User Not Found, Email Drops Silently

shervinafshar writes with an International Herald Tribune story explaining just why it is failed emails don't always result in a helpful error message for the sender, which also gives some insight into ways that email can be used to spy on recipients. "In last lines of the article, two companies are introduced which provide services that can 'spy' on your email reading habits. They also can 'call home' too: 'Some entrepreneurs have seen that uncertainty and offered senders the ability to obtain receipts that a given message has been read — without the recipient knowing that a confirmation has been sent back to the sender. ReadNotify, based in Queensland, Australia, started in 2000 and promised to report not only on whether a message was read, but also on how long it was opened for reading on the recipient's PC. It can also send the message in "self-destructing" form, preventing forwarding, printing, copying and saving.' IHT also is asking its readers to comment about these kind of services being against user privacy."

Comments

Remote images?

[simcop2387]

What about decent clients that won't automatically load remote images and don't support javascript?

Re:Remote images?

[Anonymous Coward]

In that case ReadNotify et al are shit out of luck.

Re:Remote images?

[Creepy Crawler]

I use pine on my server all the time. That means I dont do any JS or image loading. How is downloading text from a mailserver going to "autodelete", "report" or other nefarious activities?

If they had my login/pass it'd be a different story, which could be gotten by ANSI injection in mail, but that would require a lot of assumptions, including platform server resides upon. We've seen those hacks before, including ones that echo rm -rf / \cr\lf

Re:Remote images?

[Creepy Crawler]

But Im not trying to get out of "readnotify" gunk. I use pine on my server because I can read it via a 56k modem. I dont need to download big nasties or anything else. All I need is PuTTY or ubuntu's ssh.

All my mails are there on the server for my easy pickings. No stupid stuff, and damned fast.

Re:Remote images?

[rm999]

As far as I am aware, Gmail was the first mainstream e-mail service/client that did not load remote images automatically. Before then, these tracking products were plausible, but fortunately most clients I am aware of have followed suit and ruined the business plan.

Now, the only way to truly track e-mails is to request the user click on a link to an external website to read the message. I don't know many people who would do this without suspicion.

Re:Remote images?

[pthor1231]

Hotmail doesn't loaded remote images, and would even prevent you from clicking on a link if the sender was unknown. They have been doing this for quite a while.

Re:Remote images?

[cayenne8]

Yep...I prefer email to be plain text, no need to send 1MB worth of date, to display 5 lines of text.

I request that people set their email clients to text for forums I'm on...and often, people will do it and didn't know they could change this setting on their email client. Why is html mail the default on so many clients anyway?

Anyway...I was wondering how this company would get this type of info reading plain old email, but, I'd forgotten about using clients set up to download images, javascript...etc.

Re:Remote images?

[Anonymous Coward]

Gmail was certainly not the first. I know that Rocketmail(now Yahoo!) and Hotmail had this feature long before Google as a company even existed.

Re:Remote images?

[Smauler]

html mail is not a big overhead necessarily. All it is a markup language, and it only adds small amounts to emails if used well. If used poorly, it's diabolical. Blame the sender, not the medium - html emails do have their place.

Also, anyone who lets their mail reader access _any_ unkown outbound html connections is asking for trouble.

Re:Remote images?

[Kalriath]

Is there actually an email client that runs Javascript? Even recent versions of Outlook wont (and even can't - Word has no Javascript interpreter!) and I'm sure that Thunderbird wouldn't be that stupid.

Re:Remote images?

[cayenne8]

"html mail is not a big overhead necessarily. All it is a markup language, and it only adds small amounts to emails if used well. If used poorly, it's diabolical. Blame the sender, not the medium - html emails do have their place.",

I was exaggerating a little bit on the amount of data being sent with html mail, but, I have seem some emails that were WAY too big, for the few lines of information they carried...with the wallpapers, and animated images all dancing around, etc.

With so much email out there, it all adds up to serious bandwidth waste.

