell whether your attention was focused on it during that time.

If I open the message, then take a caffeine break, then close it upon return, my time away shows up in the sender's report.

A bad investment

[digid]

This company will be shot in the foot before long. It's not hard for email services such as hotmail and yahoo to protect the privacy of its users to filter out the cookie-cut inline image. How's this company supposed to charge for a service that they can't guarantee will work for every email address

Re:A bad investment

[takshaka]

It's not hard for email services such as hotmail and yahoo to protect the privacy of its users to filter out the cookie-cut inline image.

So easy, in fact, that they already do it. When I heard the ridiculous claims from the didtheyreadit.com spokesman on NPR's Talk of the Nation last week, I immediately signed up and sent a test email to a new Yahoo account. Yahoo mail blocked the image by default.

I can't believe that anyone in their right mind would attempt to turn a spammers' trick into a legitimate business. Considering that even Outlook now has methods for defeating web bugs in email, this is obviously a dead end.

Re:A bad investment

[plover]

But perhaps this is having precisely the intended effect.

Perhaps their goal wasn't to really sell their services, but to end web-bugged email. Maybe all they wanted was for the big on-line webmail services like Yahoo & Hotmail to receive an outcry from outraged users demanding a "stop to this privacy invasion." Maybe their focus all along was to get these mailhausen to start blocking all web bugs by default to render useless the old spammer's trick for the majority of spam victims?

Or maybe they're just stupid.

Either way, it won't ever have affected me since I've blocked email images ever since learning about web bugs years ago.

Does what it claims....which isn't much

[MCron]

If you really read into their site, it isn't saying it will "work on anything, including hotmail, aol, yahoo!, etc" but that if you use those, it will work. In other words, it will only work if you're using a web-based client, which needless to say makes perfect sense considering the methods they're using, and the failures under Pine, etc.

Idiots.

[rice_burners_suck]

What a bunch of fucking numb nuts. It reminds me of the time my grandmother received a derogatory email. She called me to say that she's been receiving these for the past few weeks, all from the same address, and that she didn't know what to do. I asked her to forward it to me, but she claimed it had disappeared from her Yahoo email box. How could that be? Well, she had some neighbor, whom she claims knows a LOT about computers (yeah right), and he told her that some really smart uber-hacker put a "bomb" in her mailbox that caused that email to disappear without her deleting it. Uh, yeah. And did you know that those old 2x CD-ROM drives from, like, 1992 could write to a CD-ROM disc? (A silver, pressed one!) Yeah, some idiot told me that once, too...

In other words, anything that looks sufficiently mysterious is deemed to be magic. What a bunch of StuplePeopid.

Re:Idiots.

[wo1verin3]

You mean i'm the only one who downloaded that trojan..er...program to make my CD-ROM in to a recorder? :(

Re:Idiots.

[Anonymous Coward]

so where were you grandmother's emails going?

Re:Idiots.

[Anonymous Coward]

Up your arse.

spam

[Tjebbe]

The only real use for this service is for spam, who cares how often and for how long your message has been read? Especially since it's only reliable on a greater scale (if there are enough people using html mail with automatic loading).

I for one would personally find the first client i could get to disable this (which is any reasonable client at the moment i guess, although i did not rtfa).

Re:spam

[Anonymous Coward]

Lots of us care, especially with legal documents, tech support requests, or bills. It's extremely useful to be able to say "you read this thing at 8:15 am from the IP address 1.2.3.4".

Re:spam

[Alex Belits]

You also care that your legal documents are passed without being modified by some assh^H^H^H^H third parties, and that you won't claim something as unreliable as this "confirmation".

I'M RICH!!

[nacturation]

Now I'm going to finally get Bill Gates and tons of other companies to finally pay up!

eeevviiilll!

[Gaima]

http://www.rampellsoft.com/, the people bringing you didtheyreadit looks to me like a really evil company.

software products to make your life on a computer easier and more efficient. by secretly spying on your spouse, kids and employees.
Oh, sorry, record, my bad.

/me goes back to kmail in text/plain by default, happy, safe, and in privacy.

Re:eeevviiilll!

[jcuervo]

Yeah, what he said.

/me goes back to elm, thank you very much.

Re:eeevviiilll!

[Anonymous Coward]

Boy, these guys are funny:

AlwaysONline 3.0 $18.95
AlwaysONline stops you from being logged off AOL due to inactivity.

They're selling a ping program for 19 bucks.

Re:eeevviiilll!

[Anonymous Coward]

/me goes back to kmail in text/plain by default, happy, safe, and in privacy.

KMail includes the option of rendering HTML, but not loading external resources, so you get bold, italics, etc, but can't be tracked by these types of techniques. It's in the Security section when you configure KMail.

Re:eeevviiilll!

[dbc]

exactly! why pay $19 for a ping program, when you can just let your computer become 0wn3r3d for free, than all that spam you relay will keep you connected. some people are just begging to be ripped off.

Re:eeevviiilll!

[protohiro1]

Great, keyloggers, backdoors and root kits. The wonderful world of dubious software.

Smoke and mirrors

[Shivantrill]

This is how they do it:

<IMG height=1
src="http://didtheyreadit.com/index.php/ worker?code=787d9d69fd47aceac0e6e6225eafb831"
wid th=1>

Doubt this would work with text only readers. As far as the time open, maybe they monitor how long the img is being accessed. Kinda like a auto refresh, when does it stop.

And yes, Slashdot reported that spammers use this to determine if an email account is valid.

Re:Smoke and mirrors

[DaHat]

And now we all DoS their site as we try to load that image to see if it really does work...

It seems to be good, just an awful slow load (which no doubt is intentional to measure the length of your 'reading' of the e-mail).

This would fail with GMail

[tji]

By default, Google mail has images turned off. You have to click a link at the top of the message to force it to load the images.

Most other mailers also have a way to turn off image loading because spammers have been using this tracking technique for a long time. If mailers don't allow image blocking yet, I'm sure that a service like this will get them to add that trivial feature.

Re:This would fail with GMail

[attemptedgoalie]

Outlook 2003 blocks images as well.

Outlook Express will when XP SP2 hits at end of July.

Re:This would fail with GMail

[Anonymous Coward]

Outlook Express- Microsoft's best attempt at making a security hazard. They are really good at that.

Re:This would fail with GMail

[neko9]

in Opera 7.50 its called "Suppress external embeds" and is enabled by default.

Re:This would fail with GMail

[Rits]

And unlike Thunderbird, this works for *all* external elements in a mail, like stylesheets, scripts, table backgrounds, plugins etc. It's been a feature of Opera since 6.0, November 2001.

But we're blocking it anways..

[Gandalfar]

Since most of us already use option like 'do not show images from remote servers' inside our emails to prevent spammers from tracking us....

how much useful can this service be to slashdot crowd?

Re:But we're blocking it anways..

[JessLeah]

Clearly, this service isn't being marketed to the SlashDot crowd. The very IDEA of this service reeks of "mass market", which we are not. (Though, with all the MSFT ads, we're getting closer every year. I'm just waiting until I see AOL ads on SlashDot. That'll be the day...)

Re:But we're blocking it anways..

[Todd Knarr]

No, we aren't the "mass market". We're the people the mass market goes to when they get their new computer and realize they have no idea how to set it up, or when they get hit by the worm du jour and need their system repaired. If they won't change the defaults from what Redmond gives them, why would they be any more likeliy to change the defaults the neighborhood geek gave them when he cleaned up their system and installed the anti-spam/anti-malware packages?

Re:But we're blocking it anways..

[swordfishBob]

A number of corporates also disable inline images by policy, or thanks to defaults (Lotus Domino 5).

Yahoo, and Gmail too...

[QangMartoq]

Both of these web-based email services have the ability to block loading of images in spam, though, at least with Yahoo, it's worthy to note that this feature extends only to messages stored in your 'Bulk' folder.

As to Gmail, I don't know, but from what I've heard it works in a similar way.

Also, the newer versions of AOL diasable images in emails by default, requiring the user to click on an 'Enable images and links' option on each email they want to see images/have working links in.

