![Privacy Privacy](http://a.fsdn.com/sd/topics/privacy_64.png)
![Communications Communications](http://a.fsdn.com/sd/topics/communications_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
![Your Rights Online Your Rights Online](http://a.fsdn.com/sd/topics/yro_64.png)
Testing didtheyreadit.com's Mail-Tracking Claims 400
iosdaemon writes "didtheyreadit.com claims to be able to track your sent email: "When, exactly, your email was opened. How long your email remained opened. Where, geographically, your email was viewed. DidTheyReadIt works with every single internet provider and e-mail account, including EarthLink, AOL, NetZero, Juno, Netscape, Hotmail, Yahoo, and much more." Read on for more.
"This appears to be snake oil. I put it to test just in case someone had come up with some magical code. I sent email from a Yahoo.com account through the service, to an account on a Linux Box. Running tcpdump, I received the email from my pop and let 5 minutes pass before opening it. I left the message open with the cursor in the text for another 5 minutes. Tcpdump revealed absolutely no questionable traffic. And, the service control panel indicated the email had not been viewed. Sending email to a Yahoo.com account results in a 'read' in the service CP. But I had the message open for 10 minutes, and it indicated a 2-minute read......" The company's "How it works" page explains the system to some degree; it involves redirecting all mail to be tracked through their servers by appending "didtheyreadit.com" to your recipient's email address. I doubt this is mutt-compatible ... Reader xrxzzy points out USAToday's article on the service as well.
Link doesn't work (Score:5, Informative)
How it 'works' (Score:5, Informative)
<img src="http://didtheyreadit.com/index.php/worker?cod e=2f985e815bd2b46450e
07957611ab6c9" width="1" height="1" />
So not only will it not work in text-based email clients (such as mutt), it won't work in modern versions of Outlook which block inline images by default.
(It was nice enough to leave my plain-old-text message - "blah blah blah" - alone in the original format, as well as adding a text/html mangled version.)
Re:How it 'works' (Score:3, Informative)
Re:How it 'works' (Score:2, Informative)
Re:How it 'works' (Score:3, Interesting)
Mozilla-Thunderbird needs to make their version more like Evolution's, which has the option of allowing inline images from addresses you have put into your address book.
Re:How it 'works' (Score:3, Interesting)
Open a Terminal...
defaults write com.apple.mail PreferPlainText -bool TRUE
Voila, any stupid HTML email will be displayed as text only.
Re:How it 'works' (Score:5, Insightful)
Re:How it 'works' (Score:5, Insightful)
No. Not unless you want them to know.
As I suspected, they are just using a tracking image, sometimes I look at the source of messages (sad, I know), then I would know if I was being tracked. That saves me opening an account to see how they were going to do this.
I always view my email as Plain Text using Mozilla, so this wouldn't work unless I decided to switch back to HTML. I made some of these tracking images once and tried it out. I found that browsers were cacheing them, so it wouldn't always register if it was viewed in a webmail acount.
Re:How it 'works' (Score:3, Informative)
Re:How it 'works' (Score:5, Interesting)
in plaintext, which for most users who know the difference is not the case.
Viewing in plain text has the advantage of providing a consistent look and
feel for every message, always using the reader's preference for fonts and
colors, among other things. (There are a few exceptions, but most people
prefer the fonts and colors *they* like over the ones other people want them
to see, except in special circumstances such as when having a discussion
about fonts and colors.)
It's all moot for me; I use Gnus. Currently I have it set to only display
text/plain parts and show anything else as an attachment, which I can save
and view if I choose. This means HTML mail has the From and Subject fields
to convince me it's not spam. It's been years since I received an HTML
message that wasn't spam, incidentally, and I get a *lot* of mail. I do
sometimes receive multipart/alternative messages that aren't spam, but the
plain text part always shows fine in that case.
