Great news for SPAM haters (aren't we all?) - Page 1
Forum section: electronics / general

author: Benta
author_rank: Super Contributor
timestamp: August 26, 2022, 09:13:26 pm
content: DuckDuckGo has opened it's email tracker-stripping service for Spam etc.The idea is, you open an email account at duck.com which you use when having to enter your email at a site you don't really trust or don't want to be tracked from. (plenty of those around)duck.com will strip the spam (it may also be totally legit emails) for trackers and forward the mail to your real email addressGet your duck.com address now, before the nice ones are gone.https://arstechnica.com/gadgets/2022/08/duckduckgo-now-offers-anti-tracking-email-service-to-everyone/Now, a problem might be that all those spam merchants decide to disallow duck.com adresses. I've already thought around that one: make a free email account at some free mail provider, and use that up front. Let the account forward the mails to the duck.com account automatically, and throw the email into the garbage at the same time.Done.I look forward to this, I already have my duck.com account.EDIT: I'm going NUTS right now. I'm trying to post a link to the arstechnica.com article, but it just doesn't appear in the post. Why not?

author: ataradov
author_rank: Super Contributor
timestamp: August 26, 2022, 09:29:39 pm
content: I don't really get spam on my regular account. I use FastMail and their spam filter is pretty nice. I also set spam scores for instan deletion and move to spam folder somewhat high. I get occasional spam email once a week or so, but most of it gets trashed before I see it.And for sketchy services or mandatory signups where I don't really care to provide my real email, I use throwaway email at mailinator.com. Some sites block mailinator, so I have a custom domain that uses mailinator as MX record, so mailinator would accept mail for that domain with no effort on my side. For a domain cost ($15/year) it totally worth it.

author: Benta
author_rank: Super Contributor
timestamp: August 26, 2022, 09:34:53 pm
content: It's not really about spam, but trackers. HP, Apple, Ebay, Google, you name it, like to use this. Stripping incoming emails of this cr*p is to me a good service.I't up to you.

author: ataradov
author_rank: Super Contributor
timestamp: August 26, 2022, 09:41:17 pm
content: Is not that blocked by essentially every email service? I have my stuff set to never download anything but the text for sources that are not in my address book. And I think this is the default setting everywhere.I guess once you decide to add the source to the address list, you would be tracked without additional blockers.But also, I'm not sure how I would feel about my primary email being @duck.com. A lot of stuff can go really wrong here.

author: Benta
author_rank: Super Contributor
timestamp: August 26, 2022, 09:56:51 pm
content: Quote from: ataradov on August 26, 2022, 09:41:17 pmNo. All the responses from the above mentioned sites are graphic/html. Do you only receive text emails, like 30 years ago? Times New Roman?And I never said anything about duck.com being your primary email.But perhaps my readability index is too high.

author: ataradov
author_rank: Super Contributor
timestamp: August 26, 2022, 10:14:56 pm
content: HTML is fine, but the graphics (including tracking pixels) that are linked to the outside sites are blocked. This does not stop rendering of the email without providing any feedback. It might break formatting a bit, but that's not a huge deal.I would not just let it download anything from any outside source even after passing though that duck service.

author: eti
author_rank: Super Contributor
timestamp: August 30, 2022, 12:12:17 am
content: I always knew there was some "Taking the moral high ground" with that company with SUCH A STUPID name, which I refuse to repeatAmazing how easily swayed people are, when they're told that a product will "free them" from something. Load of crap. Stupid name, stupid company, and now they've been rumbled. Next................

author: PlainName
author_rank: Super Contributor
timestamp: August 30, 2022, 05:13:39 pm
content: A better rant would be about people posting two-hour videos in which something something but neglect to say where, or what.

author: madires
author_rank: Super Contributor
timestamp: August 30, 2022, 05:55:44 pm
content: Simply use an email client that shows you the text message, and not the HTML.

author: Benta
author_rank: Super Contributor
timestamp: August 30, 2022, 07:43:12 pm
content: Quote from: madires on August 30, 2022, 05:55:44 pmYes. Or go back to granite, hammer and chisel.

