From: Jinwoo Lee Date: Wed, 28 Jan 2015 04:44:10 +0000 (+1600) Subject: Re: privacy problem: text/html parts pull in network resources X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=113c696c475e151ebc368ff26b14ed82141e7aa5;p=notmuch-archives.git Re: privacy problem: text/html parts pull in network resources --- diff --git a/eb/61366c13e715cf1e9d781ca737abd47c261970 b/eb/61366c13e715cf1e9d781ca737abd47c261970 new file mode 100644 index 000000000..0c02b7c8b --- /dev/null +++ b/eb/61366c13e715cf1e9d781ca737abd47c261970 @@ -0,0 +1,112 @@ +Return-Path: +X-Original-To: notmuch@notmuchmail.org +Delivered-To: notmuch@notmuchmail.org +Received: from localhost (localhost [127.0.0.1]) + by olra.theworths.org (Postfix) with ESMTP id DA6D4431FC9 + for ; Tue, 27 Jan 2015 20:44:17 -0800 (PST) +X-Virus-Scanned: Debian amavisd-new at olra.theworths.org +X-Spam-Flag: NO +X-Spam-Score: 2.639 +X-Spam-Level: ** +X-Spam-Status: No, score=2.639 tagged_above=-999 required=5 + tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, + DNS_FROM_AHBL_RHSBL=2.438, FREEMAIL_ENVFROM_END_DIGIT=1, + FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=disabled +Received: from olra.theworths.org ([127.0.0.1]) + by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024) + with ESMTP id 3mR7t83dmx73 for ; + Tue, 27 Jan 2015 20:44:14 -0800 (PST) +Received: from mail-pd0-f172.google.com (mail-pd0-f172.google.com + [209.85.192.172]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) + (No client certificate requested) + by olra.theworths.org (Postfix) with ESMTPS id 8A050431FAF + for ; Tue, 27 Jan 2015 20:44:14 -0800 (PST) +Received: by mail-pd0-f172.google.com with SMTP id v10so23270573pde.3 + for ; Tue, 27 Jan 2015 20:44:13 -0800 (PST) +DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; + h=from:to:subject:in-reply-to:references:user-agent:date:message-id + :mime-version:content-type; + bh=g+bJ/t4Y/uYSIjRuZRBgW8YXqOKJZ/oNyHIWfNPat5Q=; + b=KAhhJ1Mh7Aag7iOQK9wDCEhXzNPSVdd1WU/xbXOyW54Qcb/RN90xhthprC6Eh0y77X + pluvwNoep1gxOafz8brJMcMmZ3kQFskiQC2SFdRQ5UO+vuXIlDck6r18g2G+amhgI7Dr + FOPQSjlernOQUwn21UN4WnAH1ropWttXhQmx8hGoUp9yWsSMF/AfkeepZdATl9xEeThZ + OvxfqpqJnm03k4R02ttAwI2bIF4d9KAE50ux8YFo9boCqw/jJmfbTZAXcoiKykODE98F + JFGfy2xTsjHdzSuHYJjKlbGEVfH+hPs9RyDrDmuUBzAjtAu7Kf/Df+Be3p2LR2P6TOIN + l+GA== +X-Received: by 10.66.124.225 with SMTP id ml1mr2490155pab.142.1422420253619; + Tue, 27 Jan 2015 20:44:13 -0800 (PST) +Received: from localhost ([2601:9:5d00:15b9:4126:a36a:c52a:a96f]) + by mx.google.com with ESMTPSA id lq2sm3213926pab.34.2015.01.27.20.44.12 + (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); + Tue, 27 Jan 2015 20:44:12 -0800 (PST) +From: Jinwoo Lee +To: Daniel Kahn Gillmor , + David Bremner , + notmuch mailing list +Subject: Re: privacy problem: text/html parts pull in network resources +In-Reply-To: <871tmfin1k.fsf@alice.fifthhorseman.net> +References: <87ppa7q25w.fsf@alice.fifthhorseman.net> + <87fvay3g0g.fsf@maritornes.cs.unb.ca> + <871tmfin1k.fsf@alice.fifthhorseman.net> +User-Agent: Notmuch/0.18.1 (http://notmuchmail.org) Emacs/24.4.1 + (x86_64-apple-darwin13.2.0) +Date: Tue, 27 Jan 2015 20:44:10 -0800 +Message-ID: +MIME-Version: 1.0 +Content-Type: text/plain +X-BeenThere: notmuch@notmuchmail.org +X-Mailman-Version: 2.1.13 +Precedence: list +List-Id: "Use and development of the notmuch mail system." + +List-Unsubscribe: , + +List-Archive: +List-Post: +List-Help: +List-Subscribe: , + +X-List-Received-Date: Wed, 28 Jan 2015 04:44:18 -0000 + +On Tue, Jan 27, 2015 at 07:47 PM, Daniel Kahn Gillmor wrote: +> On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: +>> Daniel Kahn Gillmor writes: +>> +>>> If i send a message with a text/html part (either it's only text/html, +>>> or all parts are rendered, or it's multipart/alternative with only a +>>> text/html subpart) and that HTML has >> src="http://example.org/test.png"/> in it, then notmuch will make a +>>> network request for that image. +>>> +>>> This is a privacy disaster, because it enables an e-mail sender to use +>>> "web bugs" to tell when a given notmuch user has opened their e-mail. +>> +>> I've just pushed Austin's shr related series to master, so this problem +>> should be fixed as of commit b74ed1c. One tradeoff that we should at +>> least remark in NEWS, if not actually fix, is that I think there is now +>> no way to view such images in notmuch. I don't know offhand what other +>> html renderers will do. +> +> thanks for this, David and Austin! +> +> Other html-rendering mail clients that are privacy-conscious will often +> provide a button or mechanism to indicate that some remote resources +> were requested by the page but weren't fetched (e.g. a button saying +> something like [Load Remote Images...]). I have no idea who actually +> clicks on those buttons (or why), though, and even if we wanted them, +> we'd only want to add a button on an image that actually had remote +> network resources to load, and i don't know how we'd get that +> information propagated back up the rendering stack to make such a +> display decision. So i'm fine with leaving it this way for now. + +Well, most promotional emails contain remote images and their contents +are incomprehensible without those images. I ignore most of them but I +do read a few of those promotional emails. It would be great to have a +UI for loading remote resources. + +> +> --dkg +> _______________________________________________ +> notmuch mailing list +> notmuch@notmuchmail.org +> http://notmuchmail.org/mailman/listinfo/notmuch