Slashdot Mirror
User Not Found, Email Drops Silently
shervinafshar writes with an International Herald Tribune story explaining just why it is failed emails don't always result in a helpful error message for the sender, which also gives some insight into ways that email can be used to spy on recipients. "In last lines of the article, two companies are introduced which provide services that can 'spy' on your email reading habits. They also can 'call home' too: 'Some entrepreneurs have seen that uncertainty and offered senders the ability to obtain receipts that a given message has been read — without the recipient knowing that a confirmation has been sent back to the sender. ReadNotify, based in Queensland, Australia, started in 2000 and promised to report not only on whether a message was read, but also on how long it was opened for reading on the recipient's PC. It can also send the message in "self-destructing" form, preventing forwarding, printing, copying and saving.' IHT also is asking its readers to comment about these kind of services being against user privacy."
What about decent clients that won't automatically load remote images and don't support javascript?
Try to prevent me from forwarding or printing those bits, and I'll do it just to spite your sniveling ass.
And there's NO way to stop me. If you sends bits to MY computer, using MY libraries, and running MY kernel, those bits are mine to do with as I wish, and I take offense at any attempts to prevent me from doing just that.
Since their business model depends upon selling their "service" to people who don't know anything about email other than "click to send" ...
Thunderbird defaults to asking when someone asks for a return receipt; I always change the setting to not even ask but simply never to send them. It is nobodies business to know whether, not to mention when I have first opened their e-mail (which is also, by the way, not the same thing as actually reading it).
In addition, you should set your client to never download external images. This should solve about 99% of these "exploits". As far as I can remember, the company mentioned uses a transparent/invisible image on an intentionally slowed down server that feeds the image byte by byte; usually, mail clients disconnect/cancel the download once you click another message.
I can only imagine "preventing" forwarding to work with really retarded mail clients (I think we all know the one I'm talking about).
The very valid reason why mail servers don't always return a message when a mail address does not exist, is because this can be used to phish for existing usernames - when you don't get a bounce message, you know you've probably hit a valid username. (because for most systems, login/username = default mail alias)
Every expression is true, for a given value of 'true'
Let me know when this works with Pine or GMail. OTOH, my blackberry seems to support self destructing text messages, or maybe it just looses them randomly.
Follow me
The other thing I see around here is the people who request a receipt (we use Outlook) when they send a global email to all 1500 users on the system. Most of them only do it once.
it primarily depends upon the recipients who don't know any better than to use all sorts of unsafe mail clients who allow such tricks to be played on them. as long as these comprise the majority, that business model is sustainable.
so this is not a privacy issue but a security issue.. and it's much older than 2000.
I run all my pop accounts through GMail. Images don't load automatically and I keep javascript on a short leash. So, do those services have some kind of techno-magic or are they just spying on the weak, the lame and the infirm?
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Too much trouble for everyday use, but most people have a pretty good idea about who they have to watch out for among their business associates.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Here's a good summary of why such plans won't work:
http://theamigo.blogspot.com/2007/07/expiring-email-no-not-really.html
Difference is that the recipient is notified about the return receipt and they can choose to take action from there.
Transparent images embedded in html emails (which never should have been started in the first place) are a different kettle of fish, in that most users won't realize that their email is being monitored
I suppose one way of gaining awareness would be setting up a system (think Sorbs/Spamhaus), which lists domains of people who embed sort of shit in their emails.
Companies frown upon negative publicity and if you can say "Hey, you're listed because jbloggs@example.com sent out an email with this shit in it", then I can't see the company continuing to do that for very long
> I agree that it is older than 2000. But it is becoming less of an issue every day. As
> the older machines fail, they will be replaced with newer ones with modern email clients.
Mutt and Gnus are both modern, well-maintained, and available for "modern" machines (unless "modern", to you, means "comes with built-in malware").
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
As various people have pointed out, this would only really work if you sent html-only email, and if the recipient was guaranteed to have client software that executed javascript or something. I use mutt, a text-only email reader, and I have my mail software set up so it bounces html-only email (that it doesn't think is spam) back to the sender with an error message explaining that html-only email violates internet standards. I've never understood why anyone sends html-only email. Seems hard to believe that there would be service providers so clueless that they'd make html-only the default, and it also seems hard to believe that people would be clueless enough to want to send html-only email, but clueful enough to switch to html-only if it wasn't the default.
I have to admit that the concept of being able to get a return receipt for email has a certain allure. Recently, for example, my boss got pissed off at me and made a big scene because he thought I hadn't notified him about something. I happened to have a copy of the email in which I notified him, and I also happened to have saved his reply to it. But what if I hadn't saved the reply, or if he hadn't replied?
A lot of people send CYA emails, e.g., "Okay, this is to confirm that you want me to put the uranium in the crisper drawer of the fridge, and that you take responsibility for the results." But the recipient can pretend he never got it.
