510531 - BCC is DISCLOSING recipients

Status: RESOLVED INVALID

(Thunderbird :: Message Compose Window, defect)

Description

[culturegrrl]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13
Build Identifier: 

Only just recently (last two weeks), when I send something addressed "BCC," it says in the address box---
To: Undisclosed recipients
and then, on the line below that, it says---
BCC: after which ALL the email addresses are revealed from the "BCC" mailing list!
This is driving me (and my recipients) crazy. Why is this suddenly happening? Please help ASAP!

Reproducible: Always

Steps to Reproduce:
1.Drop down BCC in address box
2.insert mailing list
3.send
Actual Results:  
entire address list was visible to recipients
(for recipients, it says, "To: undisclosed recipients" and, below that, "BCC: followed by the entire clickable address list!

Expected Results:  
address list invisible to recipients

This is a relatively recent development. It used to work fine! And I haven't changed anything.

Comment 1

[culturegrrl]

I hope to hear from you very soon!

Comment 2

[Wayne Mery (:wsmwk)]

check with your ISP. Something's broke/changed on the server

Comment 3

[Ludovic Hirlimann [:Usul]]

What version of thunderbird are you running ? Did you edit your mailing list recently ?

Comment 4

[[:Aureliano Buendía]]

WFM here on

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3pre) Gecko/20090815 Lightning/1.0pre Shredder/3.0b4pre ID:20090815035456

Comment 5

[[:Aureliano Buendía]]

Reporter could answer to comment #3, please?

Could you try to see if it still happens with
http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-comm-1.9.1/ ?

Comment 6

[culturegrrl]

To answer your questions: I did check with my provider (Time Warner RoadRunner) and they said my problem (recipients disclosed with BCC) had nothing to do with them. To prove it, we tried sending a BCC e-mail on Outlook, and I did not have this problem. I don't know what version of Thunderbird I have, but it was created on Nov. 18, 2005 and modified on Nov. 23, 2006. It updates itself periodically. I continually add to my e-mail list, and I can't at this point say whether this problem coincided with any particular addition. This is a very vexing problem. I send one regular e-mail blast for which I should shift the entire mailing list over to Outlook, but I haven't yet figured out how to do this and I've not gotten around to asking for help.  HELP!

Comment 7

[[:Aureliano Buendía]]

For TB version see on menu-->Help-->About.

Can you try in safe-mode if the issue is still present?

safe-mode is described here http://kb.mozillazine.org/Safe_mode

Comment 8

[culturegrrl]

The issue is still present, but the online instructions for "safe mode" are way too techie for me, and I'm worried about what else I may LOSE if I try to go that route. Someone is going to have to call me and walk me through this. I know that it's contrary to your techie protocols to actually talk to me, but that's the only way this is going to work (or not). It seems like it would be simpler to shift my e-mail blast list over to Outlook. Perhaps, if all else fails, you can help me with that.
Lee Rosenbaum 201-224-3741

Comment 9

[Ludovic Hirlimann [:Usul]]

Can you give us the version of TB you are using ?

Can you make a test email that show the issue ?
 if you can - can you look into Tools -> Error console before sending the email, clear it, and look into it after sending the email ?
 could you share - privately - one of those test emails ?

Comment 10

[Ludovic Hirlimann [:Usul]]

Attachment: hey indeed my name is shown.

Comment 11

[Ludovic Hirlimann [:Usul]]

Attachment: Source of the email as received.

Comment 12

[Ludovic Hirlimann [:Usul]]

One more thing, could you go in your sent folder and save the email you've sent me and attach it here ? so we can see how it was formatted by TB when sent.

Comment 13

[Ludovic Hirlimann [:Usul]]

Attachment: Email saved as sent by TB.