Having email clients disable images by default (Which sems to be an increasing trend) will relegate this 'service' to the wasteland of failed dot coms pretty quickly, I'd think. When this happens, I wont be one to shed a tear. I have no desire for anyone that emails me to be able track if I have read their message. If I have, and I choose to respond to it, then they know. If I don't respond, they can keep guessing.

quick prevention of getting tracked by this...

[griffjon]

Not that I let my email client load images anyway, but just because I'm spiteful, I think I'll go add
"127.0.0.1 didthereadit.com" to my /etc/hosts file. (c:\windows\hosts in win98, C:\windows\system32\drivers\etc\ in XP, )

Re:quick prevention of getting tracked by this...

[KhalidBoussouara]

I have heard that if you have too many entries in the hosts file it can slow down the operating system start up. I am still looking for some solid evidence to back this up but in the meantime might it instead be a good idea to use a firewall to block these web bugs. That way you can block the IP addresses too. Advertising companies will soon catch on to the idea of the hosts file and use IP addresses for the URL's.

Instead of using:
http://localhost/image.jpg

Advertisers would use:
http://127.0.0.1/image.jpg

Re:quick prevention of getting tracked by this...

[Anonymous Coward]

HAHAHAHA.

Re:quick prevention of getting tracked by this...

[ax_42]

Not that I let my email client load images anyway, but just because I'm spiteful, I think I'll go add
"127.0.0.1 didthereadit.com" to my /etc/hosts file.

Good (though unoriginal) idea, you might want to spell the domain name correctly though. Add in doubleclick.net while you're at it, too :)

Re:quick prevention of getting tracked by this...

[ewg]

Or add it to your web proxy server configuration. One line in squid.conf means I can watch this develop from the sidelines. ;-)

Re:quick prevention of getting tracked by this...

[serial frame]

A lot of those advertising companies depend on round-robin DNS. Do an 'nslookup' on ad.doubleclick.net every now and then if you don't believe me. It wouldn't be easy for them to implement.

Thankfully, it would take them a little longer than we would think to implement.

Re:quick prevention of getting tracked by this...

[zeath]

If an advertiser were to use Akamai they would be forcing the users to alienate themselves from a whole lot of other services by adding that to their hosts file. I'm not sure if Akamai has policies against hosting advertising clients or not, because I've never seen any of the like using them, but there might be a similar workaround piggybacking on another service.

Re:quick prevention of getting tracked by this...

[griffjon]

not only unoriginal, it's one of the oldest tricks in the book to getting around banner ads (surplanted only recently by the adblock extension) (ok, junkbuster proxy, but that was more hassle to me than hosts).

(It was spelled right in my hosts file!)

Depressing...

[Gutboy_Barrelhouse]

Does anyone else find it depressing that the entire privacy issue this service (creates? no... inflames?) hinges on the fact that 99% of Internet users probably don't know whether they're reading email as HTML or plain text?

Re:Depressing...

[Brandybuck]

At work I have to use Windows. I've got Mozilla mail, but also have to use Outlook at times. Please tell me, in both applications, how to enable reading messages in plain text. As a hardcore Unix user, this is something that seems to be beyond my skills to do.

Re:Depressing...

[PTBarnum]

Outlook 2002:

To suppress all HTML rendering, add this key as a DWORD with value 1.

HKEY_CURRENT_USER\Software\Microsoft\Office\10.0 \O utlook\Options\Mail\ReadAsPlain

Outlook 2003:

I don't use this, but I understand there are preference settings in the app itself to suppress external images and possibly even turn off HTML.

Re:Depressing...

[Brandybuck]

And people call Windows "easy to use"? Hah!

mwahaha

[Anonymous Coward]

Devious suggestion: Buy misspellings of their domain, then capture all emails you receive. Hours of fun!

Re:mwahaha

[Anonymous Coward]

Forward the mail just like didtheyreadit, but instead of a transparent image, insert a nice big goatse guy jpeg.

Re:mwahaha

[timothv]

Won't work, the html specifies a 1x1 pixel image. Goatse isn't very shocking scaled down to that size.

Re:mwahaha

[Anonymous Coward]

and why do you thing you have to use a 1x1 image when you forward it?

Re:mwahaha

[jonadab]

> Buy misspellings of their domain, then capture all emails you receive. Hours
> of fun!

Hours of *what*? I think all you'd get out of that is reading email that was
written by people stupid enough to believe grandiose and transparently false
claims and spend money on a useless service. It is extraordinarily unlikely
that even 1% of the email you would get that way would be worth your time to
read, much less hours of fun.

Re:mwahaha

[Ironica]

Devious suggestion: Buy misspellings of their domain, then capture all emails you receive. Hours of fun!

You'd think they'd be smart enough to have taken care of this already... but ditheyreadit.com is available, at least. That was the first common typo that came to my mind. If they didn't get that one, I'm guessing they didn't think to get quite a few of them...

snake oil indeed. two words -

[Anonymous Coward]

as

if.

Better alternative

[mapinguari]

If you're wanting to use something along these lines, a more up-front company that doesn't use invisible web bugs is HaveTheyReadItYet.

They use images of stamps, which are customizable, which is kind of a cool idea.

However, this only available for Windows.

Re:Better alternative

[magefile]

So ... DidTheySueItYet? That, is, did HTRIY sue DTRIY for trademark infringement yet?

Re:Better alternative

[Reziac]

First thing I see on their page:

"Unlike other read-detection services, HaveTheyReadItYet never hides anything from message recipients. It's the only choice for honest, up-front people who want reliable read-notification and privacy-protection."

I say cheers for them, for being honest and encouraging honesty among their users.

Myself, I consider it a betrayal of trust if someone feels like they have to *silently* track whether I've read an email, viewed a particular web page, etc. If they don't trust me, how can I trust them?

Re:Better alternative

[Anonymous Coward]

How about if it included a url to a dynamically generated page which kept track of everyone who had read the page? Then you'd know if someone else were reading email intended for you. (well, not really but sort of...)

SPAMMERS, perhaps?

[whoever57]

A whois on didtheyreadit.com shows an address in Florida.

Wouldn't this be a great way to harvest thousands or millions of known good email addresses?

The TOS only states that they will not store the emails -- yet their own logs will contain the email addresses. There is nothing in the TOS that explicitly prevents them from using those addresses.

Re:SPAMMERS, perhaps?

[gl4ss]

considering that such technique(tracking if email was read by having an img tag) has been used by spammers for years it wouldn't be that surprising.

Re:SPAMMERS, perhaps?

[e9th]

The best part is that you're paying them to grab your recipients addresses.

Absolutely brilliant.

Re:SPAMMERS, perhaps?

[danharan]

And conveniently, they also have a sender that is likely on your white list...

More sophisticated analysis could also yield useful info (likely gender of the sender based on words and sentence structure; keywords to indicate interests).

Re:How does this crap get posted?

[Anonymous Coward]

This wasn't a troll. Slashdot readers (hopefully?) don't need to see press releases from companies plugging well-known, half-baked technology as an innovation.

Awesome!

[CRC'99]

Now I'll be able to find out if the boss is actually reading my email!

heh - and he says he doesn't get it :)

Re: Awesome!

[Black Parrot]

> Now I'll be able to find out if the boss is actually reading my email! heh - and he says he doesn't get it :)

Maybe he's telling the truth, i.e. he read it and didn't get it.

Good for them, and us.

[tigress]

In my personal opinion, I think this might actually be a good thing. Considering the fact that didtheyreadit.com uses external images for tracking, and that they're getting a whole bunch of publicity right now (partially due to this very article), this is just another reason for email clients to block external images by default - spam apparently not being a big enough reason yet.

With a bit of luck, this will make more sites and clients want to implement image blocking, which will in turn make it harder for spammers to get their messages across.

Spam is merely an annoyance to most people. Privacy issues are not. :)

Could be useful

[zerosignal]

I think this would be useful for dealing with companies with poor customer service. You can check if your mail was actually read by a human. Chances are they are all using Outlook with HTML enabled, so the tracking would work.

Re:Could be useful

[Atrax]

No good if said big company uses, say, Lotus notes. my electricity provider certainly does, luckily I'm next door neighbours with one of their IT manager guys.

good point though.

One of many...

[ILL Robinson]

Anyone really wanting a service such as this only needs to use the obligatory Google-plug-n-play method.

Search results return a number of companies who advertise this service - none of which are didtheyreadit.com.

