Site Navigation
I stated that I could not make up my mind whether it qualified as SPAM or HAM. Now turning to the most recent e-mail, the headers are less hammy but they are, nevertheless, quite interesting. Here they are:
From baddr-171979931699-39699068-900436804-1S@mx.plaxo.com Wed Jan 26 15:31:15 2005 Return-Path: <baddr-171979931699-39699068-900436804-1S@mx.plaxo.com> Received: from mx.plaxo.com (mx01.plaxo.com [66.54.249.34]) by pgts04.pgts.com.au (8.11.6/8.11.6) with SMTP id j0O4VDm69655 for <gerry@pgts.com.au>; Wed, 26 Jan 2005 15:31:13 +1100 (EST) (envelope-from baddr-171979931699-39699068-900436804-1S@mx.plaxo.com) Received: (qmail 21137 invoked from network); 26 Jan 2005 04:22:06 -0000 Received: from pas05.plaxo.com (10.1.0.6) by mx03.plaxo.com with QMQP; 26 Jan 2005 04:22:06 -0000 Received: from 211.30.111.41 by pas02.plaxo.com; 26 Jan 2005 04:26:17 -0000 Message-ID: <1106540526.20403.26910.sendUpdate@mx.plaxo.com> XDSB-Id: 1031992::20040701::PlaxoUpdateRequest Date: 26 Jan 2005 04:22:06 -0000 From: "Fred Nurk" <fred_nurk@optusnet.com.au> To: "Gerry Patterson" <gerry@pgts.com.au> Reply-to: "Plaxo Contact Update for Fred Nurk" <addrupdate-171979931699-39699068-900436804-1SH@mx.plaxo.com> Precedence: bulk Subject: Please help me update my address book MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="_-------==3636427023"
Note: I have munged the addresses (to protect the identity of the person who owns the address book. (I use the fictional name "Fred Nurk" and munged plaxo labels so that nobody can trace back to discover who this person really is).
also included was the following message (as multipart/mixed). It is rendered below as plain text:
Greeting Gerry, I'm updating my address book. Please take a moment to update your latest contact information. Your information is stored in my personal address book and will not be shared with anyone else. Kind regards Fred Nurk Click the following link to correct or confirm your information: <link to Plaxo Site> Name: Gerry Patterson Job Title: Company: Work E-mail: gerry@pgts.com.au Work Phone: Work Fax: Work Address Line 1: Work Address Line 2: Work City, State, Zip: Mobile Phone: Home E-mail: Home Phone: Home Fax: Home Address Line 1: Home Address Line 2: Home City, State, Zip: Birthday:
I do find these headers (and the body) intriguing.
I use mutt, which is a non-GUI MUA. And I must say, that had HTML email been invented first, what a marvellous invention text-only email would seem! I have configured mutt to show headers when I compose email (with vi). I can also view all the headers easily. So, when the email from Plaxo arrived, the following things were apparent to me:
- The From Address says From Fred Nurk <fred_nurk@optusnet.com.au>.
- Although it says it is from Fred, the Reply-To Address says something different, and if I press "r" (in mutt this means "reply"), the To: tag will contain <addrupdate-171979931699-39699068-900436804-1SH@mx.plaxo.com>, rather than Fred Nurk's e-mail address.
- The Subject: says "Please help me update my address book", which is not my friend Fred Nurk speaking, but Plaxo.
- The body text is signed with Fred's name, but it actually comes from Plaxo!
- Unless I get gripped by a bout of sudden temporary insanity, Plaxo have about as much chance of me volunteering information such as my birthday, home address, business address, etc I would of getting a date with Sharon Stone.
Now that might be obvious to me, but most of it (apart from the last point) may not be so obvious to your average GUI user.
Your average GUI user might look at the HTML version of this email in their GUI MUA and suppose that they are looking at an email from their good friend Fred Nurk, asking them to please update their details in his address book. They might even click on the link to update Fred's address book
Now the more wary GUI user (yes there are a few of them) might pause to think -- Hey! Fred should know all this stuff! (seeing as how they are such good mates.
This would not occur to the less wary, or they might think -- Oh well, maybe he was just too lazy to put it in his address book -- I'll do it for him. And they would hand over the details to Plaxo (who up to this point only had their e-mail address.
The more wary GUI user might click the reply button (finally the lesson has begun to sink in that one should not click on things in HTML emails -- especially if one is a GUI-only user).
Well it should be safe to reply -- After all the email does say it is From: Fred Nurk. But the Reply-To: tag means that the reply goes to <addrupdate-171979931699-39699068-900436804-1SH@mx.plaxo.com>.
Now your average GUI user can't see that portion of the address. He only sees the part in double quotes. So if he is still a very wary user he might see that, after clicking "Reply" the To: address now says "Plaxo Contact Update for Fred Nurk", and reconsider. But this only happens after actually clicking on Reply, and "Fred" did mention that it was for his address book. So if the victim fills in the parts in the body they have just clicks on send ... it goes not to Fred Nurk ... but to Plaxo.
It appears that Plaxo have tried to clean up their act since I last mentioned them in the Feedback Column. And yes, they are no longer listed in popular DNS-block lists. And some people are even saying nice things about them. But I think this email shows that are not so nice. In fact, the rather tricky construction of these headers borders on deceptive and misleading conduct. It may not be illegal but it certainly is not honest.
For an in-depth discussion of what else might be not-so-nice about Plaxo see Roger Clarke's Black Book.
For non-technical, GUI-only users (and I hope there are a few of you peeking over the other side of the fence to see what technos are discussing), a word of warning ... If you still wish to use Plaxo to store your address, make sure you let people on the list know that their details are held by Plaxo. You have just sent all the data on those people to an external organisation, and unless you are a Californian, it may be out of your jurisdiction (and judging by Roger Clarke's article, the news is not all that good for Californians).
If you are the recipient of one of these e-mails -- Remember the first rule of the Internet for GUI only users Don't click on anything in your inbox!
(Makes one wonder ... why have a GUI MUA? -- Why indeed!)