Comment 14

[Ludovic Hirlimann [:Usul]]

Marking new - but I believe that the issue might be at the ISP but I don't know how to prove it :-(

Adding a few people to get ideas

Comment 15

[Wayne Mery (:wsmwk)]

close to sufficient test would be the same message being sent through *.rr.com and some other ISP, and that other ISP working correctly and rr.com not. The stripping of properly specified BCC is entirely up to the MTA.

Comment 16

[David :Bienvenu]

it's the smtp server that's supposed to strip off the bcc header

Comment 17

[WADA:World Anti-bad-Duping Agency]

To bug opener:

What phenomenon do you mean by "BCC is DISCLOSING recipients".
Can you attach mail on which the phenomenon occurs, which is not copy of your sent mail in your Sent folder, which really arrived at Mbox of recipient(s).

Is it mail arrived at Ludovic's Mbox which is attached to Comment #11? If so, I couldn't see next. (usually called "recipients disclosed with BCC")
  Other mail addresses than Ludovic's one in list(which you specified in BCC:
  filed upon composition) are disclosed to Ludovic.
I could see next only. (usually not called "recipients disclosed with BCC")
  To: [e-mail] is seen in the mail, and you say that
  you typed "Undisclosed recipients" in To: field upon mail composition.
  No mail addresse other than Ludovic's one is seen in the mail.

Can you get SMTP log and attach log file?
> https://wiki.mozilla.org/MailNews:Logging

Comment 18

[Ludovic Hirlimann [:Usul]]

(In reply to comment #17)
> To bug opener:
> 
> What phenomenon do you mean by "BCC is DISCLOSING recipients".
> Can you attach mail on which the phenomenon occurs, which is not copy of your
> sent mail in your Sent folder, which really arrived at Mbox of recipient(s).

Wada please see attached emails example. One is saved from the users sent folder. The other one is as received by the recipient.

from private email :
I've gotten various messages from Mozilla people, but I'm not sure what it all means. I should remind you that I don't have the problem if I send BCCs through Outlook, so it does not appear to be the ISP's fault.

Can you try to send me and someone else like wayne , while you are folloing the instructions on https://wiki.mozilla.org/MailNews:Logging for smtp ?

Thanks

Comment 19

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #18)
> Wada please see attached emails example. One is saved from the users sent
> folder. The other one is as received by the recipient.

To Ludovic:

Screen shot you attached to Comment #10 :
  Subject highlighted at thread pane : [Bug368924] ...
  Subject of mail in mail pane(preview pane) : [Bug 510531] BCC is DISCLOSING ...
Mail data you attached to Comment #11 :
  Subject: [Bug 510531] BCC is DISCLOSING recipients
Mail data you attached to Comment #13 :
  Subject: CultureGrrl blog link
  To: undisclosed-recipients:;

Which is evidence of what phenomenon of this bug?

> from private email :
>  if I send BCCs through Outlook, so it does not appear to be the ISP's fault.

Ludovic, are you sure that Outlook(which bug opener used to send same mail) used same SMTP server which was used when bug opener sent same mail by Tb?
If yes, and if same SMTP server was really used, what is difference between (i) really delivered mail data which was sent by Outlook and (ii) really delivered mail data which was sent by Thunderbird?

(In reply to comment #15)
> The stripping of properly specified BCC is entirely up to the MTA.

Wayne Mery, do you mean that Tb really passed "BCC: ..." header to SMTP server?

AFAIR, and AFAIK, Tb writes BCC: header data in Sent folder for tracking and/or user's convenience, but Tb doesn't pass BCC: header to SMTP server.
AFAIK, BCC: is implemented by;
 - Tb doesn't pass BCC: header to SMTP server.
   Tb passes From:, To:, CC: header to SMTP server.
 - Tb passes mail address of all mail recipients to SMTP server by RCPT command.
   (recipients in ENVELOPE)
 - Tb passes mail address in From: to SMTP server by MAIL command.
   (original address in ENVELOPE, is put in Return-Path: by server.)
   (frequently called "Envelope From:".)
 - SMTP server deliveries mail data to recipients requested by RCPT command.

