5 ms·

Hmm, so the e-mails are routed through their infrastructure and then ( presumably ) some form of magic is injected and delivered to the recipient. Upon opening

Hmm, so the e-mails are routed through their infrastructure and then ( presumably ) some form of magic is injected and delivered to the recipient. Upon opening, the content 'fades-out' and fade.li assure us that they delete the content from their systems. /me tries with disposable account Aha, it renders the mail content as images. A bunch of basic HTML with the GIFs inline, I used wget to pull them down but the metadata is corrupted. I'll poke at them... Aha2: animated GIF. Frame-by-frame 'writing' of the e-mail, then blanking-out. Presumably they delete the GIF from their server when it has been served once. Here's one ( safe for work! ) http://imgur.com/jS2cvMr http://imgur.com/jS2cvMr

IanCal 13y ago
It renders it as an image which fades and they seem to only allow one get for.
- pyalot2 13y ago
  Yes, but if you don't display the image, there's no get, so when you put it on a new tab, that's one get, and from there you can save it from the browser, which isn't no more additional get.
  - IanCal 13y ago
    Yep, you can also check the original email and download the image directly.
partha-shah 13y ago
Freemium model appears to be allowing this else downloading can be easily stopped from wget and other downloaders. ofcourse screenshot is the option. ;)
- laumars 13y ago
  You can't easily stop wget. It's impossible to distinguish between Firefox accessing the image, and wget / curl / whatever accessing the image with Firefox's user agent string (and changing the user agent string in these utilities is just a simple flag)
  - eli 13y ago
    You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept). But yeah, ultimately it's a losing game because you're trusting the client not to be compromised.
    - brey 13y ago
      neat tool: chrome developer tools > network > rightclick a resource > copy as Curl > paste on command line allows you to replay a request, complete with all cookies and the exact same headers. yeah, aware this isn't what's wanted here, single request image etc etc ... but relevant.
      - GhotiFish 13y ago
        OH! You wonderful wonderful man!
        brey 13y ago
        handy, ain't it? :)
    - laumars 13y ago
      > You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept). Those headers can vary from machine to machine even when using the same browser. So you'd have a huge amount of testing, plus the big risk of braking legitimate requests. I just cant see how you could pull that off successfully. > But yeah, ultimately it's a losing game because you're trusting the client not to be compromised. Totally. Even if your solution did work, it's trivial to break again as you just add the appropriate headers to wget / curl as well as changing the user agent string.

IanCal 13y ago

It renders it as an image which fades and they seem to only allow one get for.

pyalot2 13y ago
Yes, but if you don't display the image, there's no get, so when you put it on a new tab, that's one get, and from there you can save it from the browser, which isn't no more additional get.
- IanCal 13y ago
  Yep, you can also check the original email and download the image directly.

partha-shah 13y ago

Freemium model appears to be allowing this else downloading can be easily stopped from wget and other downloaders. ofcourse screenshot is the option. ;)

laumars 13y ago
You can't easily stop wget. It's impossible to distinguish between Firefox accessing the image, and wget / curl / whatever accessing the image with Firefox's user agent string (and changing the user agent string in these utilities is just a simple flag)
- eli 13y ago
  You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept). But yeah, ultimately it's a losing game because you're trusting the client not to be compromised.
  - brey 13y ago
    neat tool: chrome developer tools > network > rightclick a resource > copy as Curl > paste on command line allows you to replay a request, complete with all cookies and the exact same headers. yeah, aware this isn't what's wanted here, single request image etc etc ... but relevant.
    - GhotiFish 13y ago
      OH! You wonderful wonderful man!
      - brey 13y ago
        handy, ain't it? :)
  - laumars 13y ago
    > You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept). Those headers can vary from machine to machine even when using the same browser. So you'd have a huge amount of testing, plus the big risk of braking legitimate requests. I just cant see how you could pull that off successfully. > But yeah, ultimately it's a losing game because you're trusting the client not to be compromised. Totally. Even if your solution did work, it's trivial to break again as you just add the appropriate headers to wget / curl as well as changing the user agent string.