User Not Found, Email Drops Silently 292
shervinafshar writes with an International Herald Tribune story explaining just why it is failed emails don't always result in a helpful error message for the sender, which also gives some insight into ways that email can be used to spy on recipients. "In last lines of the article, two companies are introduced which provide services that can 'spy' on your email reading habits. They also can 'call home' too: 'Some entrepreneurs have seen that uncertainty and offered senders the ability to obtain receipts that a given message has been read — without the recipient knowing that a confirmation has been sent back to the sender. ReadNotify, based in Queensland, Australia, started in 2000 and promised to report not only on whether a message was read, but also on how long it was opened for reading on the recipient's PC. It can also send the message in "self-destructing" form, preventing forwarding, printing, copying and saving.' IHT also is asking its readers to comment about these kind of services being against user privacy."
Remote images? (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:Remote images? (Score:4, Insightful)
All my mails are there on the server for my easy pickings. No stupid stuff, and damned fast.
Re:Remote images? (Score:4, Informative)
I request that people set their email clients to text for forums I'm on...and often, people will do it and didn't know they could change this setting on their email client. Why is html mail the default on so many clients anyway?
Anyway...I was wondering how this company would get this type of info reading plain old email, but, I'd forgotten about using clients set up to download images, javascript...etc.
Re:Remote images? (Score:5, Insightful)
html mail is not a big overhead necessarily. All it is a markup language, and it only adds small amounts to emails if used well. If used poorly, it's diabolical. Blame the sender, not the medium - html emails do have their place.
Also, anyone who lets their mail reader access _any_ unkown outbound html connections is asking for trouble.
Re:Remote images? (Score:4, Insightful)
I was exaggerating a little bit on the amount of data being sent with html mail, but, I have seem some emails that were WAY too big, for the few lines of information they carried...with the wallpapers, and animated images all dancing around, etc.
With so much email out there, it all adds up to serious bandwidth waste.
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2)
If you're really concerned about retaining formatting tne only practical solution is to use a PDF attachment.
Re:Remote images? (Score:4, Insightful)
My email is not a web page, and I don't *want* it to be one. Nor do I want to read someone else's "web-page-style" email, run their dorky embedded javascript, or download their 1x1 12ab95rtyd62534.gif tracking images. CSS Style sheets for email? Wallpaper? Muzak? Sick.
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
But, seriously - if you are using a mail application that does "blindly" support HTML and resides on your desktop/laptop the weasel sending you email will have your MAC and IP address. Consider being in your "lover's" home / business when that email hits your laptop - now the spouse has you located.
The Feds and some state pol
And Get Off My Lawn, Too! (Score:5, Informative)
Re: (Score:3, Insightful)
Bullshit. Create a one paragraph message and send it with Pine or command-line unix mail. Then send the same paragraph with Outlook or other common email software. Look at how much html fluff gets into the message.
All it is a markup language, and it only adds small amounts to emails if used well. If used poorly, it's diabolical. Blame the sender, not the medium - html emails do have their place.
The sender doesn't know anything about what happens behind the scenes,
Re:Remote images? (Score:4, Insightful)
Wanna know the kicker here? Without taking the time to read the article, I bet, you're likely one of the people who bitches about blowback spam. Which is it? Do the folks want to be notified when it doesn't reach the sender or not? Me? I'll take notification and delete the blowback like I do the rest of the garbage. I process a few thousand emails daily, all in about ten minutes to an hour depending on the day... I don't even have to use software to do it. I'm not even that smart. Hell, I don't even type that fast.
So, no... To get to my point. You're full of crap. Don't blame the authors for creating functional software that does what people want it to do. I'd have agreed if you'd thought that *maybe* plain text should be enabled by default but that's not what "people" want, that's what "we geeks" want and how we prefer things. It isn't our internet any more. It isn't our system any more. Today they're no longer users and the longer we can keep calling them users or lusers or the likes the further we'll split the divide. There will not be a convergence but, well, this digresses beyond what the topic is and I'll attempt to avoid that. It is easy enough to figure out who I am and use email contact but, please, plain text only.