I seem to remember another company back in the Net heyday that provided the same service - assumed they went down in flames with the rest.

DNS fun...

[AVee]

Looks like they've got a wildcard mx record:

# host -t mx aol.com.didtheyreadit.com
aol.com.didtheyreadit.c om mail is handled by 10 mail.cluster1.didtheyreadit.com.
host -t mx lsdkfjksdlfjklsdjf.didtheyreadit.com
lsdkfjksdlfj klsdjf.didtheyreadit.com mail is handled by 10 mail.cluster1.didtheyreadit.com.

Now whould you like to pay for an email service that doesn't even have a fallback mailserver and is likely be busy handling mail for info@didtheyreadit.com.didtheyreadit.com.didtheyre adit.com.didtheyreadit.com.didtheyreadit.com

# host -t mx didtheyreadit.com.didtheyreadit.com.didtheyreadit. com.didtheyreadit.com.didtheyreadit.com
didtheyre adit.com.didtheyreadit.com.didtheyreadit.com.didth eyreadit.com.didtheyreadit.com mail is handled by 10 mail.cluster1.didtheyreadit.com.

Re:DNS fun...

[Anonymous Coward]

Probably because mail.cluster1.didtheyreadit.com points to 3 different IP addresses.. Not sure why they didn't just make 3 separate MX records.

Re:DNS fun...

[rusko]

thank you for being clueful.

in case my previous comment where i mentioned this gets modded down, here it goes:

we are the managed hosting company that engineered the load-balanced high availability cluster which powers didtheyreadit.com. specifically, i am the engineer who led the development and implementation. i am not including the company name - my comments are *not* meant to advertise the company, just shed some light on the technical issues involved.

we wanted to load balance the mail servers. had we added 3 mx records with priorities designating order, we would have no control over directing traffic to a less loaded box; in essence, it would just be a failover (high-availability), not a load-balanced solution.

we do extensive weighting of results returned by the nameserver based on several load parameters; this level of control was easier to achieve within the same framework we used for http traffic for this application.

as you can see, the cluster is doing well with the traffic our client got from slashdot, especially since they are simultaneously getting hit by traffic generated from all of the other press they are getting. as the engineer who did the bulk of the coding, i can say i am quite satisfied with the result =]

cheers,
paul

Re:DNS fun...

[grozzie2]

mail is handled by 10 mail.cluster1.didtheyreadit.com.

Ok, a little more digging. mail.cluster1.didtheyreadit.com resolves to 3 consecutive ip addresses. Repeat the process for www.didtheyreadit.com and you find that the same 3 ip address resolve to that. This smells a lot like somebody has gone to the effort to build a high availability cluster for dealing with mail, just based on the consecutive ip's and the telltale names.

Interesting, this same cluster is also set up to provide the backing infrastructure to do email tracking via embedded images.

Obviously these guys are set up to handle volume, so, that does prompt a question. Are there really enough people using this service to load up 3 mail servers in a cluster configuration ? Or is it possible they have the infrastructure in place for another business, and they are leveraging it to do this too ?

I just dont see the 'didtheyreadthat.com' business being large enough to swamp 3 machines processing the outgoing mail, and the incoming image connections. But, if this is just a sideline for machines that are spending the day tracking inline images on spam, it sure makes sense. A whole new business leveraged off existing infrastructure.

Re:DNS fun...

[shani]

Two things about fallback mail servers.

The first is that Internet mail has retry functionality built in. If your mail server goes off-line for a few minutes, most clients won't notice. It's not an immediate service like HTTP. Personally, I only have a backup MX for my personal domain because my box is physically located at my employer's office. The company could unplug it (permanently!) at any moment. People I trust - companies not one iota.

The other thing is, as other people have mentioned, this service relies on embedded 1-byte images retrieved by mail clients using HTTP. In this case, if their HTTP servers are off-line, the service is basically non-functional. In this case, having the MX delivery fail may actually be a feature. If the MX fails at the same time as the web server, you avoid having mail delivered when it can't be tracked.

Incidentally, this side-effect of having related service failures is one reason I think that the DNS requirements of having DNS servers available in multiple networks is probably bogus for many services. For a lot of companies, if you HTTP server is off line, why would you care that DNS is working? Why would you spend any time or money making your DNS more reliable than your web service? (My guess is that DNS weenies consider reliable DNS an end, rather than a means.)

Re:DNS fun...

[AaronD12]

Apparently they're not the only one.

% host -t mx mail.aol.com
mail.aol.com mail is handled by 15 yc.mail.aol.com.
mail.aol.com mail is handled by 15 yd.mail.aol.com.
mail.aol.com mail is handled by 15 yg.mail.aol.com.
mail.aol.com mail is handled by 15 yh.mail.aol.com.
mail.aol.com mail is handled by 15 za.mail.aol.com.
mail.aol.com mail is handled by 15 zb.mail.aol.com.
mail.aol.com mail is handled by 15 zc.mail.aol.com.
mail.aol.com mail is handled by 15 zd.mail.aol.com.
mail.aol.com mail is handled by 15 yb.mail.aol.com.

Slashdot readers can't read

[fasura]

didtheyreadit.com

not didthereadit.com

Mwaahahaha

[Anonymous Coward]

Now, for once, it is the PINE users who laugh at the world, and not the other way around!!

didtheyreadit.com's new domain name

[Skapare]

It seems didtheyreadit.com is looking at the same thing with a different view in mind. Their new domain name is: isyourrecipienttotallyignorantaboutsecurity.com.

Great

[t_allardyce]

Actually this is good news - now you can tell if someone has 'didtheyreadit' tracked you and do with that information whatever dasterdly dead you wish ;)

I feel some follow-ups comming on:

"doessomeonenottrustyou.com"

and the ever useful

"makesomeonethinkthatmyemailhasbeenhackedintobya ki dinchina.com"

Easy fix...

[jafiwam]

just put:

127.0.0.1 didtheyreadit.com

In your hosts file...

Or put an authoritative zone in your DNS servers if you have access.

Done, no query reaches their server.

Re:Easy fix...

[Nurgled]

I'll still be pretty hacked off the first time anyone sends me mail through this "service", because most probably my address will be on a short-cut to a spam address list.

Bah.

/bin/mail works too :-)

[billstewart]

Not only did they not see my test message when I read it from /bin/mail, they didn't see it when I downloaded it to Eudora and read it on line, which is probably because I don't download images while reading mail. I sent a copy to my fastmail.fm account, and it was able to detect that, but the thing hung around in infinitely-slow-download mode so it could detect when I closed the reading window, which doesn't seem to be a reliable process (I X'd out of that so it'd stop hanging, and I haven't gotten the update message that says I've closed the window, so I assume I never will.)

Re:fp!

[volkris]

Immoral? Howso?

SPF?

[forevermore]

So if you have to send email through their server, which adds a hidden tracking image and then resends the message, wouldn't all of this be blocked by SPF-aware servers? I can't even send orkut invitations out because they send "from" me and they're not in my SPF record.

Actually

[t_allardyce]

I've got a better idea, stick a porn banner in your email which links to a site on your server, then check the logs and see *exactly* how *long* they errr.. *read* your *email* and which page they *read* the most ;) ah probably been done

im *really* *really* sorry for the asterix's (spelling)

Re:Actually

[TheLink]

Don't forget that a 1x1 image may *not* be as *effective* in this case.

Can I Short This Stock?

[Anonymous Coward]

Seriously, the new version of outlook express due to ship with service pack 2 for xp, disables image loading for just this reason.

Say buhbye to your business model. When 98% of email readers no longer can be sniffed, your business is dead.

Can I short your stock?

Pale imitation

[qurly63]

didtheyreadityet is a pale imitation of ReadNotify.com. While imitation may be the highest form of flattery these guys don't even come close to matching our service. We've been in business for over three years, we offer way more features and our service actually works!

Re:Pale imitation

[Metasynaptic]

Does anyone see how this service works? I can't find the "view source" option in Thunderbird, but I *do* have remote image loading and JavaScript turned off, and it still detected my reading a message. So... what's the trick?

Re:Pale imitation

[qurly63]

Nice! Actually it was my first time posting on slashdot. Good to see the replies are relevant and intelligent.