SMTP server and tagrget mail server(POP3 or IMAP) may alter mail header data according to information in the ENVELOP, mail headers, his spam policy, ....
SMTP server/mail server may remove BCC: header, if mail client passed BCC: header to SMTP server, for safety, according to concept of BCC: or ordinal usage of BCC: header.
I don't know which is done by which server.
Example of mail header change by SMTP server.
 - Tb passes other than Gmail's mail address in From: to Gmail's SMTP server.
 - Gmail's SMTP serever(and Gmail) replaces From: of other than Gmail's addr
   by Gmai's mail address, save it in [Gmail]/Sent Mail, and delivers it.

Comment 20

[Ludovic Hirlimann [:Usul]]

(In reply to comment #19)

> To Ludovic:
> 
> Screen shot you attached to Comment #10 :
>   Subject highlighted at thread pane : [Bug368924] ...
>   Subject of mail in mail pane(preview pane) : [Bug 510531] BCC is DISCLOSING
> ...
> Mail data you attached to Comment #11 :
>   Subject: [Bug 510531] BCC is DISCLOSING recipients
> Mail data you attached to Comment #13 :
>   Subject: CultureGrrl blog link
>   To: undisclosed-recipients:;
> 
> Which is evidence of what phenomenon of this bug?
> 

so CultureGrrl sent me en email where I was bcced. so the first two attachments are the email I've received and the way it was displayed in TB (nothing abornal here). 

THe third attachment is the mail from CultureGrrl's sent folder - where my name is not visible. Hence the evidence. 

I don't know if TB's and outlook settings are different indeed. But as CultureGrrl has talked to her ISP's Tech support I believe they are the same. It's a good idea to check however.

Comment 21

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #20)
> The third attachment is the mail from CultureGrrl's sent folder
> - where my name is not visible. Hence the evidence. 

Mail you attached to comment #13?
Evidence of what phenomenon reported by bug opener(or you) in this bug?
The mail of "Subject: CultureGrrl blog link"(attached to Comment #13, you say "mail in Sent folder of bug opener") was sent as "Subject: [Bug 510531] BCC is DISCLOSING recipients"(attached to Comment #11) to you?
Or BCC: header was not written in Sent folder by Tb 2?

(1) Following is copy of sent mail saved in local Sent folder by Tb 2. Mail was sent via. Gmail's SMTP with UserID = yatter.king @ gmail . com.
> BCC: [e-mail], [e-mail]
> Message-ID: <[e-mail]>
> Date: Mon, 28 Sep 2009 17:52:21 +0900
> From: "M. Wada" <[e-mail]>
> User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
> To: [e-mail]
> Subject: BCC test
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> 
> BCC test

(2) Following is sent mail data in "[Gmail]/Sent Mail" of UserID = yatter.king @ gmail . com. (Gmail's SMTP automatically saves in this folder. Received: etc. is omitted)
BCC: is not passed to SMTP server by Tb. From: is replaced by Gmail. Return-Path: is set by Gmail's SMTP.
> Return-Path: <[e-mail]>
> Message-ID: <[e-mail]>
> Date: Mon, 28 Sep 2009 17:52:21 +0900
> From: "M. Wada" <[e-mail]>
> User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
> To: [e-mail]
> Subject: BCC test
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> 
> BCC test

(3) Following is delivered mail to Inbox of UserID = yatter.one @ gmail . com.
(Received: etc. is omitted)
Delivered-To: is added by Gmail's server.
> Return-Path: <[e-mail]>
> Delivered-To: [e-mail]
> Message-ID: <[e-mail]>
> Date: Mon, 28 Sep 2009 17:52:21 +0900
> From: "M. Wada" <[e-mail]>
> User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
> To: [e-mail]
> Subject: BCC test
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> BCC test
Although yatter.one and yatter.king appears in the delivered mail, it's never "disclosure of BCC:".

