HTML E-Mail

"...E-mail is simple. Like the pencil, it just works..."

Graphical email clients are now the standard among users of PC's. While these email clients are convenient and powerful, they also open users up to several potential privacy and security threats. So this make e-mail is not simple when for example HTML is involved.

HTML (Hyper-Text Markup Language) is the language used to make web pages. HTML can also be used to write nice-looking, showy emails, therefore most of the standard Email readers in use today, such as Outlook, Outlook Express, Netscape Messenger, and Eudora are HTML-enabled. But HTML is for making web pages and plain text is for simple email communications. If you're looking to create a web page or write a book, fine. But e-mail messages are not web pages or books. E-mail was designed for simple messaging. Anything else detracts, rather than adds to its core functionality.
But what exactly is so bad in HTML email? Think about it. What privacy and security threats do you face on the web with your web browser? Three main threats are:
IP revealing
cookies and web bugs
active content (Java applets, ActiveX controls, JavaScript and other forms of active scripting)

The basic technique is for an HTML message to include a graphics in an HTML Email message that is loaded from a Web server. This graphics is specified using a standard HTML IMG tag. The tag can appear anywhere on the page, and the graphics file will be fetched and displayed when the Email address is read. Or won't be displayed because file can be a 1-by-1 image that is completely invisible. The technique of including invisible images in junk Email messages is common today and they are used for the purpose of checking to see if a junk Email has been read or not, or to get your IP from the IMG request. This makes Internet relations much less private.
The technique based on cookies can be used to match someone's Email address to his "internet surf history" without his knowledge. This technique can be used to allow a banner ad company to associate an Email address with an "anonymous" profile that has been created for a person as they surf the Web. Once a banner ad company has an Email address tied to a profile, they can provide a service to advertisers of customized ads in "junk" Email message. These ads can be based on profiles previously created from Web site visits. In addition, banner ad companies can offer the service of sending out "junk" Email messages to people who visit a particular Web site. Such technique relies on a security hole that is present in both Microsoft's Internet Explorer browser and Netscape's Navigator browser.
Several general vulnerabilities in HTML mail make it possible for malicious code to launch when you even preview a message in some versions of Outlook, unless you have the latest patches for Internet Explorer. For instance, the Forgotten worm was written in Visual Basic Script and spread without any attachment. Instead, the worm code was embedded into the HTML formatted message body. The I Love You worm program exploited an ActiveX vulnerability and was executed just by viewing or previewing the e-mail message without opening any attachment. The latest update for IE neutralizes the IFRAME tag used by Klez and other recent viruses.

So when you're surfing the web, all of those technologies can be used by web sites to compromise your own privacy and (in extreme cases) the security of the data on your computer. And now when you receive HTML email in one of those HTML capable email clients, however, you face the SAME threats like you're really opening a web page, just as you would in your web browser. Put simply, any technology that you might face on the World Wide Web while using your web browser is now used while you open and read email.

HTML mail tips

Use latest patches
Not only do you need to keep your anti-virus software updated and scan any attachments before opening them, but you should also stay current with updates to Internet Explorer, whose components are used to display HTML format mail messages. So unless your copy of Internet Explorer is current with the latest patches, you may be running a risk of virus infection via an HTML message.

Default HTML
Some mail programs generate HTML by default. Even if you think you are typing plain text, your program may be sending HTML without your knowing it.

Unwanted files
HTML or MIME messages leave or include unwanted files (attachments) on the machines of the recipients of these messages.

Reciepient's problems
If your recipient's mail program is not the same as yours, HTML in a message can cause problems. Your message may not look like what you intended, and there is no way for you to find out.