Find free books.
I'm surprised the author didn't link to the actual services:
Both seem to be easily defeated; indeed, the ReadNotify FAQ mentions that the "invisible" tracking service (which I assume means that it just includes the tracking images in the message) may be unreliable.
He's not talking about replacing stuff like Mutt because it's antequated, he's talking about replacing things like old versions of Outlook/Outlook Express, or even old versions of Thunderbird.
I therefore recommend blacklisting (in your MTA and web proxy) readnotify.com, pointofmail.com, e-mail-servers.com, didtheyreadit.com, mailinfo.com, and msgtag.com. I welcome any additions to this list.
I should also mention that those who use superior mail clients -- e.g., mutt -- can avoid being spied on by these abusers. I strongly recommend using such clients, or configuring other lesser clients so that they do not cooperate.
If you sends bits to MY computer, using MY libraries, and running MY kernel, those bits are mine to do with as I wish,
The copyright still remains with the sender, so, no, they are not yours. Furthermore, you cannot legally do with them as you wish.
The services discussed in TFA look like seriously weak sauce. Like anything that doesn't monkey with the recipient's system, they can be defeated by not loading external material, not executing javascript, and so on.
The more dangerous class of trackers are those that do operate on the recipient's system. In principle those can be defeated, just as DRM systems can; but doing so may be substantially challenging, particularly for joe user. Luckily, requiring the recipient to install a program of some sort just to view an email is pretty inconvenient, so these aren't commonly used; but if an entity that you pretty much have to interact with(employer, distance education system, government, etc.) took up using such a system, there would be a serious danger.
I return bounces for all errors. If it's coming from a spammy host, there are other solutions far more effective and precise to reduce their volume. For one, Postfix drops the connection if several consecutive errors occur, and greylisting is a marvel against the common pump-and-dump spammers. There are a lot of small things that come together in the modern spam fighting arsenal, few of them require breaking the spec.
-Billco, Fnarg.com
I use readnotify. Not on every email, but some important ones. Since I have to deal with continuing education and am constantly taking classes I find that readnotify is useful for covering my ass.
True story, I took an online course in Fall 07. I submitted my final to the prof. via email at his request. Neither the email or the attachment was ever opened and readnotify is extremely reliable for this particular prof. I still got a 4.0 so I'm not complaining.
load "$",8,1
"My mail client is fine because it doesn't load javascript or images.. however it's possible for someone to nuke my entire filesystem or execute anything!"
What kind of crazy priorities do you have?
Also, I use pine -- would someone please share some proof-of-concept? Otherwise I won't have to write my own goddamn text-based email client! Ye gods.
... who use Outlook's "recall email" feature :-)
Posting it via the net (email) IS publication. There is NO assumption whatsoever of privacy, unlike sealed mail through the post office. It has the same effect as a post card. If you believe your email isn't scanned, backed up on various servers, etc., you're naive. At any one time ther are multiple copies of your email sitting on your machine, the recipient's machine, undeleted mail queues, etc.
Email is not private. Get over it. If you want privacy, use pgp, or gpg. Don't depend on copyright law to "prevent copying", since for email to work, copies MUST be made - your original didn't disappear from your computer when you "sent" it - only a copy of the data was sent, and you gave authorization for that copying to be made in the act of sending.
Several years ago, I helped save someone some money by tracking where a particular person actually was via email. Realizing a tracking image in an email was unreliable, I also added a tracking image into a word document... which doesn't have any protection against loading images from remote servers.
Long story short - the person was on the other side of the world to where they were claiming to be based on their IP address.
I wrote a perl script and cron task that I used to use to send about 30 to 50 read receipts to people who request them. It sends them over the course of a week or two. When people ask about getting all of the read receipts, I tell them, "Every time I open your email it lets you know I read it. Isn't that what you wanted?"
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Now, if Outlook could come configured by default to prevent sending the messages in the first place, that would really help conserve bandwidth.
Makes you wonder why people abandonned ELM :-)
See: http://www.backscatterer.org/?target=backscatter
Computers obey me.
If it were otherwise then you're not sending me e-mail, but instead a license agreement to read your words for a limited period of time. If that's the case, then there needs to be a click-through license agreement first.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I am not responding to your post in particular, but it is as convenient a spot as any in the sea of "No HTML email!" posts. I use HTML email for one reason: text formatting. I like including underlines and italics in my emails for emphasis. Yes, I can post like I do here on slashdot and use /slashes/ for emphasis in plain text, but come on, this isn't 1980 anymore, you know?
At work I frequently embed images in my emails because I am discussing engineering problems and it is frequently useful to include pictures to describe the problem.
But the primary reason I use HTML email is for text formatting.
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.