Bug opener uses special group name for To:(Tb 2/3 may put it or similar one, if only BCC: is specified by user.) SMTP server or mail server may produce "To: <the recipient in ENVELOPE>" for such special group name. Even if so, it can't be said "BCC is disclosed (to other people in BCC:)". Even if so, Tb has no relation to phenomenon, except when the special group name is set by Tb.
> Mail data you attached to Comment #13 :
>   Subject: CultureGrrl blog link
>   To: undisclosed-recipients:;
Ludovic, please look real mail data - copy in Sent, SMTP log, mail delivered to recipient. Search Google for the special group name, please.

Comment 22

[Ludovic Hirlimann [:Usul]]

(In reply to comment #21)
> (In reply to comment #20)
> > The third attachment is the mail from CultureGrrl's sent folder
> > - where my name is not visible. Hence the evidence. 
> 
> Mail you attached to comment #13?
> Evidence of what phenomenon reported by bug opener(or you) in this bug?

I attached the emails that we privately exchanged with the bug opener.

So my attachment are  
1) a mail that was sent to me with Tb by the bug opener and that displays my name when I open the bug in TB.
 
2) the email as saved from the bug opener's mailbox and sent to me as an .eml file.


> The mail of "Subject: CultureGrrl blog link"(attached to Comment #13, you say
> "mail in Sent folder of bug opener") was sent as "Subject: [Bug 510531] BCC is
> DISCLOSING recipients"(attached to Comment #11) to you?
> Or BCC: header was not written in Sent folder by Tb 2?

see above.
 
> (1) Following is copy of sent mail saved in local Sent folder by Tb 2. Mail was
> sent via. Gmail's SMTP with UserID = yatter.king @ gmail . com.
> > BCC: [e-mail], [e-mail]
> > Message-ID: <[e-mail]>
> > Date: Mon, 28 Sep 2009 17:52:21 +0900
> > From: "M. Wada" <[e-mail]>
> > User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
> > To: [e-mail]
> > Subject: BCC test
> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> > 
> > BCC test
> 
> (2) Following is sent mail data in "[Gmail]/Sent Mail" of UserID = yatter.king
> @ gmail . com. (Gmail's SMTP automatically saves in this folder. Received: etc.
> is omitted)
> BCC: is not passed to SMTP server by Tb. From: is replaced by Gmail.
> Return-Path: is set by Gmail's SMTP.
> > Return-Path: <[e-mail]>
> > Message-ID: <[e-mail]>
> > Date: Mon, 28 Sep 2009 17:52:21 +0900
> > From: "M. Wada" <[e-mail]>
> > User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
> > To: [e-mail]
> > Subject: BCC test
> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> > 
> > BCC test
> 
> (3) Following is delivered mail to Inbox of UserID = yatter.one @ gmail . com.
> (Received: etc. is omitted)
> Delivered-To: is added by Gmail's server.
> > Return-Path: <[e-mail]>
> > Delivered-To: [e-mail]
> > Message-ID: <[e-mail]>
> > Date: Mon, 28 Sep 2009 17:52:21 +0900
> > From: "M. Wada" <[e-mail]>
> > User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
> > To: [e-mail]
> > Subject: BCC test
> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> >
> > BCC test
> Although yatter.one and yatter.king appears in the delivered mail, it's never
> "disclosure of BCC:".

good so you can't reproduce. to me it seems that the bug opener can.
 
> Bug opener uses special group name for To:(Tb 2/3 may put it or similar one, if
> only BCC: is specified by user.) SMTP server or mail server may produce "To:
> <the recipient in ENVELOPE>" for such special group name. Even if so, it can't
> be said "BCC is disclosed (to other people in BCC:)". Even if so, Tb has no
> relation to phenomenon, except when the special group name is set by Tb.

I agree that we need an smtp log from CulturGrrl - it's been asked - he/she needs to provide them or ask for help on how to produce them.

