4 ms·

If I understood correctly, I think this can be prevented by a single configuration change: "Do not automatically load inline content" but this is just speculati

• gant 8y ago
  Pretty much. Should have that as default anyway to avoid sending tracking beacons to spammers.
• Tepix 8y ago
  Yes, I think that's the default pretty much everywhere for obvious reasons. Of course some people configure exceptions for people in their address book, this could then be exploited by this issue.
• dbrgn 8y ago
  In the explanation of Table 5 in the paper (page 21), there's a list of attack vectors with the title "HTML attributes (bypasses for remote content blocking)". So apparently some of these attributes do bypass the inline content blocking on some mail clients, unless I read that wrong. It's important to note that most e-mail clients will use a webview to render e-mail. Blocking all kinds of remote content requires the developers to be really careful, and also probably violates the HTML spec. I tried to replicate the Thunderbird attack vector (H₂), but at least in the current version (52.7.0) it seems that the URL is not requested. Maybe that has been fixed in the meantime but was present in an older version? Disabling HTML rendering for now is probably the safest choice. There's not much that can go wrong when rendering a plaintext e-mail. (Edit: Added a sentence regarding webviews)