Re: (Score:3, Informative)
I'm not the person you are replying to, but here are my (unasked for) 2 cents:
If by blowback spam you mean backscatter spam, it doesn't have to be an "either or" situation. Backscatter spam is c
Re: (Score:2)
Blowback was the term I was most familiar with from my days of simply saying "screw it" and jumping into the SpamCop lists so I'll *assume* they're the same. Oddly, we do have two single Exchange servers that we host for a couple of local businesses. They seem to get the least complaints or have the least issues. You say it doesn't have to be an either or... If you disable, please pardon my ignorance,
Re: (Score:3, Informative)
The key difference is that backscatter generating SMTP servers accept an email, close the connection with the remote server, realize that there is no local user by that name, and then generate a bounce e-mail (usually, but not always) with the content of the original message. As spammers usually put some unsuspecting third party's e-mail address as the "from" or "reply to", the third party gets the bounce, AKA backscatter.
The other approach is this: mailserver
Re:Remote images? (Score:5, Insightful)
HTTP is based on HTML and you seem to be OK with using Slashdot. Why not use a proper markup language to format email messages? "
Because they are two distinctly different things. Email is not a webpage....a webpage is designed exactly for html presentation. Email is text messaging...it wasn't originally meant to be marked up, it was to be read as simple plain text.
Re:Remote images? (Score:5, Insightful)
Before IM and text messaging were ubiquitous, email served these roles along with the role of communicating more complicated (and often less transient) information. The IM and text messaging roles are now partially (and often better) addressed by other tools now.
While I hate HTML email laden with gratuitous and distracting images and formatting, appropriate use of formatting and inclusion of images helps communicate information more quickly and accurately. For example, appropriate use of bold text can highlight exceptional information very nicely without adding additional verbiage to a message. Similarly, a graph can communicate information much more quickly than the data in raw text form (for example in an emailed "release bug status" report).
The problem, of course, is that anything can be abused and become less effective. People used to abuse ASCII email by trying to make graphs in ASCII and used tabs - these were inevitably screwed up during display (esp. when included in another message).
Email has evolved. Our connectivity has evolved (remember the days of 110 "baud" modems?). To say that email should be restricted to 20 year old technology (maybe even including the speed of transmission?) at the expense of effective communications makes as much sense as saying that manuals should still be restricted to printed copies from line printer output (in monospaced font!) -- and that updates should be done via regularly distributed change pages).
Re: (Score:2, Insightful)
I gather it you don't get many multi-megabyte power p
Re: (Score:3, Funny)
Email has evolved. Our connectivity has evolved (remember the days of 110 "baud" modems?). To say that email should be restricted to 20 year old technology (maybe even including the speed of transmission?) at the expense of effective communications makes as much sense as saying that manuals should still be restricted to printed copies from line printer output (in monospaced font!) -- and that updates should be done via regularly distributed change pages).
I gather it you don't get many multi-megabyte power point slides containing 2 line jokes from newbie morons.
I gather you still use a 110 baud modem, given that a simple quotation character was already too much effort...
Re: (Score:3, Informative)
Uh, no it isn't. Granted, a lot of the objects transported over HTTP are text/html, but a lot of them aren't. And you can put text/plain documents up on the web to your heart's content. Most people don't do this very often because with the textual part of the web, unlike with email, the point is to link to other things (hence the term "web"). Furthermore, you don't need HTML to link to other things in email because decent mail clients recognize links in plain text emails anyway.
Re: (Score:2)
Re:Remote images? (Score:4, Interesting)
Re:Remote images? (Score:4, Insightful)
Re: (Score:2)
At work, where Mr. Softy p0wnz0rz me, I'm less concerned.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
How much are people going to be willing to pay for a service that doesn't even work for gmail users? I suppose you could make the image alt text say "pretty, pretty please click the display images button", but most users still aren't going to bother. They'll delete the message or mark it spam, and get on with their day.