> > Mail data you attached to Comment #13 :
> >   Subject: CultureGrrl blog link
> >   To: undisclosed-recipients:;
> Ludovic, please look real mail data - copy in Sent, SMTP log, mail delivered to

I've looked at real mail data, the only part missing is the SMTP log.

> recipient. Search Google for the special group name, please.

That I don't understand - what should I search for ?

Comment 23

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #22)
> > Search Google for the special group name, please.
> That I don't understand - what should I search for ?

Search for "undisclosed-recipients" by Google.
Following is top most three pages hit by my search.
> http://email.about.com/cs/netiquettetips/qt/et100603.htm
> http://en.allexperts.com/q/Microsoft-Outlook-1541/Undisclosed-Recipients.htm
> http://www.infopackets.com/news/carols_corner_office/2006/20060222_how_to_send_an_email_to_undisclosed_recipients.htm
Wiki page for it may be found by search.

Comment 24

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #22)
> > Ludovic, please look real mail data - copy in Sent, SMTP log, mail delivered to recipient
> I've looked at real mail data, the only part missing is the SMTP log.

Did you see "really delivered mail data to recipient in BCC:" for mail data you attached to Comment #13(you say "mail in Sent folder of bug opener")?  
> Mail data you attached to Comment #13 :
>   Subject: CultureGrrl blog link
>   To: undisclosed-recipients:;
In which mail data you attached can we see the "really delivered mail data to recipient in BCC:"?

Comment 25

[Ludovic Hirlimann [:Usul]]

(In reply to comment #24)
> (In reply to comment #22)
> > > Ludovic, please look real mail data - copy in Sent, SMTP log, mail delivered to recipient
> > I've looked at real mail data, the only part missing is the SMTP log.
> 
> Did you see "really delivered mail data to recipient in BCC:" for mail data you
> attached to Comment #13(you say "mail in Sent folder of bug opener")?  
> > Mail data you attached to Comment #13 :
> >   Subject: CultureGrrl blog link
> >   To: undisclosed-recipients:;
> In which mail data you attached can we see the "really delivered mail data to
> recipient in BCC:"?

The second attachment is the email I recieved. Where I was Bcced.

Comment 26

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #25)
> The second attachment is the email I recieved. Where I was Bcced.

Mail data you attached to Comment #13(mail in Sent) is for different mail from Comment #11(delivered mail to you). Where can we see evidence(==real data, not words by human being in mail) that the mail was really sent to you with "you are BCC'ed"? Please note that we can't distinguish delivered mail of "you are BCCed, but To: is somehow replaced by To:<ludovic@..>" from delivered mail of "sent with To:<ludovic@...>".

And, there is no BCC: header in mail data you attached to Comment #13. As I wrote, if standard Tb, Tb writes BCC: header data in Sent folder(Tb doesn't pass it to SMTP). Did you omit it upon upload? (BCC: header in Sent is expanded, if list of Tb's address book is used for BCC:. so mail addresses of many other peoples appear in it.)

Comment 27

[Ludovic Hirlimann [:Usul]]

(In reply to comment #26)
> (In reply to comment #25)
> > The second attachment is the email I recieved. Where I was Bcced.
> 
> Mail data you attached to Comment #13(mail in Sent) is for different mail from
> Comment #11(delivered mail to you). Where can we see evidence(==real data, not
> words by human being in mail) that the mail was really sent to you with "you
> are BCC'ed"? Please note that we can't distinguish delivered mail of "you are
> BCCed, but To: is somehow replaced by To:<ludovic@..>" from delivered mail of
> "sent with To:<ludovic@...>".

My bad.

Comment 28

[Ludovic Hirlimann [:Usul]]

Attachment: Received emails

Comment 29

[Ludovic Hirlimann [:Usul]]

Attachment: send one.

Comment 30

[Ludovic Hirlimann [:Usul]]

And in that email my email is not disclosed. I missed the fact that the link sent was a test email - sorry for that. It looked way to much like spam :-( Marking UNCO as I don't see the bug - and what I saw, I was probably not in bcc.