I *could* configure Gnus to display HTML parts, using W3, or to launch a
browser, such as Mozilla, but I choose not to configure it that way because
I prefer to view the plaintext alternative, and like I said it's been years
since I received an HTML-only message that wasn't unsolicited bulkmail.
Back to topic, the didtheygetit.com claim that the service works regardless
of what client the recipient uses is obviously not only bogus for their
specific product but in fact a totally impossible thing for any product to
deliver, unless the content is munged into a form that they are *unable*
to view without alerting you, such as an executable that unencrypts and
displays the text after phoning home -- but something like that would be so
odious to so many recipients that the sender would by using it be decreasing
significantly the chances that the message would be read at all, which would
rather defeat the purpose of the whole idea. In other words, it's an utterly
impossible thing to deliver. OTOH, they only claim it works in 98% of cases
and carefully qualify this saying "in our testing", which presumably means
they didn't test with geeks who use carefully selected high-quality mail
readers; they probably tested mostly with Outlook, two or three popular
webmail services, and maybe Eudora or Netscape. I can positively guarantee
that it would never work with Pegasus Mail (though pmail *does* support read
receipts, but only if the user has turned them on in the prefs; they're
off by default), and obviously it doesn't work with my particular config
of Gnus. (I don't know about a default Gnus config, but that's largely not
a significant issue since people who leave settings at their defaults don't
tend to use Gnus in the first place; it's very much geared toward people
who like to change lots of options.) Clearly it also wouldn't work with
mutt or pine or anything like that, and *obviously* it wouldn't work if
the user talks to the POP3 server directly (which I happen to have just
done yesterday, though I only looked at three or four messages that way,
and I'm atypical, being the maintainer of the Net::Server::POP3 module).
I can imagine that it might be useful to some people nonetheless, especially
in a largely homogenous corporate environment wherein it is predictable what
mail client everyone or almost everyone uses. But clearly they're very much
exaggerating (at best) when they claim it works irrespective of the client.
Re:How it 'works' (Score:3, Interesting)
Re:How it 'works' (Score:3, Informative)
Re:How it 'works' (Score:2, Redundant)
Re:How it 'works' (Score:2)
I can't find such an option in Mozilla. I've googled around but can't find anything on it. Maybe its time for me to switch to Firefox & Thunderbird.
Re:How it 'works' (Score:5, Informative)
Edit ->
Preferences ->
Privacy & Security ->
Images ->
[checkbox] Do not load remote images in Mail and Newsgroup messages
It's probably the fact that it's under 'Privacy and Security', rather than 'Mail and news' that threw you.
Re:How it 'works' (Score:5, Interesting)
PATENT ALERT
I am about to describe a patented technique. Seriously. If you ever think you're going to implement a web bug, do not read this or IBM will be able to sue you for treble damages.
Since a) I no longer work for IBM, and b) the method is on file in the patent, I am not violating my IP contract with IBM by describing this method.
.
.
.
PATENT ALERT
.
.
.
Method:
The way to defeat browser caching is to make the IMG SRC point to a CGI that returns a REDIRECT (302) that points to the single-pixel image. So you might have IMG SRC="server/path/to/cgi?key1=val1&key2=val2". The browser will have to tick the CGI because it has "dynamic" parameters. However, the CGI has to return a REDIRECT because an intelligent proxy server in the middle might be trying to cache the output too. You don't care if the single-pixel image itself is cached, you just want to capture the CGI hit with all the parameters.
Re:How it 'works' (Score:5, Informative)
Re:They may have their patent sticker but. . . . (Score:3, Informative)
It is obvious. In fact, it's about the easiest way of solving the problem of a CGI script that produces an image, let alone cache-busting.
Re:How it 'works' (Score:5, Informative)
Unfortunatelly, I don't think it works like that. Their server will then send it to the users' server, or the mail server of their ISP or the mail sever of a webmail account such as Yahoo!, Gmail or Hotmail. Their server will send the message straight away, without any delay. The end user does not download the message from didtheyreadit.com sever, they download it from their usuall Yahoo! SMTP server or whatever their usuall mail server is.