Re: (Score:2)
Re:Remote images? (Score:4, Insightful)
If they had my login/pass it'd be a different story, which could be gotten by ANSI injection in mail, but that would require a lot of assumptions, including platform server resides upon. We've seen those hacks before, including ones that echo rm -rf / \cr\lf
rm -rf / spying !? (Score:2, Funny)
What kind of crazy priorities do you have?
Also, I use pine -- would someone please share some proof-of-concept? Otherwise I won't have to write my own goddamn text-based email client! Ye gods.
Re: (Score:2)
It could be in the form of a very persuasive entreaty for you to write back to the service provider and personally report your actions.
Doesn't matter. (Score:5, Insightful)
more importantly, (Score:5, Interesting)
so this is not a privacy issue but a security issue.. and it's much older than 2000.
Not really. (Score:2)
But most of the modern mail clients have that functionality either turned off or they pop up a window that requires the recipient to agree to send the acknowledgment or view the images. I don't know about you, but I'm running Thunderbird on Ubuntu and it does both.
I agree
Re:Not really. (Score:4, Funny)
> the older machines fail, they will be replaced with newer ones with modern email clients.
Mutt and Gnus are both modern, well-maintained, and available for "modern" machines (unless "modern", to you, means "comes with built-in malware").
Re: (Score:2, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
that there's more than one program they can use for their email. Most people use whatever program is pre-installed on their computer, and as more people use Windows than anything else, that generally means one form of Outlook or another. Either that, or they only know how to use webmaiil, and that's even worse when it comes to loading images and such without asking.
Re:Remote images? (Score:5, Interesting)
Now, the only way to truly track e-mails is to request the user click on a link to an external website to read the message. I don't know many people who would do this without suspicion.
Re:Remote images? (Score:5, Informative)
Re: (Score:3, Insightful)
Re:Remote images? (Score:5, Informative)
Re:Remote images? (Score:5, Interesting)
Thunderbird (Score:2)
If you send me an email, those bits are MINE (Score:4, Funny)
And there's NO way to stop me. If you sends bits to MY computer, using MY libraries, and running MY kernel, those bits are mine to do with as I wish, and I take offense at any attempts to prevent me from doing just that.
copyright (Score:3, Informative)
The copyright still remains with the sender, so, no, they are not yours. Furthermore, you cannot legally do with them as you wish.
Re:copyright (Score:5, Insightful)
Re: (Score:2, Insightful)
Re: (Score:3, Informative)
Would depend on the judge, but certainly I think there's room in the law for sanity on a matter such as this....
As usual, I am not a lawyer, but it seems to me that your assertion that it's a clear cut legal issue
Re: (Score:2)
Re: (Score:2)
I can do with the email as I wish. I can post it all over usenet if I so desire if I am not bound by a civil contract like an NDA or something. Then there are those so-called disclaimers that demand that the email be deleted if it was sent in error, and that it may contain confidential information or some other nonsense. At most they are there to scare people. At best, they
Re: (Score:2)
I can do with the email as I wish. I can post it all over usenet if I so desire if I am not bound by a civil contract like an NDA or something.
Wrong. Copyright is not a contract. It is a federal law. Furthermore, the copyright notification requirement was dropped years ago (1989 to be exact). The email writer does not have to notify you of any intent to enforce or not to enforce the copyright. Without a license, you can't reproduce it (outside of fair uses).
Now, there is another question about whether what is in the email is copyrightable but that's beyond the scope of this discussion.
Re: (Score:2)
Nope. Mail addressed to you becomes YOUR property. It is a gift from the sender to you. You may do anything with YOUR copy that you wish. Why do you think they need a warrant to search YOUR computer/mailbox, and not a warrant for each sender as well?
