Hacker News Reader

Comment by betterunix | Hacker News Reader

It sounds like the emails were mostly HTML mail that fetched external images. HTML mail is a terrible thing that should be stopped, and HTML mail that fetches anything external is a security problem. It's nice to know that these Fab people were thinking about their customers, but the bigger picture here is that HTML mail was being abused to violate those same customers' privacy. It may have been for a good reason, but it was still a bad thing to do and legitimizing the practice will make it easier to carry out attacks via email.

The solution to inbox clutter is filtering. If users are too lazy to make filters, then the problem is with the effort required to make filters.

View on HN

Obviously you're entitled to your opinion.

But I think the fact that users opt-in to HTML emails and engage with them far more frequently than text opt-in and engagement indicates that your opinion is an outlier.

I like HTML email. I opt-in only to companies that interest me enough to do so. Those times when I'm opted-in accidentally by not unchecking a box or whatever during checkout I just unsubscribe from and move on. What I have left is useful content in my inbox, some of it more directly sales oriented, the rest more generally informational.

Similarly, for certain senders, I chose to tell Gmail to always load their images — including tracking pixels. It's not a violation of my privacy any more than the numerous pixels on any other website I read.

I have little doubt that I am an outlier, since most users have no idea what HTML even is. I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox.

HTML mail itself is a security problem. It has been used for fairly sophisticated phishing attacks in the past:

http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache...

It is almost certainly being used for phishing attacks now. It makes it difficult to give users visual cues about which emails can be trusted, since the sender could have embedded HTML in the message to present that same queue. An attacker might give the user the idea that a message was digitally signed by using HTML mail.

Security with HTML mail is a serious enough concern that the DoD will sometimes convert all incoming HTML mail to plaintext as a precaution:

http://it.slashdot.org/story/06/12/24/1922216/department-of-...

"It's not a violation of my privacy any more than the numerous pixels on any other website I read."

In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation.

> In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation.

So...the web at large violates people's privacy. I can agree to that, but I prefer a world where everyone has easy access to large amounts of information.

If the available communication mediums are only those that are secure but difficult to use, then the ecosystems of many sites would be much smaller. I can't imagine trying to browse Facebook or Yelp over a TOR connection. It's feasible but annoying to me. That tells me most of my friends and family would simply consider this process unfeasible and not use it.

You know, there was a time when browsing the web did not entail constant violations of your privacy. The web has always been open and has always been giving people easy access to information, since its very inception; the assault on privacy came later, when greedy advertisers showed up and took advantage of security problems and user ignorance.

While Tor is fairly annoying for most people (even myself), other privacy-protecting systems are less annoying. I have yet to hear someone complain about using ABP, which I would classify as privacy protecting (it blocks a large number of common tracking systems). I suspect nobody would complain about Firefox blocking tracking cookies by default either.

Really, we can live in a world where privacy is respected if we are willing to do so and willing to deploy the necessary technologies. One of my side projects is to develop a system that allows targeted ads to be delivered in a privacy-preserving fashion, so that advertisers can know which ads are successful without knowing whether any individual person actually viewed or clicked on their ads (using cryptographic techniques). My point is that there is no need to violate privacy and that better technologies can be developed and deployed.

You know, the "Greedy Advertisers" showed up when "Greedy Website Operators" decided that they didn't want to pay out of pocket to provide people with information. And that, actually, they'd like to make a buck or two doing it.

The web today has far more information and functionality than ever before. Much of this free to me because of advertising.

You act like the advertisers some how force things down your throat. If you don't want to deal with advertising, the answer is simple: Avoid websites that rely on advertising dollars.

"Avoid websites that rely on advertising dollars."

Or plan B: ABP.

So you're THAT type.

You feel entitled enough to just take what you want from a website while they pay the cost for your traffic.

Well, go ahead with that. And justify yourself with your "greedy advertisers ruined everything and violate my privacy" BS.

Feel free to have the last word here.

ABP is one of the first things I install on friends' computers which I have had to remove malware from. I genuinely think, for normal non-techy users, it is probably one of the most effective and simple methods of stopping people accidentally giving themselves problems.