Re:Pale imitation

[Anonymous Coward]

I call bullshit. You can't even remotely guarentee that you can track an email if the recipient disables java, javascript, and images in their email client (assuming they even use an email client and that it supports such options). Short of hacking into a server you can not ever guarentee such things. Buy a clue

--Devon

Re:Pale imitation

[Metasynaptic]

Well, of course you can't, and of course it's BS... the question is, how does the BS work? I *do* have images and JS turned off (or, at least, the settings show "off") so how is this working?

Re:Pale imitation

[TheLink]

They use multiple techniques - IFRAMES, javascript. Images - https, lowsrc etc. They encapsulated it all in base64.

Doesn't appear to work with Eudora (I've set it not to use the MS viewer and not to download images). I don't really recommend using Eudora as your email client tho. But don't use MS "Lookout" clients as well.

Are you sure you have images and JS turned off?

Probably a bug in your browser or misconfiguration.

For IE browsing I've got IE locked down even for the "My Computer" and Trusted zones - so most exploits that involve zone crossing in the hope of being able to run stuff in a different zone don't work. The trusted zone has no sites and has paranoid settings. I use a custom zone for my "trusted zones".

Re:Pale imitation

[TheLink]

Oops forgot. Another thing - because of the various techniques they used (base64 encapsulation, tons of javascript, image linking etc), the anti spam filter my company is using regarded it as spam, and blocked it. I had to get the email manually dequarantined in order to receive it.

Up to you to decide if this is a weakness in the antispam filtering or a weakness in the email tracking techniques, or both or whatever :).

Return Receipts?

[wheezer]

What the hell ever happened to 'em?

Is it because they don't violate anyone's privacy?

mailshell!!

[ResQuad]

Hey, if you like this, check out mailshell.com Its a nice lil service with lots of other features, and this "tracking" ability comes with it (not even mentioned on their site its such a small bit).

But mailshell does it the same way... img src=some_random_image_?4e3333333

You get the idea, it doesnt give you the geographical crap, but that info is always wrong anyways.

Yahoo and Hotmail image loading

[AzureLunatic]

Yahoo mail has the option to block all images from loading by default (not just in the sorted-as-spam bucket), warns the user when images are blocked from loading, and allows loading of images on a message-by-message basis.

However, this option must be hunted down and turned on.

Hotmail does one better, and allows you to block all images from loading by default, and set rules so certain senders' images will always load as well as viewing images in a piece of mail on a case-by-case basis.

Sounds like a job for .... Hostfile!!!

[Aging_Newbie]

Just put didtheyreadit.com as 127.0.0.1 in your host file and no image loads regardless of whether you have html mail enabled.

Big problem: instant open relay

[bigberk]

I signed up for a free account. It does work, it's fast and convenient enough. But there's a major problem...

INSTANT OPEN RELAY.

All a spammer has to do is forge their From address (the only means of relay authentication!) and append .didtheyreadit.com to any victim address, and dtri1.rampellsoft.com will relay the message to the victim. I'd say this service has a 10% chance of survival.

Re:Big problem: instant open relay

[rusko]

given that they would have to *know* the e-mail address of a registered user and would be limited to the number of e-mails said user paid for, they hardly have anything to worry about. spammers are not going to go bruteforcing e-mail addresses to send 50-100 messages when they have real open relays , botnets and chinese servers galore.

paul

Re:Big problem: instant open relay

[Geotopia]

Let's say that I monitor incoming SPAM for a while. I pick up a pattern for the DidTheyReadIt relays (that's all they are) by looking at headers or monitoring inbound traffic on my POP server. Then I take one (or many) of those email addresses I've identified as coming through "DidTheyReadIt" and forge it/them in the from: field and then append the appropriate tag to the end of the to: addresses. Now all those will relay through the DidTheyReadIt servers, racking up charges for the forged from: senders and tying up their service. This thing is as doomed to fail as the basically flawed SendMail structure that fails to certify the sender and got us in this mess in the first place.

I could have some fun with this sending email from known spammers back to other known spammers and put it on their tab for a change.

Email is dead as a useful form of communication - let's just face it and find something new!

Re:Big problem: instant open relay

[Anonymous Coward]

spammers are not going to go bruteforcing e-mail addresses

Just like spammers don't brute force guess email addresses to spam. You can be that a spammer somewhere will be trying this out right now.

Re:Big problem: instant open relay

[rusko]

please think before you hit that submit button.

if i am bruteforcing (common) email addresses at *known* domains, i have one unknown (with a bounded set of possible values), an acceptable chance of success and the reward is getting the message to a set of eyeballs. this reward apparently can not be achieved otherwise for this specific spammer, hence the use of bruteforcing.

bruteforcing, by the way, is a proportionately uncommon technique among spammers and is usually used against domains with high namespace population density.

if i am bruteforcing someone's didtheyreadit.com account, i have two uknowns (email address and domain, with a very large range of possible values), hence a reasonably low chance of success and the reward is being able to send 5 to 750 messages. the spammer must obviously be able to send spam *already* and wherever he sends spam from must be able to handle abuse reports, since you can be darn sure such abuse would be loudly reported.

spammers know their math - they are all about numbers. this is simply not financially advantageous in any way.

this is all *assuming* that they would be able to engage in said bruteforcing and having bruteforced the source e-mail address, would be able to send a large number of messages in a short amount of time.

without going into much detail, i would assure you that a successful bruteforcing attack would not be possible.

paul

Re:Big problem: instant open relay

[rusko]

let's analyze what you wrote, although it is hardly worth the time given that you haven't taken the time to think about the issue.

> Let's say that I monitor incoming SPAM for a
> while.

'SPAM' is the food, 'spam' is what you probably meant.

> I pick up a pattern for

and how would you pick up anything about didtheyreadit from spam, considering that none is sent through it? (too expensive for spammers to use).

> the DidTheyReadIt relays (that's all they are)

any MTA that accepts mail for non-local delivery is a relay. your statement was superfluous.quite obviously, custom processing is involved; as such, it is hardly *just* a relay.

i'll give you the benefit of the doubt and presume that you meant '*open* relay'. open relay is defined as a relay that does not perform authorization on relayed messages, allowing anyone to send non-local mail through them. obviously, didtheyreadit performs authorization and processes mail sent from an account holder's e-mail address only. this is hardly 'open'. this is just another form of authentication, just as pop-before-smtp is a form of authenticationn commonly used on general purpose mail servers.

clearly, this form of authentication is not suitable for general purpose mail servers where the sender's domain is a known value. this is not the case with didtheyreadit.

> by looking at headers or monitoring inbound
> traffic on my POP server.

you will be monitoring for a long time - the only incoming traffic received by your pop3 server is going to be commands from the MUA dealing with message retrieval. please go ahead though, perhaps it will improve the signal to noise ratio on /.

> Then I take one (or many) of those email
> addresses I've identified as coming through
> "DidTheyReadIt" and forge it/them in the from:

right. given the penetration of didtheyreadit, you are not very darn likely to get even one address. how many spammers control servers with a high-volume of real incoming mail?

> This thing is as doomed to fail as the basically > flawed SendMail structure

sendmail is an MTA. are you referring to smtp perhaps? noone argues it is ideal; a lot of the ietf protocols have problems.

i'm sure you have a great idea for a new messaging protocol. i'm equally certain it will be just as successful as ipv6.

> that fails to certify the sender and got us in
> this mess in the first place.

you are welcome to go back to X.400. i'm pretty sure you have no idea what that is, but feel free to google.

> I could have some fun with this sending email
> from known spammers back to other known spammers > and put it on their tab for a change.

if you find a spammer willing to pay what didtheyreadit charges to send millions upon millions of messages that they regularly send, you have just made a fortune. just don't go spending it all in one place.

> Email is dead as a useful form of communication > - let's just face it and find something new!

i'm sure you have an issue with TDM too. you don't? interesting.

please go ahead and use something else. have fun talking to the other kiddies on IM or the folks in siberia still running X.400. i think i'll still be replying to all of our customers' emails, thanks.

cheers,
paul

If you don't open it, it still comes.

[Anonymous Coward]

There's no way it can tell if I read a message, when I have my email client trash anything that looks vaguely like spam. I know that I've probably lost a few messages, but I haven't gotten anything above my ankles, while many are having to use hip waders.