Every
Re: (Score:3, Informative)
Posting it via the net (email) IS publication. There is NO assumption whatsoever of privacy, unlike sealed mail through the post office. It has the same effect as a post card. If you believe your email isn't scanned, backed up on various servers, etc., you're naive. At any one time ther are multiple copies of your email sitting on your machine, the recipient's machine, undeleted mail queues, etc.
Email is not private. Get over it. If you want privacy, use pgp, or gpg. Don't depend on copyright law to "pre
Re: (Score:2)
You are automatically granted a license to copy email by the sender, since that is the ONLY way for you to actually read the email. Think of it - when you "send" email, your copy doesn't cease to exist on your computer and magically appear on the recipients' computer. You send a copy of the data, and it gets copied to various servers, into backups, etc., it's also scanned by 3rd parties, and the recipient finally receives a copy. Claiming that their making a copy would be infringement is meaningless. Just
i use Mozilla's Seamonkey suite (Score:2)
in the email client it defaults to not automatically load images and always go to prefrences and select to NEVER send a return receipt, it is nobodies business what i read...
Only if your mail client is severely misconfigured (Score:5, Informative)
In addition, you should set your client to never download external images. This should solve about 99% of these "exploits". As far as I can remember, the company mentioned uses a transparent/invisible image on an intentionally slowed down server that feeds the image byte by byte; usually, mail clients disconnect/cancel the download once you click another message.
I can only imagine "preventing" forwarding to work with really retarded mail clients (I think we all know the one I'm talking about).
The very valid reason why mail servers don't always return a message when a mail address does not exist, is because this can be used to phish for existing usernames - when you don't get a bounce message, you know you've probably hit a valid username. (because for most systems, login/username = default mail alias)
I've changed that on mine. (Score:2)
I work for a small insurance company. I cannot silently kill any incoming email.
So the email addresses are Firstname.Lastname@ (although we also accept and deliver FirstnameLastname@).
Phishing for "
Re: (Score:2)
Re: (Score:2, Informative)
Thunderbird defaults to asking when someone asks for a return receipt
Difference is that the recipient is notified about the return receipt and they can choose to take action from there.
Transparent images embedded in html emails (which never should have been started in the first place) are a different kettle of fish, in that most users won't realize that their email is being monitored
I suppose one way of gaining awareness would be setting up a system (think Sorbs/Spamhaus), which lists domains of people who embed sort of shit in their emails.
Companies frown upon negat
Re: (Score:2)
Re:Only if your mail client is severely misconfigu (Score:3, Informative)
The very valid reason why mail servers don't always return a message when a mail address does not exist, is because this can be used to phish for existing usernames - when you don't get a bounce message, you know you've probably hit a valid username. (because for most systems, login/username = default mail alias)
Spammers don't care about bounces, they deliver the message and move on. They don't linger around for a bounce, since that would require a valid return path, thus a trace back to the spammer's mail server.
I return bounces for all errors. If it's coming from a spammy host, there are other solutions far more effective and precise to reduce their volume. For one, Postfix drops the connection if several consecutive errors occur, and greylisting is a marvel against the common pump-and-dump spammers. There
Re:Only if your mail client is severely misconfigu (Score:2)
It is nobodies business to know whether, not to mention when I have first opened their e-mail (which is also, by the way, not the same thing as actually reading it).
I actually worked in a company where the "boss" put in place policy that all emails will request a read receipt AND he started investigating using these shoddy services.
I was very quick to drop the receipt headers in our mail server and forcing all outgoing mail to go through it.
There's not much you can do when they invoke these shitty tracking services though. It just becomes a cat and mouse game of shut one down and another pops up in its place or they find a workaround for your block.
Re: (Score:3, Funny)
Supported platforms (Score:4, Funny)
I also wondered about Gmail (Score:5, Insightful)
I run all my pop accounts through GMail. Images don't load automatically and I keep javascript on a short leash. So, do those services have some kind of techno-magic or are they just spying on the weak, the lame and the infirm?