Re:Remote images?

[thePowerOfGrayskull]

Well - the overhead isn't big in terms of size - but when you have 18 different images linked to from offsite, it becomes a whole different issue. (And that's just for normal 'catalog'/advert emails that get sent out, not counting this lame tracking silliness.)

Re:Remote images?

[Anonymous Coward]

html mail is not a big overhead necessarily.

Bullshit. Create a one paragraph message and send it with Pine or command-line unix mail. Then send the same paragraph with Outlook or other common email software. Look at how much html fluff gets into the message.

All it is a markup language, and it only adds small amounts to emails if used well. If used poorly, it's diabolical. Blame the sender, not the medium - html emails do have their place.

The sender doesn't know anything about what happens behind the scenes, they are just writing a message. Blame the software writers.

Re:Remote images?

[lostguru]

Ah, but most people don't read email using a client, they use a browser and a html frontend provided by their service (gmail, yahoo, msn) in which case the browser will run javascript.

Re:Remote images?

[KGIII]

Before one cries bullshit I'd suggest that you, and a few others in this thread, look at your email software's settings. Most, including Outlook, enable you to send in plain text format. Blaming the software authors for people not understanding? I think you'll find the people DO understand (to some extent) and they like it. That'd be why they do it. People LIKE including images, pretty formats, and the likes. I friggen hate it. I read and send in one format, plain text, but that's me. My newsletter doesn't even offer a rich text format. But don't blame the software designers, blame the people who are doing what they like. "Bad people for doing what you wanted to and horrific software designers for enabling them to do so! Email is only in one way and it is my way and if you're not doing it my way then you're a dolt!" No... No... Grandma wants to send you pretty images and sound. Turn it off and smile nicely.

Wanna know the kicker here? Without taking the time to read the article, I bet, you're likely one of the people who bitches about blowback spam. Which is it? Do the folks want to be notified when it doesn't reach the sender or not? Me? I'll take notification and delete the blowback like I do the rest of the garbage. I process a few thousand emails daily, all in about ten minutes to an hour depending on the day... I don't even have to use software to do it. I'm not even that smart. Hell, I don't even type that fast.

So, no... To get to my point. You're full of crap. Don't blame the authors for creating functional software that does what people want it to do. I'd have agreed if you'd thought that *maybe* plain text should be enabled by default but that's not what "people" want, that's what "we geeks" want and how we prefer things. It isn't our internet any more. It isn't our system any more. Today they're no longer users and the longer we can keep calling them users or lusers or the likes the further we'll split the divide. There will not be a convergence but, well, this digresses beyond what the topic is and I'll attempt to avoid that. It is easy enough to figure out who I am and use email contact but, please, plain text only. ;)

Re:Remote images?

[afidel]

Here's a way to do hypertargeted tracking to a gmail client, buy an adword for some made up many character 'word' like asdjhfgkjbadjghiougscvo and then include it at the end of or embedded in the html of an email. Then just view the stats on the adword. If you are smart enough there is generally a way to do things to the majority of people who are non-paranoid. Personally that's why I like things like Mozilla and Thunderbird, their defaults are set by people who ARE paranoid =)

Re:Remote images?

[tomhudson]

Rich text can actually be useful, you know. The fact that pretty much the entire web opts to use rich text rather than plain text should tip you off to that.

My email is not a web page, and I don't *want* it to be one. Nor do I want to read someone else's "web-page-style" email, run their dorky embedded javascript, or download their 1x1 12ab95rtyd62534.gif tracking images. CSS Style sheets for email? Wallpaper? Muzak? Sick.

Re:Remote images?

[cayenne8]

"If you hate HTML so much, how come you use the web?

HTTP is based on HTML and you seem to be OK with using Slashdot. Why not use a proper markup language to format email messages? "

Because they are two distinctly different things. Email is not a webpage....a webpage is designed exactly for html presentation. Email is text messaging...it wasn't originally meant to be marked up, it was to be read as simple plain text.

