99904 - Security: Need way to block images in email

Status: VERIFIED DUPLICATE of bug 28327

(MailNews Core :: Security, enhancement)

Description

[Eric Warnke]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.4) Gecko/20010913
BuildID:    2001091303

Recently web bugs and other <img> tags with location hrefs that uniquly
identifiy the recipient.  This misuse of images is better than return recipt as
all HTML email clients are suseptable.  I would hate for to have to go back to
PINE for email, as otherwise mozilla serve all of my needs.

Reproducible: Always
Steps to Reproduce:
Check your spam for images including 
1) Your email address
2) Extremly long strings with numbers to identify you

<img
src="http://rm01.net/market/bin/open.php?r=[e-mail]&a=1000608100.0134500903800"
height=1 width=1>

This was snipped from a recent lights across america email.  This was sent by a
marketing firm.  Email address changes.  This kind of web buggin has become
increasingly more popular as the best way to validate addresses.

I see one or two possilbe solutions to this problem.

1) Stop all image loading ( except on request ).
2) Block image from loading is the email is not from a user in you personal
address book.

Comment 1

[Ashley Bischoff (blog at handcoding.com)]

Marking as dupe of bug 28327. Reporter: If you disagree, please reopen this bug.

-> Security: General, for parity with original bug.

*** This bug has been marked as a duplicate of 28327 ***

Comment 2

[scalkins]

Verifying dupe