"How Close.io (YC W11) exploited a technical loop hole in the way email and the web works in order to mine data about users without their knowledge or permission"
Oh, but everyone does it, so it's ok right?
Oh, but everyone does it, so it's ok right?
And to address the: 'I don't get the "without their knowledge or permission" part.' - What don't you get about this? The recipient doesn't realise the tracking is taking place, and the sender never asked permission to perform the tracking, nor to store the data...
> the sender never asked permission to perform the tracking, nor to store the data
Well, in this case the sender would be someone using Close.io as their CRM. So they actually almost certainly do want this tracking to be performed.
SMTP and IMAP are transport protocols. For transporting text around:
"By utilizing SMTPs RCPT TO command" - He's not utilising anything special. This is exactly how every other email that employs tracking pixels is sent. A separate recipient and message body for each recipient.
"Remove any messages stored by the SMTP server" ... "Google's SMTP servers store a copy of every message"
Nope. SMTP is used for mail servers to pass email about. An SMTP server doesn't store mail, apart from in it's temporary queue before forwarding it on.
"Store sent mail in IMAP" ... "If using a service like Gmail which stores all sent messages automatically in IMAP" - Again, you don't store email in a message transfer protocol.
This article reads particularly badly because of the repeated incorrect use of terminology.
[edit] And to address your comment, "they actually almost certainly do want this tracking to be performed" - "want" is an interesting word to use there. If there was a tick box in the top right corner of peoples email clients which said:
Allow senders to track when you open a message,
where you were when you opened it, and various
pieces of information about your system
Note that Google's SMTP servers do store the messages in your sent mail folder. I don't claim to know exactly how they do this (IMAP, direct access to filesystems, whatever), but the messages are stored -- and yes, obviously the SMTP protocol doesn't facilitate this but their SMTP servers perform this action.
Asking whether this is morally/ethically OK is probably not the right question. As we've seen with any technology, if something is possible to track/store/analyze it will be. If tracking email opens (or any data on the internet) is not something we want to accept as a society we need to find ways to ensure tracking those actions under any circumstances is impossible -- not just leave it up to chance.
"morally/ethically OK is probably not the right question"