This is easily defeated....

[EmagGeek]

by using a text-based email proggie... like pine... I just tried it...

It is also defeated if you tell Outlook to display all messages in plaintext.. just tried that, too...

*sigh*

Re:This is easily defeated....

[Anonymous Coward]

It's also defeated by web proxies that are set to block them. I recommmend privoxy, the descendant of that wonderful web proxy JunkBuster.

Paranoid Annoying Emailers

[NitsujTPU]

Things like this remind me of the most paranoid, annoying, emailers that I deal with daily. Something like 1 in 1000 emails are the type that I would ever stick a receipt on. For the most part, even those I would ask for a friendly reply in the text at the bottom.

At work, I am somewhat compelled to use outlook. Here's my favorite setting:

1) Automatically unflag incoming messages:
-Think noone reads your email? Why not flag every message you send. That way, they'll all look importat... or, the important ones will get lost in the see of red flags.

Do any of you have settings that would be good in Outlook?

Re:Paranoid Annoying Emailers

[BillX]

The 'Uninstall' setting.

(ducks)

Re:Paranoid Annoying Emailers

[Ironica]

Do any of you have settings that would be good in Outlook?

At my work, I finally filtered out all mail that was sent to the "-All Mail Recipients" list. It was almost always about supervisor training, safety standards that only applied to half the employees, someone's retirement or request for TOWP donations (I'm an intern, I don't get TOWP!) etc...

Claims about the service

[Anonymous Coward]

They never actually claim that every message will be tracked. Their "how it works" section claimes a 98% success rate, which I am a bit dubious about, considering how many people probably use text e-mail readers or have images turned off.

They're on somewhat shakier ground when they claim that the recipient won't know the e-mail is being tracked since, thanks to reading slashdot, anytime I see that url in an e-mail I'll know someone's trying to spy on my inbox.

Re:Claims about the service

[Chop]

They never actually claim that every message will be tracked. Their "how it works" section claimes a 98% success rate, which I am a bit dubious about, considering how many people probably use text e-mail readers or have images turned off.

Humm... 98% success rate, Internet Explorer has a 98% market share. Nah, those stats could not be related. Oh, and yes I am new here, thanks.

Chop

Re:How it 'works' - stupid webbugs

[Anonymous Coward]

I work for an e-commerce company Zoovy.com (http://www.zoovy.com)- we've had this "did they read it" functionality built into our product for over 5 years. We use it to determine if we should leave people negatives on eBay because they're just ignoring the payment reminders.

This is nothing novel, new or innovative.

I bet they'll try to patent it though. Arrgh..

Append a subdomain, eh?

[BillX]

it involves redirecting all mail to be tracked through their servers by appending "didtheyreadit.com" to your recipient's email address.

Maybe they should team up with this company.

"Every single internet provider"?

[Megane]

DidTheyReadIt works with every single internet provider and e-mail account, including EarthLink, AOL, NetZero, Juno, Netscape, Hotmail, Yahoo, and much more.

Guess what folks. There's no law that says you have to let a megacorp run your e-mail. With a fixed IP and a 24/7 server, you can run your own server. (Though, admittedly, it's not something a novice can make work.)

All this is is simple "web bug" HTML IMG link spying. Anyone with any kind of sense has configured their e-mail client to not automatically download remote images. Or even to not display HTML crap at all. And please don't tell me that they use Javashi^H^Hcript, because that means there's a brain-damaged popular e-mail program out there that allows it (or a webmail site that doesn't filter it). All we need is another way for e-mail to run wild code.

Is anyone else getting a flashback to the all the stupid ideas that would burn through millions of dollars in VC cash back in the dot-com bubble days?

Re:"Every single internet provider"?

[The Master Control P]

"Guess what folks. There's no law that says you have to let a megacorp run your e-mail. With a fixed IP and a 24/7 server, you can run your own server."

Except that getting the same connection speed with a static IP vs dynamic goes from $30 to $60+ per month, just for the static IP. Plus exposing yourself to the flood of digital diharrea on the internet.

Re:"Every single internet provider"?

[Anonymous Coward]

>> DidTheyReadIt works with every single internet provider and e-mail account, including EarthLink, AOL, NetZero, Juno, Netscape, Hotmail, Yahoo, and much more.

> Guess what folks. There's no law that says you have to let a megacorp run your e-mail. With a fixed IP and a 24/7 server, you can run your own server. (Though, admittedly, it's not something a novice can make work.)

Sure a novice can make it work. I mean, really, a novice would have a hell of a time setting up sendmail, but that's one of the good reasons why we have Postfix, Exim, Qmail, ..... Hell, it doesn't take /that/ much to set up Exchange Server (although I certainly wouldn't want to see a novice trying to secure /that/).

Re:"Every single internet provider"?

[BenjyD]

Except that getting the same connection speed with a static IP vs dynamic goes from $30 to $60+

No it doesn't - my static IP 512k ADSL costs me $33/month (19GBP). I could choose to have a dynamic IP if I wanted, but the default is static.

Re:"Every single internet provider"?

[Epsillon]

All this is is simple "web bug" HTML IMG link spying. Anyone with any kind of sense has configured their e-mail client to not automatically download remote images. Or even to not display HTML crap at all. And please don't tell me that they use Javashi^H^Hcript, because that means there's a brain-damaged popular e-mail program out there that allows it (or a webmail site that doesn't filter it). All we need is another way for e-mail to run wild code.

Yup. What's more, spamassassin spots it and tags it if you so desire, so even if you really *must* view HTML (I don't, nor do I wish to) then you can filter on this. Also, if you use ffproxy, it's a simple task to disallow traffic to the server in question.

All of which makes me deliriously happy. Idiots spying on our email and collecting IP addresses leaves me feeling a little cold for some reason, not to mention the possible question of "Is this bandwidth theft?" since the recipient has certainly not requested the URL of the tracking link, nor have they authorised it. Food for thought.

Re:"Every single internet provider"?

[The Master Control P]

Well then... I don't suppose I could find thier service in Southern California? Who are they?

Re:"Every single internet provider"?

[BenjyD]

It's a UK ISP called Plus.net. Unfortunately, they're only in the 51st State.

Outlook 2003

[mjeaslick]

By default Outlook 2003 blocks all images from being downloaded in a message to prevent these 'bugs' from working for the spammer.. Unless you turn it on to allow images to appear. Incase this hasn't been brought up yet..

First time I get one of these...

[jridley]

First, it won't work on me because like everyone else here, I've blocked external images from email.

Second, I'll send a nice little return email, thanking me for giving my email AND theirs to the spam databases.

This is a nice little scam.

Picture of Alex Rampell?

[Anonymous Coward]

Here's a Alex Rampell of Rampell Software, Cambridge, MA. (Not Florida, so it may be quite wrong.)

However, there is a Rampell Software in Florida:

RAMPELL SOFTWARE, LLC
PRINCIPAL ADDRESS
122 NORTH COUNTY ROAD
PALM BEACH FL 33480

MAILING ADDRESS
122 NORTH COUNTY ROAD
PALM BEACH FL 33480

Registered Agent
Name & Address
RAMPELL, RICHARD
122 NORTH COUNTY ROAD
PALM BEACH FL 33480

Manager/Member Detail Name & Address Title
RAMPELL, ALASTAIR M MGRM
122 NORTH COUNTY ROAD
PALM BEACH FL 33480 MGRM

Re:Picture of Alex Rampell?

[whoever57]

At the same address is The firm of Rampell & Rampell, PA

A multi-talented family? Accountants, Software, and now a web-based business.

The software seems to be keyloggers and others.

Re:Picture of Alex Rampell?

[Anonymous Coward]

Alex Rampell graduated from Harvard, which is in Cambridge. This is kind of bizarre. I know his sister. Alex Rampell was on NPR's Talk of the Nation on May 20. Link here (scroll down some).

It's a scam, and here's how I know

[BillX]

I have identified this service to be a scam using the "superfluous female person standing next to logo" method. I'm still wondering where her headset went, though...

Re:It's a scam, and here's how I know

[Anonymous Coward]

I have identified this service to be a scam using the "superfluous female person standing next to logo" method. I'm still wondering where her headset went, though...