Re:How it 'works' (Score:2)
Re:How it 'works' (Score:5, Informative)
Of course, if you don't believe me, please feel free to call my free 1-800 number and I'll explain it further. I promise not to redirect your call to an international $9.95/min number.
Re:How it 'works' (Score:4, Interesting)
http://spammerserver.com/cgi-bin/redirect.pl?id
to:
http://spammerserver.com/images/[md5sum]/image.
Apache then takes the a out of the url, rewrites it, and redirects it to a script which then records the hit from the user and notes that this address is valid.
Spam filters out there need to find a good way of detecting unique identifiers that can be used to track a user.
I'm personally moving towards the scorched earth method with my personal e-mail account. Blcok everything that isn't on my whitelist. If I know you, you're on my whitelist. It's certainly not the best method, but I hate spam.
Re:How it 'works' (Score:5, Insightful)
And yet they claim that there's no way the recipient can know that the message is being tracked (see their FAQ [didtheyreadit.com]) It may not be complete snake oil, but the company is definitely lying about the service's transparency.
And they route all your mail through their servers. I wouldn't be surprised if they soon started selling "pre-confirmed" email address lists.
Re:How it 'works' (Score:5, Insightful)
You and I might ignore their attempts, but there are a hell of a lot of people out there who would like the sales pitch, the 5 free samples/tests and spend the money to use the service. For the most part, they'll be emailing people without mutt and the service may just work (more or less) as described.
Where I would have an issue is with the small percentage of emails that they can't track due to clients forcing text only mail. If a user was to build a strong reliance on this service, they would only assume that the receiver had never even read their email when in actual fact they could've opened it in a text-only client and pored over it for days!
And the privacy issues are astounding -- they would essentially get every copy of email sent through their system -- personal information and details, etc. If you care enough about the information you're sending to want to know if the receivee will read it, then you can bet that this company may care enough about the content too...
Re:How it 'works' (Score:3, Interesting)
I give them credit for the "idea" and definitely the implemention (adding ".didtheyreadit" to the end of a standard email address), so best of luck to them.
And they certainly have achieved fantastic press with this slashdot exposure: suddenly a large group of people know the name, what it does, how it works and how much it costs...
Re:Well... at least no false positives. (Score:3, Interesting)
Re:How it 'works' (Score:3, Insightful)
And offsite imagine tracking is definitely not going to work for recipients like me, who use Mozilla Thunderbird and picked the config option "Block loading of remote images in mail messages".
Re:How it 'works' (Score:5, Informative)
Re:How it 'works' (Score:3, Insightful)
And, of course, in legitimate email newsletters and such, from lots of entities that actually have to track their ROI on such things. I used 'em about 4-5 years ago when I was doing web dev and DB marketing for a travel dot-com. If someone was signed up for our fare alerts or whatever, they'd get mail with a tag in it; if they clicked through to our site, that tag got tracked as a referrer, and passed along
Re:How it 'works' (Score:5, Interesting)
Let's be even more sensible: your firewall rules should allow your email client to make connections to your mail server ONLY, and only to its ports 110 and 25 (I'm assuming POP3; IMAP would be other orts).
(Not for linux users: Microsoft Windows firewalls typically allow setting rules separately for separate applications, by associating a process name (and in serious firewalls, the executable's MD5 sum) with the process requesting the connection.)
This takes care of all web bugs, inline images, and javascript pop-ups or Active-x in Microsoft HTML email.
Note that with any sensible email client, this won't block html links, as clicking an html link should invoke a separate browser application, with its own firewall rules.
It will block linked (not inline) images, but only a very small minority of email linked images that are at all useful to view -- in this case I just save the email as html and open in a web browser.