Comment 31

[Ludovic Hirlimann [:Usul]]

status is we don't see the issue. read comments above please. and stop sending me emails. communications goes through the website.

Comment 32

[Wayne Mery (:wsmwk)]

(ccing a few other rr.com bug commentors in case they have insight.)

IMO this isn't our issue. An smtp log is still needed.

Outlook not producing the issue is interesting but far from proves the problem is Thunderbird. Equally interesting would be if someone reproduced this with a different smtp server than rr.com

Wada, re 
  > The stripping of properly specified BCC is entirely up to the MTA.
  Wayne Mery, do you mean that Tb really passed "BCC: ..." header to SMTP server?
...yes, per bienvenu's correction

please reopen if more strong/helpful information develops.

Comment 33

[culturegrrl]

I'm Lee Rosenbaum, the person who reported this bug. I just got an e-mail today in which various people responded to the problem in what, to me, is incomprehensible technological jargon. Can someone please explain to me what's going on? I gather that you've now marked my case "resolved" although, for me, it is far from resolved. I continue to have the same problem, and I've just been lazy about switching over to Outlook (which DOESN'T disclose recipients), because I prefer Thunderbird and was hoping that somehow this problem would truly be "resolved." Are you, in essence, now telling me to switch over to Outlook if I don't want my BCCs disclosed, or is someone actually going to be able to solve this problem? I long ago, as you had recommended, checked with Time Warner, my service provider, and they assured me that they are not the problem (which is corroborated by the fact that Outlook works).
Lee Rosenbaum, [e-mail], 201-224-3741

Comment 34

[Wayne Mery (:wsmwk)]

Rephrasing ... I could be wrong, but ...

Lee, 
a) what version are you running per Help>About
b) can you confirm that the message you are sending 
   b1) has *only* Bcc, in other words no Cc and no To, and 
   b2) there is no line like
         To: (undisclosed recipients)
      in the message you see in your *sent* folder

If the answer to b) is yes, then ...

1. in short, the failure of rr.com's sendmail not Thunderbird, and you may ignore the rest of this comment

2. if one (any tester) *does* see 
   To: (undisclosed unrecipients)
in the message in the *sent folder*, then you should *not* be able to reproduce the issue described by reporter

3. if one does *not* see 
   To: (undisclosed recipients)
in the message in the *sent folder*, then you may or may not see the reporter's issue depending on whether your ISP's mail system is behaving well.

see Bug 16499 - Work around sendmail bug which reveals bcc recipients when all recipients are bcc - which inserts a To: line as described in the bug to work around sendmail type problems.

I just tested my system (which unfortunately shows the bug). With two Bcc recipients and no To or CC, recipient of my mail sees
 Subject: 2 bcc
 To: <recipient 1>
 To: <recipient 2>
But in my outgoing message does NOT have
   To: (undisclosed recipients)
Why it doesn't have a To: I don't know. My cubicle neighbor also running TB3 doesn't see this problem, because Thunderbird is putting a 
   To: (undisclosed recipients)
in the message before it is sent, and which shows at my receiving end as
   To: undisclosed-recipients:;

Also consistent with bug 16499, if I add a To: address to my outgoing message, recipient sees 
 Subject: 1 Bcc, 1 To
 To: <recipient 1>
and there is no disclosure of the bcc: recipient

So, my sendmail has the bug. AND something in my profile/account settings is causing 
   To: (undisclosed recipients)
to not be added. Which may warrant a new bug.  Or we morph this bug to that purpose, depending on what Lee reports.

Comment 35

[Wayne Mery (:wsmwk)]

filed Bug 532982 on the behavior I found described in comment 34. I don't presume whether it will or won't help the reporter's issue.

Comment 36

[Wayne Mery (:wsmwk)]

Lee, adding a To: or Cc: recipient might be a workaround for you.