71–80 of 99 posts
Earlier quoted context omitted.
It seems to be the MTA (probably the spam filter), since it happens to me even without any client open, so there's probably no way to close it by your end.
If it happens without any client open, then it isn't really a problem is it?
Earlier quoted context omitted.
If it happens without any client open, then it isn't really a problem is it?
Well, it doesn't happen if the address doesn't exist (I tested it too), so it can still be used by spammers to check for that.
People don't expect that when they read an email, the sender knows when they read it and from what IP address. If you're using a tracking image or any similar technology, then you are exploiting a weakness in the system to take information that you don't have permission to. I recognise that it's standard industry practice, but it's categorically not ok. If you want to track users, ask for their permission. If you hav…
You are right in principle, but this isn't a tricky detail about email. This is fundamentally how Facebook and Google run their businesses.
Earlier quoted context omitted.
Doesn't gmail stop these attacks without needing to force plaintext only by simply disabling images by default?
Yes. There was a bug a few years back though where they would display attached SVG images. These images could actually contain javascript, which left it vulnerable to XSS.
And it's the whole point of the article.
Earlier quoted context omitted.
So, by the same logic, twitter should allow javascript to execute when I view some post about people microwaving small mammals. Perhaps I should be more explicit. My problem is not with the abilities to assign pixels to an output device. Email should not be an interactive proposition and should have no ability whatsoever to run code.
Email should not be an interactive proposition and should have no ability whatsoever to run code. Agreed, but HTML isn't runnable code. It's a declarative document format.
How many people complaining about email open tracking are also Sendgrid customers? Use email newsletter service? Your emails may have open tracking (including who opened it) without you even knowing.
I have yet to work out why anyone should wish to turn on html in emails ever and I always thought that was the start of email being broken. Protocols existed before machines and should serve us as well as them.
HTML isn't what bugs you. Unauthorized loading of remote content is what bugs you. That's a misfeature of your (and most people's) mail reader.
This is yet another reason to filter all messages from Facebook directly to the trash folder. The last thing I need is a constant stream of attention-sapping fb emails polluting my inbox.
You could also just tell Facebook to not email you.
Earlier quoted context omitted.
The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes. It may shift the cost in a way you prefer, but it also slows down the send so users may not get their mails in a reasonable time, and may not appreciate the l…
The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes. But wouldn't the sender have to serve the images over HTTP anyway? Unless you expect a big percentage of those emails to never be opened, but then I have to w…
Earlier quoted context omitted.
Well, it doesn't happen if the address doesn't exist (I tested it too), so it can still be used by spammers to check for that.
If an address doesn't exist the message will simply bounce. Or am I missing something?
https://grepular.com/email_privacy_tester/lookup?code=gapz72...
If the address exists in Gmail, you get a response on "DNS Prefetch - Anchor", so it could be used to determine whether to send an email or not. I'm not a mail administrator but I can imagine how it might be useful to a spammer, e.g to stop mass bounce replies.