Mike Cardwell, Online - EmailPrivacyTesterhttps://grepular.com/favicon.icoMike Cardwell is a Web/Perl developer, Linux sysadmin and Email expert based in the United Kingdom, Nottingham2013-10-07T20:12:56ZMike Cardwell's custom built feed generatorhttps://grepular.com/atomMike Cardwellhttps://grepular.com/webmaster@grepular.comNew Version of The Email Privacy Testerhttps://grepular.com/New_Version_of_The_Email_Privacy_Tester2012-05-06T17:37:55Z8Last week I released a new version of the Email Privacy Tester. It's very similar to the old version, but it lives on its own domain, has some new tests and a more responsive and efficient user interface. I also released the full source code at the same time under the GNU GPL here. It's written in coffee-script, and runs on top of nodejs. Both of these technologies have really impressed me recently; if you're a web developer, check them out.
]]>Mike Cardwellhttps://grepular.com/webmaster@grepular.comScalable Vector Graphics and XSShttps://grepular.com/Scalable_Vector_Graphics_and_XSS2010-07-29T17:34:15Z0If your web application displays image files submitted by an external party, you should take special care about how you handle "image/svg+xml". SVG image files can contain CSS and more importantly, JavaScript. I didn't realise this until very recently when I read about an SVG vulnerability in GMail (now fixed). The fact that you can execute JavaScript from inside an image file presents an unexpected vector for XSS attacks.
]]>Mike Cardwellhttps://grepular.com/webmaster@grepular.comiOS 4 iPhone Email Privacy Leakhttps://grepular.com/iOS4_iPhone_Email_Privacy_Leak2010-07-13T17:45:10Z1In the email client of the latest version of the iPhone software (iOS 4), there is an option called "Load Remote Images". By default this is enabled. A privacy/security conscious user might untick that option so that the sender of an email, can't detect when it is read, and the IP address that the reader is using.
There is a bug however. If you disable remote image loading, yet the HTML email contains the following tag:
]]>Mike Cardwellhttps://grepular.com/webmaster@grepular.comAutomated Email Privacy Testerhttps://grepular.com/Automated_Email_Privacy_Tester2010-02-13T22:07:30Z13Over the past few months I've discovered several flaws in various email clients, which allow the sender of an email to track information about the recipient of an email. Information such as their location and what time they read the email. These are serious bugs, and they exist in widely used email client software. I've discovered problems in Apple Mail, the iPhone, Android Mail, K-9, Thunderbird 3, Outlook 2007 and a general bug involving webmail clients and DNS pre-fetching.
That I know of, my research has so far lead to fixes for Apple Mail, Thunderbird 3, IMP, Roundcube and K-9.
Last week I released a new version of the Email Privacy Tester. It's very similar to the old version, but it lives on its own domain, has some new tests and a more responsive and efficient user interface. I also released the full source code at the same time under the GNU GPL here. It's written in coffee-script, and runs on top of nodejs. Both of these technologies have really impressed me recently; if you're a web developer, check them out.