Did you get it? (Score:5, Informative)
The other thing I see around here is the people who request a receipt (we use Outlook) when they send a global email to all 1500 users on the system. Most of them only do it once.
Re:Did you get it? (Score:4, Funny)
Do what I did ... "I didn't need to read your email a second time - I got the original off you machine earlier today as you typed it. I *told* you you're running an unsecure OS!"
You'd be surprised how many people fall for it.
The kind of people who would do this... (Score:3, Funny)
Too much trouble for everyday use, but most people have a pretty good idea about who they have to watch out for among their business associates.
Re: (Score:2, Insightful)
Why it can't work (Score:4, Informative)
http://theamigo.blogspot.com/2007/07/expiring-email-no-not-really.html
Re:Why it can't work (Score:4, Interesting)
html-only email (Score:5, Insightful)
As various people have pointed out, this would only really work if you sent html-only email, and if the recipient was guaranteed to have client software that executed javascript or something. I use mutt, a text-only email reader, and I have my mail software set up so it bounces html-only email (that it doesn't think is spam) back to the sender with an error message explaining that html-only email violates internet standards. I've never understood why anyone sends html-only email. Seems hard to believe that there would be service providers so clueless that they'd make html-only the default, and it also seems hard to believe that people would be clueless enough to want to send html-only email, but clueful enough to switch to html-only if it wasn't the default.
I have to admit that the concept of being able to get a return receipt for email has a certain allure. Recently, for example, my boss got pissed off at me and made a big scene because he thought I hadn't notified him about something. I happened to have a copy of the email in which I notified him, and I also happened to have saved his reply to it. But what if I hadn't saved the reply, or if he hadn't replied?
A lot of people send CYA emails, e.g., "Okay, this is to confirm that you want me to put the uranium in the crisper drawer of the fridge, and that you take responsibility for the results." But the recipient can pretend he never got it.
Re:html-only email (Score:5, Informative)
The MIME standards (which are entirely optional) do not require duplicate text and html versions of a message either. There are several MIME content types, of which only multipart/alternative is intended for duplicate content with degraded formatting such as separate text and html versions, and in this case the actual formats can be anything, eg they could be a text version and an MS Word version, without an HTML version.
Re: (Score:3, Informative)
...I have my mail software set up so it bounces html-only email (that it doesn't think is spam) back to the sender with an error message explaining that html-only email violates internet standards.
Um. I'm unaware of any IETF standard regarding HTML-formatted email transmission. Unless you can link me to such a standard, there is no violation.
Also, you are an ass. Additionally, if you're unable to configure an MUA produced in the last five years to correctly render HTML email, you're a fucking moron.
Re: (Score:2)
Then he would be just as mad at you as he now is. Because don't think for a minute that because saying "I *did* tell you" leaves you off the hook.
What basically happens, is that he's disappointed and h
Re: (Score:2)
Because wanting to use italics, underline, bold, fonts, etc., allows more expressivity?
And the 'standard' way to do that (and is supported by Gmail at least) is: /italics/ _underline_
*bold*
I think you need to get your facts straight. Email is text-only. There's no great need to lay it out and format it like a bloody well polished journal article.
For what reason? For the 1% of users who don't use an HTML-capable email reader?
No, because HTML email uses a lot more bandwidth, doesn't render the same in any two places, etc. Text only email truncated at around 72 chars per line is almost guaranteed to render the same no matter where the reader is.
Personally I've never understood the reason for sending dual plain-text and HTML copies in the same email. It's just doubling the bandwidth for something that can be trivially "downgraded" on demand.
The first smart thing
Re: (Score:2)
Re: (Score:2)
I think you need to get your facts straight. Email is text-only. There's no great need to lay it out and format it like a bloody well polished journal article.