Re:How it 'works' (Score:3, Funny)
Ahem. I happen to have a BBA in Management. I know how to take screen shots under Windows. You just hit "printscreen" and paste, though I prefer to use a nifty little utility called "ScreenHunter" Of course the only time I need to take screenshots in windows is at work, since that's the only time I ever use windows. I'm typing this message in Mozilla, on a Linux box, running GNUStep (nee Window Maker) for my window
Comment removed (Score:4, Insightful)
Re:Definitely snake oil. (Score:5, Funny)
Re:Definitely snake oil. (Score:2, Funny)
/bin/mail works too :-) (Score:2)
this is cool (Score:5, Informative)
Re:this is cool (Score:5, Interesting)
Re:this is cool (Score:2, Funny)
Re:this is cool (Score:3, Funny)
I'm just guessing here, but, based upon my previous experiences with Outhouse, it probably downloads an activeX script from a site in Korea and promptly reboots. But then again, that's the default behavior.
OE read receipts (Score:3, Informative)
I only say use the Outlook 'standard' because it doesn't seem there's any others, and it'd be a bit useless if we had multiple versions.
If we want read receipts, that is. Personally I turn them off, and don't send them.
Re:OE read receipts (Score:5, Informative)
The only difference in clients abilities with regards to read receipts is how they present you the uninformed user the dialog box saying "Sender has requested you inform them that you have read this message".
Re:OE read receipts (Score:2)
Lets Implement a Similar System (Score:5, Funny)
This post is a joke so don't moderate down. Also I am aware that this wouldn't be really effective.
Re:Lets Implement a Similar System (Score:5, Funny)
aww crap.
Single pixel gif? (Score:4, Insightful)
How they monitor the length of time the mail stays open is a bit of a mystery.
Turn off 'Download images' and I'd imagine their system becomes useless.
Wasn't there a scare about spam merchants doing this once?
Re:Single pixel gif? (Score:2, Informative)
Re:Single pixel gif? (Score:5, Informative)
An additional note, Yahoo does have an option to disable remote images, which would also break this.
Seems this company is too late to the party. Almost all current e-mail clients now don't or have an option to not to load remote images.
Re:Single pixel gif? (Score:2, Interesting)
Re:Single pixel gif? (Score:2)
I tested with one of the links provided here. It is just a 302 byte JPEG sent 1 byte per second. So max tracking time is 5 minutes.
Re:Single pixel gif? (Score:5, Informative)
At the bottom of the mail is:
Oh well. Should prove very effective against those without the sense to turn off images anyway. Lets hear it for making money from people's ignorance!
Re:Single pixel gif? (Score:2)
Re:Single pixel gif? (Score:5, Interesting)
get your privacy back easily (Score:5, Informative)
Re:get your privacy back easily (Score:5, Funny)
No good (Score:4, Insightful)
Re:No good (Score:2)
Even Yahoo! webmail allows you to disable image loading. Furthermore, I always set my mail client to only show the plain text message, and not display any HTML at all. I don't need hypertext markup in my email messages.
Re:No good (Score:5, Insightful)
Unless it works for every single message it's no good.
So true. And this is straight from their main page:
Now you simply say, "My spam filter blocks images." And you may have a reason then to think that the person who sent you the message doesn't trust you.
You can't solve a people problem with technology.
Why not do it yourself (Score:5, Funny)
Not very useful! (Score:2, Informative)
It's an animated GIF! (Score:5, Informative)
Of course, if you use an email program that's that, umm, "open", they could just embed a trojan in it and add features like listening to what you say when you open the mail, and pictures of you reading it. :)
I'M RICH!! (Score:5, Funny)
eeevviiilll! (Score:5, Informative)
software products to make your life on a computer easier and more efficient. by secretly spying on your spouse, kids and employees.
Oh, sorry, record, my bad.
This would fail with GMail (Score:5, Informative)
Most other mailers also have a way to turn off image loading because spammers have been using this tracking technique for a long time. If mailers don't allow image blocking yet, I'm sure that a service like this will get them to add that trivial feature.