Re:Remote images?

[thePowerOfGrayskull]

I understand the reasoning for it, but that doesn't make it any less irritating as a practice. The fact is that anybody who is reasonably security conscious will - at minimum - disable image rendering and javascript in their email client. So when an entire email consists of external images and terribly formatted links, the sender pretty much shoots him/herself in the foot.

Re:Remote images?

[uncqual]

Email is a just a communication tool - nothing more, nothing less.

Before IM and text messaging were ubiquitous, email served these roles along with the role of communicating more complicated (and often less transient) information. The IM and text messaging roles are now partially (and often better) addressed by other tools now.

While I hate HTML email laden with gratuitous and distracting images and formatting, appropriate use of formatting and inclusion of images helps communicate information more quickly and accurately. For example, appropriate use of bold text can highlight exceptional information very nicely without adding additional verbiage to a message. Similarly, a graph can communicate information much more quickly than the data in raw text form (for example in an emailed "release bug status" report).

The problem, of course, is that anything can be abused and become less effective. People used to abuse ASCII email by trying to make graphs in ASCII and used tabs - these were inevitably screwed up during display (esp. when included in another message).

Email has evolved. Our connectivity has evolved (remember the days of 110 "baud" modems?). To say that email should be restricted to 20 year old technology (maybe even including the speed of transmission?) at the expense of effective communications makes as much sense as saying that manuals should still be restricted to printed copies from line printer output (in monospaced font!) -- and that updates should be done via regularly distributed change pages).

Re:Remote images?

[Kompressor]

Okiedokie, time to add my $0.02 to the pot :-D

The key difference is that backscatter generating SMTP servers accept an email, close the connection with the remote server, realize that there is no local user by that name, and then generate a bounce e-mail (usually, but not always) with the content of the original message. As spammers usually put some unsuspecting third party's e-mail address as the "from" or "reply to", the third party gets the bounce, AKA backscatter.

The other approach is this: mailserver recieves inbound SMTP connection. When the initial chitchat between the mailservers gets to the part where the remote server lists the recipients, our mailserver recognizes that there is no local e-mail address by that name, and promptly rejects the mail. If the remote mailserver is legitimate, it will then generate a bounce itself, which will go to the (hopefully authenticated) person who sent the e-mail. If the remote mail server is a spam bot, it will just go on to the next target in its list.

So, from a backscatter prevention angle, it's better to reject an e-mail that will cause a bounce at the time of the original SMTP connection, instead of accepting it and then generating a bounce locally at a later time.

If you send me an email, those bits are MINE

[Anonymous Coward]

Try to prevent me from forwarding or printing those bits, and I'll do it just to spite your sniveling ass.

And there's NO way to stop me. If you sends bits to MY computer, using MY libraries, and running MY kernel, those bits are mine to do with as I wish, and I take offense at any attempts to prevent me from doing just that.

Doesn't matter.

[khasim]

Since their business model depends upon selling their "service" to people who don't know anything about email other than "click to send" ...

Only if your mail client is severely misconfigured

[Idaho]

Thunderbird defaults to asking when someone asks for a return receipt; I always change the setting to not even ask but simply never to send them. It is nobodies business to know whether, not to mention when I have first opened their e-mail (which is also, by the way, not the same thing as actually reading it).

In addition, you should set your client to never download external images. This should solve about 99% of these "exploits". As far as I can remember, the company mentioned uses a transparent/invisible image on an intentionally slowed down server that feeds the image byte by byte; usually, mail clients disconnect/cancel the download once you click another message.

I can only imagine "preventing" forwarding to work with really retarded mail clients (I think we all know the one I'm talking about).

The very valid reason why mail servers don't always return a message when a mail address does not exist, is because this can be used to phish for existing usernames - when you don't get a bounce message, you know you've probably hit a valid username. (because for most systems, login/username = default mail alias)

Supported platforms

[jaavaaguru]

Let me know when this works with Pine or GMail. OTOH, my blackberry seems to support self destructing text messages, or maybe it just looses them randomly.