Originally, yes, email was text only, but like everything else it evolves as the users and developers want. In particular, business usage of email has diverged very far from the original ideals.
HTML is pretty much the standard in most corporate mail systems, as far as I can see, and I do myself use it for basic formatting and inline images. The most common usage I see is for quoting and inline replies with multiple colours. While this is partly generated by the limitations of Outlook, I actually find it e
Re: (Score:2)
. In fact there is a TBird plugin to do the same thing automatically...
Automatically; that is the point. There's no need to include that formatting in the email because the mail client can work out how to emphasise the different levels of reply based on the standard quote marker (greater than) in an email.
In fact, using HTML and trying do to it magically makes it harder for users who don't get HTML mails to read or to copy/paste out a relevant section into something else.
Re: (Score:2)
Not all users want to receive emails that are nothing but a line of text and an MS-Word attachment, or that have text in cyan letters overlaid on a background of ocean waves crashing on the beach.
I don't want to receive any MS Word attachments to emails.
That said, I'd much rather see a PDF if sharing it with formatting is so damned important to the sender. At least I can read PDFs and see the same thing they saw. That is a problem with rich text formats and Word attachments.
The biggest problem with making something like HTML mail a feature is that suddenly every schmuck feels that they MUST use this shiny new feature and you get just that; a bunch of emails with Javascript signatures that fade in
Re: (Score:2)
Many email clients understand the old tricks for indicating bold or italics - *bold* and /italics/.
Anything much more than that, and you end up with email that looks like a ransom letter on crack - 15 different fonts, blinking text, all sorts of images, etc.
Links to actual services (Score:5, Informative)
I'm surprised the author didn't link to the actual services:
Both seem to be easily defeated; indeed, the ReadNotify FAQ mentions that the "invisible" tracking service (which I assume means that it just includes the tracking images in the message) may be unreliable.
Re: (Score:2)
Blacklisting the abusers (Score:5, Interesting)
I therefore recommend blacklisting (in your MTA and web proxy) readnotify.com, pointofmail.com, e-mail-servers.com, didtheyreadit.com, mailinfo.com, and msgtag.com. I welcome any additions to this list.
I should also mention that those who use superior mail clients -- e.g., mutt -- can avoid being spied on by these abusers. I strongly recommend using such clients, or configuring other lesser clients so that they do not cooperate.
Re: (Score:3, Interesting)
These services are weak, some aren't. (Score:3, Interesting)
The more dangerous class of trackers are those that do operate on the recipient's system. In principle those can be defeated, just as DRM systems can; but doing so may be substantially challenging, particularly for joe user. Luckily, requiring the recipient to install a program of some sort just to view an email is pretty inconvenient, so these aren't commonly used; but if an entity that you pretty much have to interact with(employer, distance education system, government, etc.) took up using such a system, there would be a serious danger.
If the system is running on your computer... (Score:2)
P.S. Wouldn't sending a letter in WoW fall under a "more dangerous class of trackers", since one entity knows the sent and received states of all messages on the system and can vi
CYA (Score:5, Interesting)
True story, I took an online course in Fall 07. I submitted my final to the prof. via email at his request. Neither the email or the attachment was ever opened and readnotify is extremely reliable for this particular prof. I still got a 4.0 so I'm not complaining.
Re:CYA (Score:4, Insightful)
Re: (Score:3, Insightful)
Aimed at the same people ... (Score:4, Funny)
email image tracking (Score:4, Interesting)
Long story short - the person was on the other side of the world to where they were claiming to be based on their IP address.
Microsoft has them covered (Score:3, Informative)
Now, if Outlook could come configured by default to prevent sending the messages in the first place, that would really help conserve bandwidth.
ELM (Score:3, Interesting)
Not Your E-Mail Any Longer (Score:4, Insightful)
If it were otherwise then you're not sending me e-mail, but instead a license agreement to read your words for a limited period of time. If that's the case, then there needs to be a click-through license agreement first.