> Thunderbird disables remote loading by default. From the paper: "For example, in Thunderbird and Postbox we can completely redress the UI with CSS and trick

> Thunderbird disables remote loading by default. From the paper: "For example, in Thunderbird and Postbox we can completely redress the UI with CSS and trick the user into submitting the plaintext with an HTML form if he clicks somewhere into the message." This is bad news. Also, they claim/suggest that the following: <link href="http://efail.de" rel="preconnect"> is a "bypass for remote content blocking" in Thunderbird, whatever that may mean exactly. EDIT: Mozilla's docs at https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types say about preconnect: "Provides a hint to the browser suggesting that it open a connection to the linked web site in advance, without disclosing any private information or downloading any content, so that when the link is followed the linked content can be fetched more quickly." (emphasis mine). If that is really the spec and I understand it correctly and Thunderbird behaves differently, then that seems like a bug in Thunderbird.