unofficial mirror of notmuch@notmuchmail.org
 help / color / mirror / code / Atom feed
* privacy problem: text/html parts pull in network resources
@ 2015-01-21 21:00 Daniel Kahn Gillmor
  2015-01-21 21:14 ` Austin Clements
                   ` (2 more replies)
  0 siblings, 3 replies; 13+ messages in thread
From: Daniel Kahn Gillmor @ 2015-01-21 21:00 UTC (permalink / raw)
  To: notmuch mailing list

[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]

If i send a message with a text/html part (either it's only text/html,
or all parts are rendered, or it's multipart/alternative with only a
text/html subpart) and that HTML has <img
src="http://example.org/test.png"/> in it, then notmuch will make a
network request for that image.

This is a privacy disaster, because it enables an e-mail sender to use
"web bugs" to tell when a given notmuch user has opened their e-mail.

It's also a bit of a consistency/storage/indexing disaster because it
means that what you see when you open a given message will change
depending on the network environment you're in when you open it.

It's also potentially a security problem because it means that anyone in
control of the remote server (or the network between you and the remote
server if the image isn't sourced over https) can feed arbitrary data
into whatever emacs image rendering library is being used.  (granted,
this is not a unique problem because this can already be done by the
original message sender with a multipart/mixed message, but it's an
additional exposure of attack surface)

I just raised this on #notmuch, and i don't have the time or the
knowledge to look into it now, but i think the defaults here need to be
to avoid network access entirely unless the user explicitly requests it.

   --dkg

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 948 bytes --]

^ permalink raw reply	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2015-01-30 12:13 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-01-21 21:00 privacy problem: text/html parts pull in network resources Daniel Kahn Gillmor
2015-01-21 21:14 ` Austin Clements
2015-01-21 21:36   ` Daniel Kahn Gillmor
2015-01-21 22:39     ` Austin Clements
2015-01-21 21:46   ` David Bremner
2015-01-22  7:25 ` Tomi Ollila
2015-01-25 17:51 ` David Bremner
2015-01-28  3:47   ` Daniel Kahn Gillmor
2015-01-28  4:44     ` Jinwoo Lee
2015-01-28 23:57       ` Jinwoo Lee
2015-01-29 18:03         ` Daniel Kahn Gillmor
2015-01-29 18:14           ` Jinwoo Lee
2015-01-30 12:12           ` David Edmondson

Code repositories for project(s) associated with this public inbox

	https://yhetil.org/notmuch.git/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).