The company I'm working for right now has one or two of those logos lurking around. We're not scammers.

Re:It's a scam, and here's how I know

[mkendall]

My favorite example of this is a manufacturer of programmable microwave signal generators, www.aprilinstrument.com

Re:It's a scam, and here's how I know

[kilogram]

I have identified this service to be a scam using the "superfluous female person standing next to logo" method. I'm still wondering where her headset went, though...

When most scammers use this technique, they usually try the "Superfluous beautiful female person standing next to logo"-version. But then again, this is slashdot.

woohoo... an open relay

[jamesh]

spammers are going to love this!!!

Re:woohoo... an open relay

[jzap]

The "free" account is limited to 5 messages. The paid-for accounts are limited to 500 or 750 messages a month. Hardly worth it for a spammer.

Re:woohoo... an open relay

[jamesh]

yeah. the more i thought about this, the more i realised that while it would be easily exploitable by a spammer, it would require an order of magnitude or two more effort than existing methods which (looking at my spam folder) are working just fine.

Outlook solution: check read as plain text

[j_dot_bomb]

Outlook solution: check read as plain text. Stops most viruses as well.

Wonder how it compares with ReadNotify

[Krellan]

There is another company that claims to do this, ReadNotify.

It looks to be exactly the same kind of service as Didtheyreadit.com.

I first became aware of this company by reading Mozilla's bug report 28327 - http://bugzilla.mozilla.org/show_bug.cgi?id=28327 (cut/paste URL and open in new window).

Mozilla/Thunderbird also has trouble completely blocking all server contact in email, as it evidently doesn't sandbox the email environment enough (images may be blocked, but stylesheets and other external URL's can still leak through, last I checked).

BTW, there is a workaround if you use Mozilla/Thunderbird: set your View/Message Body As settings to "Simple HTML", or better yet, "Plain Text". This works 100%!

Monster does that with their email

[Anonymous Coward]

I think. Even their alerts about phishing emails. Said I should go here which supposedly redirects you to http://www1.ifccfbi.gov/. I suppose if everyone clicked on this it would really confuse the little web buggers.

This could be FUN! Re:How it 'works'

[Anonymous Coward]

Yeah, this could be fun! Imagine...

Imagine a mail filter that modifies the code that
is in the traching URL, randomize it a bit.

Or a page filter that changes the tracking code each time it is viewed...

Or get together with freinds, cross send the tracking codes that you each get and the originator will get quite confused.

Or set up wget to keep "reading" the same mail
over, and over, and over, and over, thus innundating the originator with reports.

Or grep all the tracking codes out of your mail box into one web page posted on your website
(or in an article posted on /.)

Or create a tracking code generator that feeds its
output to wget.

I wonder if we could feed these things to spammers?

Oh, this could be fun...

block for every mail client

[Anonymous Coward]

didtheyreadit.com 127.0.0.1

Re:block for every mail client

[Anonymous Coward]

Won't work.

"ellen@aol.com.didtheyreadit.com instead"

so you would need to add:

127.0.0.1 aol.com.didtheyreadit.com
127.0.0.1 btinternet.com.didtheyreadit.com
etc
etc

As a link... and another way to mess them up...

[Xtifr]

And here it is as a link, so you can see what it is that they're sending. Note that it takes a really long time to download. Be patient.

Seems to me like it could be fun to try generating some random numbers to see if you can find which ones are actually valid tracking numbers in their system. (Note that invalid numbers respond with a zero byte file instantaneously, so you can quickly try again.) Of course, that might interfere with the reliability of the information they claim to provide, so if you think these are nice guys offering a valuable service, you probably don't want to do that! :)

Re:As a link... and another way to mess them up...

[The Kiloman]

Ahh, so that's how they track how long you looked at the message. As long as you have the message up, your client keeps the socket open, trying to load the image. They send you the image content at a rate just fast enough to keep the client interested. (If I cared, I'd run a TCPDump and get numbers.) When the socket's closed, they think you've stopped looking at the message.

They're probably also relying on quirks in the Windows / IE network code... something about Linux or maybe Mozilla gives up, calls the image done, and closes the socket after 2 minutes, whereas IE will keep trying until the parent frame or message is closed. That would explain why it took me ~2 minutes to load the parent post's link, and why it said that the reviewer only read the message for 2 minutes.

Gotta luv firewalls

[Anonymous Coward]

or for those of us that want to protect several computers in one step. Go to your firewall/router (I know you have at least one becuse you own 5 computers, and two that don't work) :-P and tell it to block address didtheyreadit.com

Now your blocked from didtheyreadit.com, and all sub-domains there-in for any computer on your network in one easy step even my mother could do.

Similar approach

[TheLink]

Put:
a.b.c.d didtheyreadit.com

In your DNS servers or hostfiles, where a.b.c.d is an address of a webserver you control.

I did something similar on April Fool's day in the company I worked for, and users instead of getting banner ads from ad.doubleclick.net and similar sites were getting our corporate logo[1].

Only a few people seemed to notice. Maybe it means people aren't surfing sites which link to these ads at work (includes *.yahoo.com etc ). Or they can't be bothered to mention it? Or their conscious brain has started filtering out ads.

[1] I never got around to putting messages like "Company ABC Staff Meeting at 2pm". :).

If I were like Amazon and gang I would patent the idea, but to me this sort of stuff is obvious to anyone skilled in the field.

Slashdot THIS, suckas!

[Anonymous Coward]

What happens if someone posts one of their Web bugs on a popular site?

Re:fp!

[senatorpjt]

OK, so, who's going to set up a free service that duplicates what DidTheyReadIt does. It uses almost no bandwidth (you're only loading a 1x1 pixel image off a webserver). I'd do it if I had any hosting capability whatsoever.

The entire point of a free service would be 1) to educate people as to why this is pointless and 2) to make it unprofitable and drive these people out of business.

Tracking HTML e-mail without images or JavaScript

[Kent Brewster]

You can do this without using an image or JavaScript, and give away nothing in the source of the message. Here's one way, using Apache, .htaccess, and PHP:

1) In the header of your HTML e-mail message, load up a style sheet:

<style type="text/css">
@import "http://your.server.com/your.css";
</style>

2) In the server directory containing your CSS file, add the following line to .htaccess:

AddType application/x-httpd-php .css

Any file ending in .css under this directory will now be run as if it were a PHP script.

3) Save this as your.css:

<?php
require "track_message.php";
?>

Done. No images, no JavaScript ... any reader that accepts HTML messages will trigger track_message.php, and nothing unusual will be visible in source code, even if some curious person pulls down http://your.server.com/your.css to take a look.

I though this was new in 2000

[ry4an]

Back then I created a project on sourceforge called Mail Receipt. I was way wrong; the idea is as old as the hills.

Well... at least no false positives.

[WoTG]

If someone thinks that the recipient hasn't received the message, they can send a followup. No biggie. This service, if programmed properly, doesn't have false positives - so, for a lot of people, it could be useful. Unfortunately, going forward, it will be less and less useful as email services and spam filters and antivirus programs start filtering out linked images.

No, this isn't new... a friend of mine was using a similar service at least two years ago. I can't recall the exact site though.

Re:Well... at least no false positives.

[grahamm]

If the recipient not only reads the email but replies to it when the tracker says it has not been read, will this cause 'average Joe' to doubt the accuracy of other 'not read' reports?

Re:Well... at least no false positives.

[nahdude812]

Given that it re-routes all the replies through their service, I'd wager that they are at least smart enough to mark a message as read if they get a reply for it through their network.

Great idea... How about this though?

[Anonymous Coward]

So what if someone starts a service called "ProtectMyPrivacy.com". It would have a small script/installer to download that adds that to your hosts or equivalent file, but redirects to ProtectMyPrivacy.com's servers. Then the image would sent back by the server would be a warning icon or something.

Heard about this on NPR interview last week

[kc8jhs]

The shocking thing was, in the interview, the founder/inventor(not)/designer/coder whatever he was, claimed that large large portions of mail actually gets lost on the internet.

A gentleman called in from a design engineering firm who emails large documents to other members of the firm and other associates around the country. The "expert" insisted that the didtheyreadit.com was the perfect service for them to assure that their emails made it there and were in fact read.

