195006 - Don't load external images in junk mail (spam)

Status: RESOLVED DUPLICATE of bug 179568

(MailNews Core :: Filters, enhancement)

Description

[Bob thompson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3b) Gecko/20030128
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3b) Gecko/20030128

If a spam email is clicked, Mail/News will attempt to retrieve any src= tags in
the body of the spam (web bugs), thereby letting the spammer know they have a
"live one". 
In normal use, this is not a problem since spam can be right-click deleted
without activating the preview pane. The next email to receive focus is
typically a genuine email. In the new Junk folder however, moving a genuine
email back to the inbox can result in a spam email receiving the focus and
activating a web bug. I'm currently switching Mozilla to Offline when I work
with the Junk folder to block this problem.
A better solution here would be to make the Junk folder permanently Offline, or
be able to switch off html rendering selectively.

Reproducible: Always

Steps to Reproduce:
1.Click on non-spam email in Junk folder
2.Move or delete the email
3.Watch your spam increase

Actual Results:  
I'm not that silly. 

Expected Results:  
When the little trash can is deselected, the email should automatically return
to the inbox. The junk folder should be permanently offline anyway.

Comment 1

[Matthias Versen [:Matti]]

Why do you not enable :
edit\preferences\Privacy..\Images[]DO not load remote Images in Mail.. ?

Comment 2

[Bob thompson]

The "edit\preferences\Privacy..\Images[]DO not load remote Images in Mail"
setting prevents _all_ remote images from being displayed. 

I routinely receive emails from product suppliers which contain links to remote
images I _do_ want to see, so being able to have the Junk folder offline while
the Inbox is online would work better for me.

Actually, my personal preference would be for the Junk folder to display html
source, since I'd then be able to see where the spam was linking to, but I think
it would be better for most people just to have it switched off.

Comment 3

[Gabriel Klein]

The solution is ;-)
View -> MessageBody As -> Plain Text

And the good side is that most of the spam 
have only HTML part... no text part.
So you won't see the spam if you open it.

GAb

Comment 4

[Mike Cowperthwaite]

I am a little confused about the summary of this bug compared to the report.
The summary is consistent with the 'Expected Results' but most of the report has 
nothing to do with what happens to a mail that has been marked as Not Junk.

The description (which also is legitimate) focuses on the fact that some other 
mail in the Junk folder will be undesirably opened after currently-unimplemented 
automatic move back to whence the junk came.  Reporter, did you intend that as a 
potential problem to be aware of while implementing the feature?

Anyway, there are two possible solutions I can see to that:
1) Junk folder is *always* offline, as requested by reporter -- a good idea, I 
think, but it should be a separate bug.
2) When a viewed message is marked as Not Junk, and moved, the focus should not 
be automatically placed on another message.  (Somewhat similar to bug 200138.)

Note that it is possible to right-click on a junk message and select
  Move To|<wherever>  without opening any message in the folder; then you can 
return to that folder and turn off the junk flag there.

Since clicking the Junk column on a message does not result in that message 
being selected, then the automatic move-back would presumably work the same for 
clicking on the column.  Only if the message is already being viewed should 
there be an issue of opening another message in the folder.

I'm confirming this (the problem described by the summary and the Expected 
Results) as an enhancement, as I couldn't find any dupes for it.

Comment 5

[Mike Cowperthwaite]

*** Bug 208197 has been marked as a duplicate of this bug. ***

Comment 6

[Bob thompson]

>I'll address these inline...
>The description (which also is legitimate) focuses on the fact that some other 
>mail in the Junk folder will be undesirably opened after currently-unimplemented 
>automatic move back to whence the junk came.  Reporter, did you intend that as a 
>potential problem to be aware of while implementing the feature?

Sort of - it was something I'd noticed would happen when I was manually moving
non-spam back to the inbox. It seemed like a good idea to raise it as a problem
_before_ the automatic move was implimented, otherwise spammers would get a
rapid boost in confirmed victims as soon as the feature was used.


>1) Junk folder is *always* offline, as requested by reporter -- a good idea, I 
>think, but it should be a separate bug.

Actually, it might be a good idea to have the Junk folder offline by default,
but be able to switch any folder off or on line on a per folder basis - it would
be more flexible.

>2) When a viewed message is marked as Not Junk, and moved, the focus should not 
>be automatically placed on another message.  (Somewhat similar to bug 200138.)

This would work too, but I think the offline option is more elegant.

BobT

Comment 7

[Alfonso Martinez]

*** Bug 220347 has been marked as a duplicate of this bug. ***

Comment 8

[Jack Angel]

maybe add a security option (just like image or pop-up blocker) that prohibits
of loading any "src=" from mail?

Comment 9

[Vaclav Dvorak]

I propose simply not loading any external resources for any mail deemed to be
junk. If that's too radical, have a pref for it, set to "not load" by default.
Marking the junk folder offline is not a complete solution - you can have junk
mails in your inbox, too. Besides, I suspect that a per-folder offline setting
might be more difficult to implement, but that's just a guess.

Clarifying the summary. The discussion here is really about the privacy issue of
loading external resources in spams. I'll reopen bug 220347 for the RFE of
moving messages back from Junk to Inbox when they're marked Not Junk.

Comment 10

[Vaclav Dvorak]

Actually, that was bug 208197 - it's earlier that 220347, and it has a more
accurate description (move back to location as specified by filters, not always
inbox).

Comment 11

[Alan Hart]

It's actually useful having the option to have the junk folder online if you 
are working at 2 locations and want to train both databases as well as 
possible. In this situation you need to be able to see the junk folder from 
both locations i.e. it needs to be online.

Offline would be fine if someone built a way to share the junk database - and 
preferably other settings - between locations.

Alan

Comment 12

[OstGote!]

What is the difference to Bug 179568? For me this bug looks like a dupe.

Comment 13

[Mike Cowperthwaite]

(In reply to comment #12)
> What is the difference to Bug 179568? For me this bug looks like a dupe.

Functionally, you're correct -- but the internals would be different.  This bug 
is talking about blocking images via the specific Block Remote Images In 
Mail/News feature, the other is talking about blocking images via the View 
Message Body As feature.  I think the other might be easier to implement...

Comment 14

[Ben Bucksch (:BenB)]

Given that the other bug is already implemented (and goes further in
functionality), dupping.

*** This bug has been marked as a duplicate of 179568 ***