User Not Found, Email Drops Silently

shervinafshar writes with an International Herald Tribune story explaining just why it is failed emails don't always result in a helpful error message for the sender, which also gives some insight into ways that email can be used to spy on recipients. "In last lines of the article, two companies are introduced which provide services that can 'spy' on your email reading habits. They also can 'call home' too: 'Some entrepreneurs have seen that uncertainty and offered senders the ability to obtain receipts that a given message has been read — without the recipient knowing that a confirmation has been sent back to the sender. ReadNotify, based in Queensland, Australia, started in 2000 and promised to report not only on whether a message was read, but also on how long it was opened for reading on the recipient's PC. It can also send the message in "self-destructing" form, preventing forwarding, printing, copying and saving.' IHT also is asking its readers to comment about these kind of services being against user privacy."

Comments

Remote images?

[simcop2387]

What about decent clients that won't automatically load remote images and don't support javascript?

Re:Remote images?

[Anonymous Coward]

Gmail was certainly not the first. I know that Rocketmail(now Yahoo!) and Hotmail had this feature long before Google as a company even existed.

Re:Remote images?

[Smauler]

html mail is not a big overhead necessarily. All it is a markup language, and it only adds small amounts to emails if used well. If used poorly, it's diabolical. Blame the sender, not the medium - html emails do have their place.

Also, anyone who lets their mail reader access _any_ unkown outbound html connections is asking for trouble.

Only if your mail client is severely misconfigured

[Idaho]

Thunderbird defaults to asking when someone asks for a return receipt; I always change the setting to not even ask but simply never to send them. It is nobodies business to know whether, not to mention when I have first opened their e-mail (which is also, by the way, not the same thing as actually reading it).

In addition, you should set your client to never download external images. This should solve about 99% of these "exploits". As far as I can remember, the company mentioned uses a transparent/invisible image on an intentionally slowed down server that feeds the image byte by byte; usually, mail clients disconnect/cancel the download once you click another message.

I can only imagine "preventing" forwarding to work with really retarded mail clients (I think we all know the one I'm talking about).

The very valid reason why mail servers don't always return a message when a mail address does not exist, is because this can be used to phish for existing usernames - when you don't get a bounce message, you know you've probably hit a valid username. (because for most systems, login/username = default mail alias)

Did you get it?

[RidcullyTheBrown]

I am amused by the ways people treat different technologies. I see people who assume that email delivery is perfect and instantaneous, and get upset if their message is delayed or doesn't reach the destination. The same people will follow up a fax with a phone call to confirm the recipient got it. There appears to be no difference in the importance of the messages involved, so perhaps it is a generational (in terms of the technology) thing.

The other thing I see around here is the people who request a receipt (we use Outlook) when they send a global email to all 1500 users on the system. Most of them only do it once.

more importantly,

[Escogido]

it primarily depends upon the recipients who don't know any better than to use all sorts of unsafe mail clients who allow such tricks to be played on them. as long as these comprise the majority, that business model is sustainable.

so this is not a privacy issue but a security issue.. and it's much older than 2000.

Links to actual services

[e r i k 0]

I'm surprised the author didn't link to the actual services:

• ReadNotify FAQ - doesn't seem to give too much actual info on how it works, but looks like it's a combination of images hosted on the ReadNotify server with tracked downloads, rewritten links to go through ReadNotify servers to add log entries, and some other things I couldn't guess immediately.
• MessageTag seems to just be an image hosting service which tracks image downloads.

Both seem to be easily defeated; indeed, the ReadNotify FAQ mentions that the "invisible" tracking service (which I assume means that it just includes the tracking images in the message) may be unreliable.

Blacklisting the abusers

[Arrogant-Bastard]

It is clear that readnotify and their ilk are engaged in abusive activities: we would not tolerate the equivalent with snail-mail, and so we should of course not tolerate it with email, either. These abusers are only one step removed from spam and spyware, and should therefore of course be blacklisted permanently.

I therefore recommend blacklisting (in your MTA and web proxy) readnotify.com, pointofmail.com, e-mail-servers.com, didtheyreadit.com, mailinfo.com, and msgtag.com. I welcome any additions to this list.

I should also mention that those who use superior mail clients -- e.g., mutt -- can avoid being spied on by these abusers. I strongly recommend using such clients, or configuring other lesser clients so that they do not cooperate.

CYA

[fishthegeek]

I use readnotify. Not on every email, but some important ones. Since I have to deal with continuing education and am constantly taking classes I find that readnotify is useful for covering my ass.

True story, I took an online course in Fall 07. I submitted my final to the prof. via email at his request. Neither the email or the attachment was ever opened and readnotify is extremely reliable for this particular prof. I still got a 4.0 so I'm not complaining.

Re:html-only email

[martin-boundary]

Just a little clarification FYI: HTML only messages do not violate internet standards. It's quite standards compliant, as the minimum is RFC2822, which has no requirement about the content other than the character set it's written in.

The MIME standards (which are entirely optional) do not require duplicate text and html versions of a message either. There are several MIME content types, of which only multipart/alternative is intended for duplicate content with degraded formatting such as separate text and html versions, and in this case the actual formats can be anything, eg they could be a text version and an MS Word version, without an HTML version.

Re:copyright

[palegray.net]

Please cite a case where copyright law was used to prosecute someone for forwarding an email.