You'd think that wouldn't you. I found ways to track this stuff even when remote images are disabled in Thunderbird, Apple Mail, Android Mail, Mail on iOS, Outlook, tonnes of webmail apps:
I created a web application which crafts an email with lots of tests and sends it your address. When you open it, it tries to "call back" to my server and the web page shows you the results. If you see anything on there before hitting "Load Images" your client has a problem. You can access the app here:
Comments
You'd think that wouldn't you. I found ways to track this stuff even when remote images are disabled in Thunderbird, Apple Mail, Android Mail, Mail on iOS, Outlook, tonnes of webmail apps:
https://secure.grepular.com/Apple_Mail_Privacy_Hole
https://secure.grepular.com/iOS4_iPhone_Email_Privacy_Leak
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunder...
I created a web application which crafts an email with lots of tests and sends it your address. When you open it, it tries to "call back" to my server and the web page shows you the results. If you see anything on there before hitting "Load Images" your client has a problem. You can access the app here:
https://secure.grepular.com/email_privacy_tester/
Hey look, mutt and Gnus don't leak my personal information. What a surprise.
FWIW, my yahoo mail account with default settings passes that just fine.
Thunderbird 3.1.4 doesn't trigger anything. All yellow stars.
Thunderbird 3.1.0 used to trigger the dns prefetch test, but yeah it's fine now.
gmail didn't trigger any.