Re:This would fail with GMail (Score:3, Informative)
Outlook Express will when XP SP2 hits at end of July.
quick prevention of getting tracked by this... (Score:5, Informative)
"127.0.0.1 didthereadit.com" to my
Depressing... (Score:5, Insightful)
mwahaha (Score:4, Funny)
Better alternative (Score:4, Informative)
If you're wanting to use something along these lines, a more up-front company that doesn't use invisible web bugs is HaveTheyReadItYet [havetheyreadityet.com].
They use images of stamps, which are customizable, which is kind of a cool idea.
However, this only available for Windows.
SPAMMERS, perhaps? (Score:5, Insightful)
Wouldn't this be a great way to harvest thousands or millions of known good email addresses?
The TOS only states that they will not store the emails -- yet their own logs will contain the email addresses. There is nothing in the TOS that explicitly prevents them from using those addresses.
Re:SPAMMERS, perhaps? (Score:2)
Re:SPAMMERS, perhaps? (Score:3, Insightful)
More sophisticated analysis could also yield useful info (likely gender of the sender based on words and sentence structure; keywords to indicate interests).
Re:Picture of Alex Rampell? (Score:3, Interesting)
A multi-talented family? Accountants, Software, [rampellsoft.com] and now a web-based business.
The software seems to be keyloggers and others.
Awesome! (Score:3, Funny)
heh - and he says he doesn't get it
Good for them, and us. (Score:5, Insightful)
With a bit of luck, this will make more sites and clients want to implement image blocking, which will in turn make it harder for spammers to get their messages across.
Spam is merely an annoyance to most people. Privacy issues are not.
Could be useful (Score:3, Interesting)
DNS fun... (Score:5, Insightful)
Now whould you like to pay for an email service that doesn't even have a fallback mailserver and is likely be busy handling mail for info@didtheyreadit.com.didtheyreadit.com.didtheyr
Re:DNS fun... (Score:2, Interesting)
Re:DNS fun... (Score:3, Interesting)
Ok, a little more digging. mail.cluster1.didtheyreadit.com resolves to 3 consecutive ip addresses. Repeat the process for www.didtheyreadit.com and you find that the same 3 ip address resolve to that. This smells a lot like somebody has gone to the effort to build a high availability cluster for dealing with mail, just based on the consecutive ip's and the telltale names.
Interesting, this same cluster is also set up to provide the backing infras
Re:DNS fun... (Score:3, Interesting)
The first is that Internet mail has retry functionality built in. If your mail server goes off-line for a few minutes, most clients won't notice. It's not an immediate service like HTTP. Personally, I only have a backup MX for my personal domain because my box is physically located at my employer's office. The company could unplug it (permanently!) at any moment. People I trust - companies not one iota.
The other thing is, as other people have mentioned, this ser
didtheyreadit.com's new domain name (Score:2)
It seems didtheyreadit.com is looking at the same thing with a different view in mind. Their new domain name is: isyourrecipienttotallyignorantaboutsecurity.com.
Easy fix... (Score:5, Informative)
127.0.0.1 didtheyreadit.com
In your hosts file...
Or put an authoritative zone in your DNS servers if you have access.
Done, no query reaches their server.
SPF? (Score:2)
Actually (Score:3, Funny)
im *really* *really* sorry for the asterix's (spelling)
Big problem: instant open relay (Score:5, Insightful)
INSTANT OPEN RELAY.
All a spammer has to do is forge their From address (the only means of relay authentication!) and append
Paranoid Annoying Emailers (Score:3, Interesting)
At work, I am somewhat compelled to use outlook. Here's my favorite setting:
1) Automatically unflag incoming messages:
-Think noone reads your email? Why not flag every message you send. That way, they'll all look importat... or, the important ones will get lost in the see of red flags.
Do any of you have settings that would be good in Outlook?
"Every single internet provider"? (Score:5, Insightful)
Guess what folks. There's no law that says you have to let a megacorp run your e-mail. With a fixed IP and a 24/7 server, you can run your own server. (Though, admittedly, it's not something a novice can make work.)