author: Benta
author_rank: Super Contributor
timestamp: August 30, 2022, 07:44:26 pm
content: Quote from: dunkemhigh on August 30, 2022, 05:13:39 pm

author: ataradov
author_rank: Super Contributor
timestamp: August 30, 2022, 07:49:17 pm
content: You can use HTML, it is perfectly safe as long as you don't download external images or other resources. And automatically downloading stuff like this from email is nuts no matter what amount of filters you have. You are asking to get owned.

author: madires
author_rank: Super Contributor
timestamp: August 30, 2022, 08:48:36 pm
content: Quote from: Benta on August 30, 2022, 07:43:12 pmThe HTML is just for formatting and can be also used for tracking and other stuff we don't want. So you can either add security and privacy features to an email client and hope it does help, or simply go for the text content which minimizes the attack surface dramatically. I've seen so many security/privacy issues with HTML emails and email clients over the last two decades that I happily prefer text emails over fancy HTML.

author: ataradov
author_rank: Super Contributor
timestamp: August 30, 2022, 08:50:53 pm
content: Quote from: madires on August 30, 2022, 08:48:36 pmHow exactly? Don't spread misinformation.

author: madires
author_rank: Super Contributor
timestamp: August 30, 2022, 09:01:23 pm
content: Simply look up Outlook's security issues for the last 20+ years.

author: ataradov
author_rank: Super Contributor
timestamp: August 30, 2022, 09:13:36 pm
content: Can you point out any actual issues that lead to tracking? Also, who is using outlook?Also, security issues in individual clients are different from inherent weaknesses in the protocol. HTML is perfectly safe on its own.

author: madires
author_rank: Super Contributor
timestamp: August 30, 2022, 09:21:41 pm
content: For tracking you can use the old fashoned 1x1 pixel transparent image, for example. Outlook is used by many corporations. Here's a blog post about HTML injection:https://www.twilio.com/blog/dont-get-pwned-via-email-html-injection.How hard is it to search for "HTML email security issues"?

author: ataradov
author_rank: Super Contributor
timestamp: August 30, 2022, 09:24:33 pm
content: Quote from: madires on August 30, 2022, 09:21:41 pmAs I said, you need to disable images by default. This does not prevent use of HTML.But I don't really care, use whatever you want.

author: SeanB
author_rank: Super Contributor
timestamp: August 30, 2022, 09:52:26 pm
content: Quote from: Benta on August 30, 2022, 07:44:26 pmWell, Steve actually has both show notes and a transcript of the show available.https://www.grc.com/sn/sn-873-notes.pdfstart at page 13 of the PDF to read about it......

author: PlainName
author_rank: Super Contributor
timestamp: August 30, 2022, 10:24:26 pm
content: Maybe he could have taken the 2 seconds to post those links, then. But better would be to just say wtf he is ranting about andthenthe web links might be interesting to waste our time on.

author: madires
author_rank: Super Contributor
timestamp: September 01, 2022, 01:35:20 pm
content: Quote from: ataradov on August 30, 2022, 09:24:33 pmReleased yesterday:Thunderbird CVE-2022-3033 (https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/) and two more HTML related security issues.If you're interested in security please subscribe to a security mailing list and you'll see how bad things are. Most people aren't aware of these security issues since mainstream media reports them only very rarely. I'm just trying to increase awareness and possibly educate a few users as I'm involved in this cat and mouse game for a long time.

author: ataradov
author_rank: Super Contributor
timestamp: September 01, 2022, 04:40:17 pm
content: Quote from: madires on September 01, 2022, 01:35:20 pmVulnerabilities in clients are different. I don't consider them a real problem unless you are being specifically targeted. Advertisers and trackers will not use them, since they get patched and only affect a limited set of clients.Also, the recent issue does not affect Simple HTML mode, which is the mode I would use if I used Thunderbird.There is noting prevents your client from having issues with parsing the text as well. Sure, plain text is easier, so the chance of an issue is lower, but you can't eliminate it.