Did you get it?

[RidcullyTheBrown]

I am amused by the ways people treat different technologies. I see people who assume that email delivery is perfect and instantaneous, and get upset if their message is delayed or doesn't reach the destination. The same people will follow up a fax with a phone call to confirm the recipient got it. There appears to be no difference in the importance of the messages involved, so perhaps it is a generational (in terms of the technology) thing.

The other thing I see around here is the people who request a receipt (we use Outlook) when they send a global email to all 1500 users on the system. Most of them only do it once.

Re:Did you get it?

[tomhudson]

People at my work still send me stuff with receipt requested. The first time anybody does it they wonder why I never read my email. My answer is always the same. Email is fundamentally unreliable and my client doesn't send receipts.

Do what I did ... "I didn't need to read your email a second time - I got the original off you machine earlier today as you typed it. I *told* you you're running an unsecure OS!"

You'd be surprised how many people fall for it.

more importantly,

[Escogido]

it primarily depends upon the recipients who don't know any better than to use all sorts of unsafe mail clients who allow such tricks to be played on them. as long as these comprise the majority, that business model is sustainable.

so this is not a privacy issue but a security issue.. and it's much older than 2000.

I also wondered about Gmail

[HangingChad]

I run all my pop accounts through GMail. Images don't load automatically and I keep javascript on a short leash. So, do those services have some kind of techno-magic or are they just spying on the weak, the lame and the infirm?

Why it can't work

[Anonymous Coward]

Here's a good summary of why such plans won't work:
http://theamigo.blogspot.com/2007/07/expiring-email-no-not-really.html

Re:Why it can't work

[Just some bastard]

Here's a good summary of why such plans won't work:

Here's another one: http://www.sox-online.com/act_section_802.html

Re:Not really.

[John Hasler]

> I agree that it is older than 2000. But it is becoming less of an issue every day. As
> the older machines fail, they will be replaced with newer ones with modern email clients.

Mutt and Gnus are both modern, well-maintained, and available for "modern" machines (unless "modern", to you, means "comes with built-in malware").

html-only email

[bcrowell]

As various people have pointed out, this would only really work if you sent html-only email, and if the recipient was guaranteed to have client software that executed javascript or something. I use mutt, a text-only email reader, and I have my mail software set up so it bounces html-only email (that it doesn't think is spam) back to the sender with an error message explaining that html-only email violates internet standards. I've never understood why anyone sends html-only email. Seems hard to believe that there would be service providers so clueless that they'd make html-only the default, and it also seems hard to believe that people would be clueless enough to want to send html-only email, but clueful enough to switch to html-only if it wasn't the default.

I have to admit that the concept of being able to get a return receipt for email has a certain allure. Recently, for example, my boss got pissed off at me and made a big scene because he thought I hadn't notified him about something. I happened to have a copy of the email in which I notified him, and I also happened to have saved his reply to it. But what if I hadn't saved the reply, or if he hadn't replied?

A lot of people send CYA emails, e.g., "Okay, this is to confirm that you want me to put the uranium in the crisper drawer of the fridge, and that you take responsibility for the results." But the recipient can pretend he never got it.

Re:html-only email

[martin-boundary]

Just a little clarification FYI: HTML only messages do not violate internet standards. It's quite standards compliant, as the minimum is RFC2822, which has no requirement about the content other than the character set it's written in.

The MIME standards (which are entirely optional) do not require duplicate text and html versions of a message either. There are several MIME content types, of which only multipart/alternative is intended for duplicate content with degraded formatting such as separate text and html versions, and in this case the actual formats can be anything, eg they could be a text version and an MS Word version, without an HTML version.

