3 ms·
Email doesn't run JS. That's why they have to use tracking pixels (images) and unique links. Your first sentence was great, but the whole JS rant didn't land.
by ficklepickle 6y ago
Email doesn't run JS. That's why they have to use tracking pixels (images) and unique links.
Your first sentence was great, but the whole JS rant didn't land. I can't see how side-channels are relevant unless an attacker is already in the system, at which point they could just grab the plaintext.
- corty 6y ago"Optional security protections also include disabling loading of remote images within messages, enabling only specific media types (sanitizer), and disabling JavaScript." says the TB wikipedia page. The arch wiki says "JavaScript is disabled for message content but not for RSS news feeds. To disable set javascript.enabled to false in the #Config editor.". So with evidence to the fact that TB does indeed execute attacker-supplied JS I would like to ask for a reference for your claim.