Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sparrow for iPhone

sparrowmailapp.com

Post reply on HN
Print view View original

51–60 of 103 posts

Re: Sparrow for iPhone

#51

Post by mike-cardwell »

dsplittgerber wrote: post #50
mike-cardwell wrote: post #39

Has anyone tested this client with The Email Privacy Tester yet? https://grepular.com/email_privacy_tester/ - I'd do it myself, but I don't have an iOS device.

I was seriously shocked to see that the iPhone's native client leaked that bad. 2 questions: 1) Is it possible for an app to leak less? 2) Is the 'leakage' already commonly exploited by firms for specific means? (proving you saw something etc.) If anyone could help, that'd be awesome!

My understanding (I don't have an iOS device) is that the standard iOS email client has remote images enabled by default, and if you turn that off, then it doesn't leak at all. I think all email clients should have the option to automatically load remote images, but that it should be disabled by default. The problem is, users don't understand that by clicking the "load remote images" button, it will be possible to track them, so they often don't understand its purpose.

It is possible for an email app to not leak at all. All it has to do is not load remote content unless the user specifically requests it.

Yes, these tricks are commonly exploited. Most of the time, people just use a simple img tag pointing to a 1 pixel image, although recently there was some news about Facebook using the bgsound tag.

I don't know if law enforcement ever use these sort of techniques to try and track down suspects, but it wouldn't surprise me.

Re: Sparrow for iPhone

#52

Post by mike-cardwell »

Tyrannosaurs wrote: post #45
mike-cardwell wrote: post #39

Has anyone tested this client with The Email Privacy Tester yet? https://grepular.com/email_privacy_tester/ - I'd do it myself, but I don't have an iOS device.

Leaks on 12 out of 32.

Does it have an option to enable/disable automatic loading of remote images? If so, what is it set to by default? And does it still leak if you disable loading of remote images?

Re: Sparrow for iPhone

#53

Post by Tyrannosaurs »

mike-cardwell wrote: post #52
Tyrannosaurs wrote: post #45

Earlier quoted context omitted.

Leaks on 12 out of 32.

Does it have an option to enable/disable automatic loading of remote images? If so, what is it set to by default? And does it still leak if you disable loading of remote images?

No such option that I can see.

Re: Sparrow for iPhone

#54

Post by mike-cardwell »

ropiku wrote: post #44
mike-cardwell wrote: post #39

Has anyone tested this client with The Email Privacy Tester yet? https://grepular.com/email_privacy_tester/ - I'd do it myself, but I don't have an iOS device.

Here's my result: http://cl.ly/1p2M3C462Y0E0u0F0w3b

Interesting that it seems to loads remote Flash content. I wonder if you could do anything nefarious with that capability. I don't know Flash enough to comment.

Re: Sparrow for iPhone

#55

Post by mike-cardwell »

Tyrannosaurs wrote: post #53
mike-cardwell wrote: post #52

Earlier quoted context omitted.

Does it have an option to enable/disable automatic loading of remote images? If so, what is it set to by default? And does it still leak if you disable loading of remote images?

No such option that I can see.

Can anyone confirm this? I've never seen an email client that lacks such an option...

Re: Sparrow for iPhone

#56

Post by lylejohnson »

ivanstojic wrote: post #25

I have several (breaking) issues with the paid desktop version of the Sparrow.app. I've posted the most bothersome one on their support forums about two weeks ago: no reply at all. Nothing. As a company that does epic UI, they should figure out that customer support is a form of user interface as well. I'm not ready to give them any more money at this point.

I stopped using Sparrow due to a bug in their implementation of two-factor authentication for Gmail (it would always "forget" my app-specific password on startup). I got at least one (unhelpful) response to my support request(s) but the trail eventually went dead, with no resolution to the problem.

Re: Sparrow for iPhone

#58

Post by tomkr »

Tyrannosaurs wrote: post #48
tomkr wrote: post #29

Earlier quoted context omitted.

I like that they're being honest about this and are focussing on what they are good at. The request push option, useless as it may be with Apple in charge, might be just what is needed. As they already state, allowing an e-mail app into the app store in the first place is a step in the right direction. Why not try to prod Apple to take another one.

The problem is focusing on what they're good at leaves the user with only half a product. I've just downloaded the app and it's awesome from a UI perspective, but it's never going to be an option as my primary mail app in it's current form which means I really can't recommend it to anyone. Yes Apple might change their policy on this but it seems unlikely, at least in the short term. I think their best hope would be a…

I'd say it's better to have half a product than to have a product that spills your e-mail credentials all over the web. It's not like they try to hide the shortcoming in their app, they are open about it. If you feel the lack of push is a dealbreaker then you can just not use or buy the app.

Re: Sparrow for iPhone

#59

Post by mgcross »

ivanstojic wrote: post #25

I have several (breaking) issues with the paid desktop version of the Sparrow.app. I've posted the most bothersome one on their support forums about two weeks ago: no reply at all. Nothing. As a company that does epic UI, they should figure out that customer support is a form of user interface as well. I'm not ready to give them any more money at this point.

I've also had a lot of problems, primarily that email subjects don't properly link to the body. Very confusing. I gave up on the app after a couple of updates.
Post reply on HN