All this is is simple "web bug" HTML IMG link spying. Anyone with any kind of sense has configured their e-mail client to not automatically download remote images. Or even to not display HTML crap at all. And please don't tell me that they use Javashi^H^Hcript, because that means there's a brain-damaged popular e-mail program out there that allows it (or a webmail site that doesn't filter it). All we need is another way for e-mail to run wild code.
Is anyone else getting a flashback to the all the stupid ideas that would burn through millions of dollars in VC cash back in the dot-com bubble days?
It's a scam, and here's how I know (Score:5, Funny)
Wonder how it compares with ReadNotify (Score:4, Informative)
It looks to be exactly the same kind of service as Didtheyreadit.com.
I first became aware of this company by reading Mozilla's bug report 28327 - http://bugzilla.mozilla.org/show_bug.cgi?id=28327 [mozilla.org] (cut/paste URL and open in new window).
Mozilla/Thunderbird also has trouble completely blocking all server contact in email, as it evidently doesn't sandbox the email environment enough (images may be blocked, but stylesheets and other external URL's can still leak through, last I checked).
BTW, there is a workaround if you use Mozilla/Thunderbird: set your View/Message Body As settings to "Simple HTML", or better yet, "Plain Text". This works 100%!
Tracking HTML e-mail without images or JavaScript (Score:3, Informative)
1) In the header of your HTML e-mail message, load up a style sheet:
<style type="text/css">
@import "http://your.server.com/your.css";
</style>
2) In the server directory containing your CSS file, add the following line to
AddType application/x-httpd-php
Any file ending in
3) Save this as your.css:
<?php
require "track_message.php";
?>
Done. No images, no JavaScript
Heard about this on NPR interview last week (Score:3, Interesting)
A gentleman called in from a design engineering firm who emails large documents to other members of the firm and other associates around the country. The "expert" insisted that the didtheyreadit.com was the perfect service for them to assure that their emails made it there and were in fact read.
My question was this, how does email between two people who regularly email each other, and are probably expecting it, "get lost"? This was a major point that the guy was making, which seemed to me like he was spreading classic FUD.
Lets make sure that our friends aren't using this product for those reasons! Assure them that undeliverable mail will be properly reported back to them always, and show them how to set their mail clients to always accept mail from those in their address books!
-Mikey P
Here's How They Time the View (Score:3, Interesting)
I'd show you what a dump of an 118-byte-long version of their JPEG image looks like, but the Slashdot Lameness Filter didn't like all those "junk" characters! However, you can view the dump here: http://jzap.com/img/ReadItBug.jpeg.txt [jzap.com]
Re:fp! (Score:5, Informative)
On another note, I find it's walking on the thin red line of immoral behavior, and I know here in Denmark there've been several companies who've got bad publicity because of using said method.
Re:fp! (Score:3, Interesting)
The entire point of a free service would be 1) to educate people as to why this is pointless and 2) to make it unprofitable and drive these people out of business.
Yahoo, and Gmail too... (Score:2, Informative)
As to Gmail, I don't know, but from what I've heard it works in a similar way.
Also, the newer versions of AOL diasable images in emails by default, requiring the user to click on an 'Enable images and links' option on each email they want to see images/have working links in.
Having email clien
Yahoo and Hotmail image loading (Score:3, Informative)
However, this option must be hunted down and turned on.
Hotmail does one better, and allows you to block all images from loading by default, and set rules so certain senders' images will always load as well as viewing images in a piece of mail on a case-by-case basis.
Re:Uh, the link is wrong (Score:2, Interesting)
You know that a URL like
Re:Uh, the link is wrong (Score:2, Interesting)
Re:But we're blocking it anways.. (Score:4, Insightful)
Re:How it works (Score:2)
Re:Smoke and mirrors (Score:5, Funny)
It seems to be good, just an awful slow load (which no doubt is intentional to measure the length of your 'reading' of the e-mail).