My question was this, how does email between two people who regularly email each other, and are probably expecting it, "get lost"? This was a major point that the guy was making, which seemed to me like he was spreading classic FUD.

Lets make sure that our friends aren't using this product for those reasons! Assure them that undeliverable mail will be properly reported back to them always, and show them how to set their mail clients to always accept mail from those in their address books!

-Mikey P

just use a 1x1 image

[pingus]

if you know that your target address to be tracked uses an HTML reader, just set up a home webserver with a 1x1 pixel graphic and include it in the mail. when they read it, the image will load quickly, and then you can grep your /var/log/httpd/access_log or whatever for the name of the image. it's crude and it's the oldest trick in the book, but it works great for me when dealing with naieve wankers at school here.

Seems like it would break any signatures.

[EMR]

if they alter the e-mail message and add in that 1 pixel gif image to track the viewing of the e-mail, then a GPG, PGP, S/MIME signature would be useless as they have altered the body of the message.

Re:April's not a scam, and here's how I know

[Anonymous Coward]

How can you say the woman at April is superfluous? She is holding up a piece of instrumentation and is there to draw the average viewer's eye to the equipment. That is hardly superfluous.

Implanting Webbug Images With Eudora?

[BigBlockMopar]

Nothing special, just "Webbug" images, which spamfilters such as SpamAssasin (in the default setting) adds point to as more likely to be spam, so using DidTheyReadIt users mail is more likely to end up in a spamfolder than any other type of mail.

For sure, and this was my first thought, and the best way to have made it DidTheyReadIt work.

Based on the testimony and description, though, I'm concerned about the possibility that they might just be a slick-looking e-mail address collector for spammers.

Somewhat related: Anyone know how to implant a webbug image with Eudora? Eudora seems to embed images by MIME; it doesn't seem to handle an IMG tag pointing to an HTTP server. Would be useful with independent consulting; "freaking out" people by telling them exactly when they viewed their e-mail would be a handy way to break the Outlook and "but I like all the pretty pictures in my e-mail" habit.

Question:

[dysprosia]

Did "Did They Read It" read it?

Talk of the Nation

[matrix0f8h]

NPR interview with didtheyreadit founder

Whoops - the marketing SPAM backfired...

[HarryZink]

I was the recipient of Ricardo Batista's marketing spam announcing this 'service'. Noting several problems with it, I replied to his e-mail (doing a 'reply all'), and informed him not only of my concerns, but also pointed out that now all the morons thinking they get $5,000 from Bill Gates and Walt Disney Jr. will resurface with renewed efforts to convince their famiies to forward mail "because now it can be tracked, here's proof..."

Well, turns out that Ricardo had a 'setting' wrong on his mail server, or whatever, as my response to him was also broadcast to his entire spam list.

- He neglected to supress the recipient list.
- 'customers@batista.org' was aliased to his customer list.
- He allow any non-local reply to take advantage of that.

As confirmation, Ricardo sent me an e-mail pointing out *my* mistake in replaying 'all', and the subsequent deluge of 'bounced mails' and other recipients responding pretty much corroborated this.

Whoops.

Granted, this is a simple mistake that could happen to anyone (well, not really) but doesn't paint to rosy a picture of someone claiming to provide an expert e-mail service.

I have no idea why someone like Ricardo Batista would jump on doing something so obviously silly and transparently flawed (I guess rent needs paying), but I wonder how mnay (if any) people will fall for this.

Harry

Re:Whoops - the marketing SPAM backfired...

[Anonymous Coward]

Looks like he patched it. At least for people who weren't sent the message initially.

Now if everyone reading slash dot was to test sending email to customers@batista.org it would be a wonderful thing.

ha ha ha.

This isn't new..

[efextra]

I have been using this for over a year.

Extremely easy to Code yourself???

[Anonymous Coward]

Just setup a server that will:

1. Handle cgi and mail
2. Foward all the mail sent to it by parsing the subdomain
3. Add in a img link to a cgi script on same box.
4. Write a CGI to take in an ID number and send out a new email to author everytime the thing is called.

How much are they charging for this?????

Hell, if you add in the image to the bottom of every single email you send, you could run this thing completly anonymously from any free-web host that lets you run cgi scripts....

Here's my tracking code...

[Anonymous Coward]

http://didtheyreadit.com/index.php/worker?code=2f7 621ffef56d47760ab1408510d6995

Blocked

[supun]

#1 SpamAssassin

In my .spamassassin/user_prefs added ...

score HTML_WEB_BUGS 20

That will throw all emails with a web bug right in the spam pile. I don't just delete my spam. I normally go through and check to see if any valid emails got tossed in my spam folder.

#2 Privoxy

In my user.action added ...

{ +block }
.didtheyreadit.com

That should block any web page that links to that site. I could have just put 127.0.0.1 for didtheyreadit.com in my hosts file, but if they start putting subdomains in from of their domain name, it won't work anymore.

Service

[Anonymous Coward]

What about the following idea: a service that you can forward your received e-mail to, to filter out any special images that are there to track what you are doing.

Simple!

[le_jfs]

echo 127.0.0.1 didtheyreadit.com >> /etc/hosts

Re:How reading comments 'works'

[Anonymous Coward]

Try "nested" at -1, then you won't have to rant on about something that already has a bunch of responses
and somewhat rare for /. - a retraction by the op...

Lets send some 10Mb big messages..

[Anonymous Coward]

just to /. their email servers..and make their clients happy..

Poor ellen@aol.com ...

[biet]

Getting Started: Now that you are a member, all you need to do is add ".didtheyreadit.com" to the end of the recipient's e-mail address. For example, if you were sending an e-mail to ellen@aol.com you'd just send it to ellen@aol.com.didtheyreadit.com instead*, and your email will be tracked.

Education

[Alain Williams]

This is absolutely brilliant, I shall add it to the list of examples that I talk about when I try to convince people that HTML email is bad for security/privacy and has few real advantages over plain text.

They may have their patent sticker but. . . .

[WinterpegCanuck]

Can this really be a valid patent? I mean it is describing a method to defeat a specific instance, but it is using http standards that have already been defined. It is like having scissors used for cutting paper but using them to cut ribbon at christmas time. Just because it passed the clerk at the office, does it really stand a chance of passing a reasonable man test in a court?

Re:They may have their patent sticker but. . . .

[HuguesT]

It would be very likely to put up a good fight in court, because it is novel, useful and non-trivial. What you are complaining about is equivalent to saying that a piece of software written in the C language cannot be patented because the C language is an ISO standard.

Re:They may have their patent sticker but. . . .

[julesh]

I'm sorry, it isn't either novel or non-trivial. I've been using this technique since 1997, when I read it as a recommended technique in a book on CGI programming that had been published years before.

It is obvious. In fact, it's about the easiest way of solving the problem of a CGI script that produces an image, let alone cache-busting.

Re:They may have their patent sticker but. . . .

[ciggieposeur]

I saw two separate patents related to the same technique. I'm not sure where the novelty is claimed to be. It's not the simple fact that a parameter is on the SRC tag since that has a lot of prior art; I *think* it's described as a method to collect the logfile data even when a caching proxy is in the way. The original filing date is somewhere around 1999.

*I* never filed for patents inside IBM. I'd probably have about five by now (~ $3000) if I had, but I like to be ethical.

Re:They may have their patent sticker but. . . .

[WinterpegCanuck]

I know logically this is the case, but the difference to me is the magnitude. Can one really expect to patent their five line "hello world" program? The 302 method is already a defined standard in the RFC, which is the only reason that this approach would work for IBM. I can see if they created a new plugin or had the standard adopt their method, it would be a valid case. The transportation department puts in a turn right lane to the road to my house. If am am the first one to make that right turn, can I patent that instance of using the existing method?

Re:They may have their patent sticker but. . . .

[HuguesT]

The parent asked if the technique can be patented, not whether it should.

The technique is not obvious. It's obvious to you because you've read about it in a book. In hindsight most things are obvious, even Relativity.

Now it was obviously novel at some point. Will the USPTO look into books for reference to prior art? I don't think so, what matters is whether the technique has been patented before. In all likelihood the patent will be granted unless someone has patented it before.

Now in court, if you want to challenge it you can use books and papers and prior art and in this case maybe the evidence is compelling.