Obviously this isn't because of the nice sites with good content which just want to make some money from their effort, it's generally because of less legitimate sites. But I think the idealogical argument of "these content providers deserve to get paid" just falls into irrelevance for these people when the alternative is protecting their computers, privacy, safety online, and of course their time.

As an ABP user who uses it mainly to make my internet experience nicer, I can take the time to unblock websites which I agree I should be supporting or reimbursing somehow for the content they have provided me, but most people would never take the time to do this, and for them the best solution seems to me to be blocking all ads where possible.

> I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox.

Are you serious? I can assure you that I have opted in to receive email, even HTML email, and so have nearly all my friends.

> It is almost certainly being used for phishing attacks now.

And the solution is to teach users about phishing. That's the only sane route, it's what everybody is doing and, by the way, and it mostly works (despite some ISPs, governments and banks trying hard to teach people that they must click on every unreliable warning).

> An attacker might give the user the idea that a message was digitally signed by using HTML mail.

That's a bug in your reader.

> most [email] users have no idea what HTML even is.

For most users email is something you do in a web browser. They've never used it any other way.

> I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox.

We manage lists with an aggregate about 1 million people who have all explicitly ticket checkboxes that were not checked by default and/or explicitly gone into their user account and added mailing lists on various sites we operate for clients.

That you even doubt that people are truly opting in just reinforce how much of an outlier you are.

I understand where you're coming from, but you're swimming upstream in a raging torrent and being carried away at 100x the speed of your progress.

The filter side can always be better, sure, but HTML is tremendously successful and it only annoys a tiny minority. It's not going anywhere, accepting this will create less cognitive dissonance for yourself.

I am fine swimming upstream. I browse with Javascript disabled, I am not on any social networking sites, I do not have a smartphone, etc. I do not get too stressed about these things as long as I can keep doing things my way.

Ultimately, I think filtering is going to win. The problems with HTML mail are going to become more severe, not less. Phishing attacks are becoming more and more of a problem, and HTML mail makes phishing attacks much easier to carry out. The sort of tracking that Fab used to detect who was actually reading their mail could just as easily be used to identify potential targets for scams, or in a coordinated attack of some kind. We cannot continue to leave ourselves open to such attacks -- eventually we are going to have to start blocking HTML mail or at least blocking external images/etc. Filters that are good enough to reduce clutter are already starting to be deployed e.g. GMail's Priority Inbox, and GMail already blocks external images by default.

> HTML mail is a terrible thing that should be stopped,

Yes. Really, yes.

Please, if you offer email please also offer plain text email.

  | HTML mail is a terrible thing that should be stopped

How so? Obviously the full set of HTML isn't optimal, but just using a subset of HTML formatting for things like headings, etc isn't that bad.

Anything other than basic text formatting is at least a major security problem. The simplest scenario is a phishing attack that disguises itself as a plaintext message, with blue underlined URLs that are actually links to the attacker's site. There have also be CSRF attacks carried out by HTML mail. More sophisticated attacks are also possible:

http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache...

Even more sophisticated attacks could be imagined. Suppose you train users to look for a digital signature check; an HTML message could be used to create something that looks like such a check, tricking people into believing they received a signed message. The sort of monitoring used to unsubscribe Fab's readers could have been used to determine when people are at their desks in a particular office, or who is more likely to read a scam message.

It is a no-brainer: HTML mail allows the sender of a message to render things of their choosing on your screen, and potentially execute code they have written on your computer (similar things can be said about the web; the difference is that setting up a website is useless if nobody visits it, but with email you get to send someone the message without waiting for them to request it). There are other complaints about HTML mail, but the security angle is biggest in my opinion.

betterunix has spoken folks. If we just do what he thinks is best, the world would be a better place. Your little 'opinions' are cute but they ultimately don't matter, because betterunix has decided what is best, and that is that HTML mail is terrible and should be stopped. TEXT FOR US ALL.

Would you have not chosen an ad hominem attack if he had prefixed his opinion with "in my opinion?" Would you demand that everyone post that way?

Sometimes I think people use these logical classifications to downplay others too liberally. In this case benihana's sarcasm is effective because it uses ad hominem. It's meant to point out that perhaps his response is too absolutist given it's a not widely held opinion.

Again, should any opinion posted here that is not widely held be prefixed with "in my opinion?" Does that make it more acceptable?

Reply on news.ycombinator.com