Re:html-only email

[ion.simon.c]

...I have my mail software set up so it bounces html-only email (that it doesn't think is spam) back to the sender with an error message explaining that html-only email violates internet standards.

Um. I'm unaware of any IETF standard regarding HTML-formatted email transmission. Unless you can link me to such a standard, there is no violation.
Also, you are an ass. Additionally, if you're unable to configure an MUA produced in the last five years to correctly render HTML email, you're a fucking moron.

Links to actual services

[e r i k 0]

I'm surprised the author didn't link to the actual services:

• ReadNotify FAQ - doesn't seem to give too much actual info on how it works, but looks like it's a combination of images hosted on the ReadNotify server with tracked downloads, rewritten links to go through ReadNotify servers to add log entries, and some other things I couldn't guess immediately.
• MessageTag seems to just be an image hosting service which tracks image downloads.

Both seem to be easily defeated; indeed, the ReadNotify FAQ mentions that the "invisible" tracking service (which I assume means that it just includes the tracking images in the message) may be unreliable.

Blacklisting the abusers

[Arrogant-Bastard]

It is clear that readnotify and their ilk are engaged in abusive activities: we would not tolerate the equivalent with snail-mail, and so we should of course not tolerate it with email, either. These abusers are only one step removed from spam and spyware, and should therefore of course be blacklisted permanently.

I therefore recommend blacklisting (in your MTA and web proxy) readnotify.com, pointofmail.com, e-mail-servers.com, didtheyreadit.com, mailinfo.com, and msgtag.com. I welcome any additions to this list.

I should also mention that those who use superior mail clients -- e.g., mutt -- can avoid being spied on by these abusers. I strongly recommend using such clients, or configuring other lesser clients so that they do not cooperate.

copyright

[speedtux]

If you sends bits to MY computer, using MY libraries, and running MY kernel, those bits are mine to do with as I wish,

The copyright still remains with the sender, so, no, they are not yours. Furthermore, you cannot legally do with them as you wish.

Re:copyright

[palegray.net]

Please cite a case where copyright law was used to prosecute someone for forwarding an email.

CYA

[fishthegeek]

I use readnotify. Not on every email, but some important ones. Since I have to deal with continuing education and am constantly taking classes I find that readnotify is useful for covering my ass.

True story, I took an online course in Fall 07. I submitted my final to the prof. via email at his request. Neither the email or the attachment was ever opened and readnotify is extremely reliable for this particular prof. I still got a 4.0 so I'm not complaining.

Re:CYA

[stabiesoft]

How do you know the prof didn't use pine to read the email? No one would ever know if I read an email. Once the email has been received by my mail server, no one knows (except me) if it got read & saved, read & deleted, or just deleted.

Aimed at the same people ...

[IchBinEinPenguin]

... who use Outlook's "recall email" feature :-)

email image tracking

[geoff_smith82]

Several years ago, I helped save someone some money by tracking where a particular person actually was via email. Realizing a tracking image in an email was unreliable, I also added a tracking image into a word document... which doesn't have any protection against loading images from remote servers.

Long story short - the person was on the other side of the world to where they were claiming to be based on their IP address.

Not Your E-Mail Any Longer

[Nom du Keyboard]

Once you've sent it to me it's not your e-mail any longer. It's mine to do as I with wish.

If it were otherwise then you're not sending me e-mail, but instead a license agreement to read your words for a limited period of time. If that's the case, then there needs to be a click-through license agreement first.

And Get Off My Lawn, Too!

[maillemaker]

I am not responding to your post in particular, but it is as convenient a spot as any in the sea of "No HTML email!" posts. I use HTML email for one reason: text formatting. I like including underlines and italics in my emails for emphasis. Yes, I can post like I do here on slashdot and use /slashes/ for emphasis in plain text, but come on, this isn't 1980 anymore, you know? At work I frequently embed images in my emails because I am discussing engineering problems and it is frequently useful to include pictures to describe the problem. But the primary reason I use HTML email is for text formatting.