quote:

Yes lovely, they have a technology that helps get a location from an IP address. They still need a bloody IP address, which they can't get if the message is read in plain text format!

Again, could you plz clarify.. i'm no expert on SMTP, but from what I know - Ii'm guessing that it is possible.

quote:

Maybe their "geo-location algorithm" is SLIGHTLY more sophisticated than ancient, ancient programs like NeoTrace (which was damn good with pinpointing locations), but the trace-back idea which the whole thing relies upon has been around for a VERY long time, dating back at least 5 years.

Well, if you read that damn information page, you'll see that they came up with this idea in... right 1999 - exactly 5 years ago

BTW:

In 1998 we built our own geo-IP db based off of ip-blocks and whois lookups. It fished geo-data (country, state, zip, area code) from various references within the whois table.

It worked acceptably well (based on cost to build/deploy) within USA/CA - useless other than for country outside of NA.

As more of our business became global we had to move to a more robust, deep-data system.

We've been using Digital Envoy's geo-ip DB for a few years and it is well worth the investment.

___________________
- rabbit.joker [funny¿rabbit] | www.rabbitjoker.com |www.ddtt.org

Dark Dirty Tech Tribal. | Hands in air (trance) and feet on the floor (house).

quote:

We've been using Digital Envoy's geo-ip DB for a few years and it is well worth the investment.

Google, Microsoft, CNN are some other clients of that company.

quote:

Originally posted by Durafei Google, Microsoft, CNN are some other clients of that company.

I guess in this respect I can then conclude that I am as smart as Google, MS and CNN.

___________________
- rabbit.joker [funny¿rabbit] | www.rabbitjoker.com |www.ddtt.org

Dark Dirty Tech Tribal. | Hands in air (trance) and feet on the floor (house).

quote:

Originally posted by Durafei Again, could you plz clarify.. i'm no expert on SMTP, but from what I know - Ii'm guessing that it is possible.

Look, the principle is simple, and really has very little to do with SMTP at all.

The domain didtheyreadit.com and all related services are basically like relays or bncs. Messages that get sent to the didtheyreadit.com domain have the suffix scrubbed and the prefix translated into a normal e-mail address. The relay then generates a kind of UUID for the message and embeds it into some type of server object, which is appended to the body of the message.

Generally, this object is a blank image which is linked to a Perl or ASP script, although it could technically be anything which gets automatically displayed by a web mail client, even an HTML page embedded within an iframe or something to that effect, although that particular trick isn't used too often anymore after Microsoft found out the security risks associated with iframes and disabled them in Outlook/OE. So usually, it's an image, and this obviously appears "invisible" to the end user because it is a valid link (so no "X") but contains no data.

The image URL contains the UUID. So when the user "visits" that CGI script via automatically loading the image, the server can immediately identify which message was read, and since it is a CGI script, the server can gather all information which is normally available to a web page - IP address, browser, referrer, etc. Thus it can tell not only that the message was read, but where it was read.

As for privacy issues: typically these "tracers" don't store message bodies in their databases, just the UUID and whatever information the sender might need in order to remember what the message was (usually a subject, destination address, etc.). Storing message bodies would take excessive database space. So technically, it is much less of an invasion of privacy than gmail, since the messages are not actually scanned - they are simply appended to, sent out, and then they disappear except for a subject line.

But you see the point of this - in order to get that IP address, the relay server depends on something automatically opening up in the receiver's e-mail client. This is practically guaranteed with web mail, but if the mail is opened in a plain-text viewer (or has its img/object/embed/etc. tags stripped and java/JS disabled, which many browsers do), then the relay can NEVER get that IP address. Ever. It's simply impossible, period, end of discussion. The only other way to ever get that kind of information would be to hack the destination server, open its mail logs, and find out who last downloaded the message, but even that wouldn't prove that it was opened, just received.

Whether or not these people were the first to come up with it, I don't know, but the existence of it is certainly not news, since it has indeed been around for 5 years or more.

And it is not foolproof, as explained above, and it never can be.

___________________
My party schedule:
2009-02-21 - DJ Attention @ I'm So Popular
2009-06-18 - DJ Annoying @ People Need To Know Where I'll Be
2012-11-32 - DJ Insufferable ɸ Or At Least the Stalkers I Complain About
2048-06-66 - Spastic & Whocares ¶ Although I'm Actually Flattered
9999-45-81 - Tweaker Gimp ☼ I Probably Won't Even Go To This But I Have To Make Sure I Fill Up All The Available Space Here

HEY YOU TWO! GET A (server) ROOM!

___________________
- rabbit.joker [funny¿rabbit] | www.rabbitjoker.com |www.ddtt.org

Dark Dirty Tech Tribal. | Hands in air (trance) and feet on the floor (house).

quote:

Originally posted by Durafei Well, if you read that damn information page, you'll see that they came up with this idea in... right 1999 - exactly 5 years ago

I wasn't really sure when NeoTrace first came out, so I googled for it (haha), and found a page with this paragraph:

quote:

21 September '98: File Investigator, a right click on any file allows you to investigate its properties. It's a fancy version of Peek (see Fravia's pages) NeoTrace and Visual Route, two ping/traceroute/whois utilities as entertaining as they are functional. Details below.

So the idea has been around for quite some time. Most geo-location programs depend on a traceroute combined with some whois, fingers, etc., and I am quite sure the one you are talking about does too, although I'm sure it has plenty of fancy additional algorithms too.

___________________
My party schedule:
2009-02-21 - DJ Attention @ I'm So Popular
2009-06-18 - DJ Annoying @ People Need To Know Where I'll Be
2012-11-32 - DJ Insufferable ɸ Or At Least the Stalkers I Complain About
2048-06-66 - Spastic & Whocares ¶ Although I'm Actually Flattered
9999-45-81 - Tweaker Gimp ☼ I Probably Won't Even Go To This But I Have To Make Sure I Fill Up All The Available Space Here

quote:

The domain didtheyreadit.com and all related services are basically like relays or bncs. Messages that get sent to the didtheyreadit.com domain have the suffix scrubbed and the prefix translated into a normal e-mail address. The relay then generates a kind of UUID for the message and embeds it into some type of server object, which is appended to the body of the message. Generally, this object is a blank image which is linked to a Perl or ASP script, although it could technically be anything which gets automatically displayed by a web mail client, even an HTML page embedded within an iframe or something to that effect, although that particular trick isn't used too often anymore after Microsoft found out the security risks associated with iframes and disabled them in Outlook/OE. So usually, it's an image, and this obviously appears "invisible" to the end user because it is a valid link (so no "X") but contains no data. The image URL contains the UUID. So when the user "visits" that CGI script via automatically loading the image, the server can immediately identify which message was read, and since it is a CGI script, the server can gather all information which is normally available to a web page - IP address, browser, referrer, etc. Thus it can tell not only that the message was read, but where it was read.

Huh ! Understood - thanks

As far as privacy goes - that is debatable. But we already had this discussion earlier, so let's stop here.

quote:

Originally posted by rabbitjoker HEY YOU TWO! GET A (server) ROOM!

___________________
Palm Trees > Pine Trees , Sand > Snow