In one fell swoop you've described what's wrong with the patent system today. The USPTO and other patent offices in Europe and elsewhere don't have the resources or the skills or the patience to look for prior art in depth.

Call me crazy. . .

[WinterpegCanuck]

. . . but maybe I am missing the obvious. Couldn't you just always ask the recipient "Did you get that e-mail/memo/TPS Report?" I mean are phones and dialogue really that uncool and inapropriate in modern society. Or maybe just include at the bottom of your e-mail "Please reply, Sincerly, Joe Somebody"

I dunno, I am going back to that bright, sunlit place full of people on the otherside of the door.

DidTheyOpenIt...

[perly-king-69]

is a better title, for if this dubious technique works it can't tell if someone actually has read a message.

One suspects that that technology is some way off.

Here's How They Time the View

[jzap]

They put a 1x1 image in the HTML e-mail with a (long) unique number in the SRC URL. The unique number identifies the sent message. When your e-mail client tries to fetch the image, they send the header right away (type=image/jpeg), but they trickle the data to you at one byte per second. This keeps the connection open for as long as you view the message. When you stop viewing the message, the connection closes, and their timer stops.

I'd show you what a dump of an 118-byte-long version of their JPEG image looks like, but the Slashdot Lameness Filter didn't like all those "junk" characters! However, you can view the dump here: http://jzap.com/img/ReadItBug.jpeg.txt

Re:Tracking HTML e-mail without images or JavaScri

[Anonymous Coward]

AddType application/x-httpd-php .css

Or, cleaner and more idiomatic, in any Apache not dating from prehistoric era:

AddHandler php-script .css

This is lame...

[dzfoo]

Its lame! It works by inserting a "webbug" in the HTML e-mail. Spammers and "bulk commercial email marketers" (spammers!) have been doing this for a while now. Its no big deal. Nothing to see here. Move along.

All you have to do is disable the opening of web images in your mail client or set it to render as plain text -- most (good ones) do this by default anyway. And I think M$ even allows this to be done in the latest version of OE.

-dZ.

Security?

[JamieKitson]

It seems you can sign up with a totally ficticious e-mail address. ie you can send mail "from" anyone.

Re:fp!

[ArsenneLupin]

I know here in Denmark there've been several companies who've got bad publicity because of using said method.

Company exec: So, Mr customer, are you still happy with us?
Customer: I would really like to ask bigCo why you felt it was necessary to spy on us like this...
Company exec: I think we've already answered that question, I'm sorry customer. So are you yes, no, abstain?
Customer: I think we wouldn't, we're not hap...
Comapny exec: I assume you're still satisfied with our service
Customer: We're not happy.
Company exec: Are you 80% happy?
Customer: But... I think we...
Company exec: We don't need you to be totally happy. None of us are totally happy
Customer: Oh, I know that, I know that.
Company exec: If we were, we wouldn't be here!
Customer: I think we're not very happy about the breach of privacy, but I think we would, we would...
Company exec: Thank you very much.
Customer: ... still continue buying your product, which nobody else carries.
Company exec: Thank you very much, valued Customer.
Ladies and Gentlemen, I'm happy to say that none of our customer objected to our recent e-mail campaign, so thank you all very very much indeed, and thank you to agent Big Brother for implementing our wonderful mailing software.

The Danish are so easy to convince, why worry about bad publicity? Just shove them around a little bit, and they'll eat out of your hand!

(SCNR)

Just use kmail default settings

[neves]

Kmail doesn't load external images. They won't be able to track you. Easy.

Now I know what to filter on

[TooLazyToLogon]

I have now set up my email filter to delete off of the server any email that contains "didtheyreadit". Any email that includes this "didtheyreadit" is guaranteed to be spam. I hope all spammers use "feature".

ISPs block this (my test results)

[Dracanna]

I followed many of the posts so far about this, and I do understand why an email client will see the relayed messages as Spam. What I wasn't aware of was that the ISP may also see it as spam, making it impossible to send to anyone at a particular domain. Using didyoureadit I sent two emails to myself, each account being on a different ISP. I sent both messages from my same gmail account. Sending was flawless. The first message did work, although Thunderbird acted odd when I opened that message (so much for this being invisible). The second message seemed to vanish in the ether for awhile. The next day a bounced message appeared back at gmail: "Barracuda Spam Firewall to me - 2:34am (8 hours ago) " Even (not!) cooler than that, a view of the didyoureadit email log shows this email is still waiting being opened. Talk about bad design! There is no warning at all about this on their web site, and there is no way I could ask my recipient to turn of his *isp's* spam filters. I return to the didyouread it site. Now I notice there are *no* help files covering any problems, troubleshooting, or spam filters. I would love to have asked someone, but their user support phone number was conspicuously absent. Hmmm. I think their should change their domain name to did-you-think-this-would-really-work?.com

Re:How it 'works' - Same in outlook.

[AyeRoxor!]

Turn your preview window off (duh)

Right-click on a message, go to properties.
On the details tab, click Message Source.

Net Complaints (and unmeetable requriements)

[IBitOBear]

The company will get compaints from the normal lusers when they see that some of their contacts clearly have read the message (because, for instance, they replied to them) but there was no confirmation (because their track-ee has images blocked.)

It's just dot-bomb nonsense.

Besides, how soon will it be before someone figures out that mid-relay tracking for spam (you know, this came through butt-heads-R-us, we will reject it) plus intrusive crap == nobody is reading any of my mail at destination-X

And the web-bug does nothing to tell "how long" a user looked at your mail unless the very next mail message is also bugged, and unless the target user never opens more than one message at a time. (e.g. people who only read their mail in the outlook preview pane.)

"Gee, he really loved that joke." beting the response to clikcing on next-message and going home. /sigh... 8-)

While techically true.

[/dev/trash]

With a fixed IP and a 24/7 server, you can run your own server. (Though, admittedly, it's not something a novice can make work.)

Where do you think 98% of the people would GET the static IP from?

That doesn't work

[TBone]

your firewall rules should allow your email client to make connections to your mail server ONLY

You assume a network of one - one computer running one firewall.

I have just one computer attached to my Internet-facing network: the Linux box that serves as a NAT/firewall proxy. That is all it does - the PC's inside, all running Windows, know nothing about how to get out to the network, and they have 192.168 private addresses, so nothing inside me network knows how to speak to the net in general.

Your firewall shouldn't have to be able to filter out requests per application, your email client should be smart enough to not render HTML in previews in the first place :)

DNS redirection

[simoncion]

Don't services like dyndns.org, EasyDNS, Hammernode, and etc. replicate the functionality of a static IP?

-Avatar

Re:DNS redirection

[/dev/trash]

Sure. But when someone says static ip, I assume they mean truly static.

Prior Art?

[sorbits]

I thought this was the standard approach for web-services (to return a redirect when the resource returned changes with each invocation of GET), exactly to avoid problems with caching? But perhaps this convention was "invented" after the patent...

Also, what if I use a redirect for other purposes than to avoid caching?

ah, procmail

[pwiringa]

procmail+formail to strip the DTRI tag out of the message and maybe prepend the subject or body with something like "[sender is a nosey ]".

don't know if procmail & formail can be used to generate new messages to send out but a carefully crafted response, such as "my, my, you're a nosey <same expletive>, aren't you?" could be in store.

DNS Redirection vs. Static IP

[simoncion]

Functionally,is there a difference?

On the surface, no.

[/dev/trash]

But my whole point was that the static IP was most likely being bought from one of the 'evil' corps. The same can be said about dynamic IPs as well.

DidTheyReadIt.com uses hidden HTML img tag

[fdavis99]

If you use an email viewer that displays HTML email, then messages sent via didtheyreadit.com will record that you've read them when your viewer fetches the invisible image. They embed a transparent 1x1 image in the HTML email, coded with an ID that tells their Web server that the message was read. This is the same method used by many spammers to verify that an email address is real--if you even open a spam message in an HTML-capable mail reader they know yours is a real address. On yahoo mail you can turn off display of HTML graphics for this very reason. My test of didtheyreadit.com didn't register my reading the message at yahoo until I clicked "show HTML Images". Hmmmmm... it's sneaky. It's using a spammer trick for personal monitoring of one's own email. But is it ethical?