Don't strip the display name in reply address masking

Discussion re sg development. You don't have to be a developer.

Don't strip the display name in reply address masking

Postby lwc » Thu Sep 24, 2009 9:29 am

Please merge this thread inside here (as it contained no actual subject and went in the wrong forum).
When you use Reply Address Masking, it strips both the From Name and To Name.
i.e.
Code: Select all
From: Joe Blow <jblow@server.com>
To: Your Friend <friend@theirserver.com>

Becomes:
Code: Select all
From: jblow@server.com
To: friend@theirserver.com

This basically turns Spamgourmet into an anonymizer service, which might partially explain why more and more services block Spamgourmet.

Can you please don't strip the names from From and To and thus lower the risk in using Spamgourmet?

Also, why isn't this mentioned in FAQ? I actually didn't realize the stripping part until someone blocked me...
Last edited by lwc on Sat Jul 03, 2021 8:36 am, edited 5 times in total.
lwc
 
Posts: 455
Joined: Sat Aug 28, 2004 9:09 am

Re: Don't strip the display name in reply address masking

Postby gourmet » Mon Oct 05, 2009 12:25 pm

My point of view.

I like that reply masking removes name info. Email address is perfectly enough. If I want to use my real name and email address, then I do. If I choose to use spamgourmet reply masking, then I use it. And then it's better that my realname is also stripped away.

So please let me know if and when this is going to be changed.

Of course it's possible to set email name in email program to something funny. But that's not funny for other contacts.

Or user can setup multiple profiles in email program. Other with directy reply-to addresses to SG and some other name etc.

At least stripping should be optional. And I would prefer to use it.
Last edited by gourmet on Sun Oct 18, 2009 9:09 am, edited 1 time in total.
gourmet
 
Posts: 124
Joined: Thu Mar 27, 2008 4:46 pm

Re: Don't strip the display name in reply address masking

Postby nick4mony » Mon Oct 05, 2009 12:31 pm

I think we need to distinquish two use-cases
    When you receive an email from Ty Coon
    When you send an email to Ty Coon.

Since this thread is concerned with outgoing messages (you -> Ty Coon), here's a suggestion:

If you want to use your real name and real email address, you simply skip Spamgourmet altogether.

But if you want to use your real name and a Spamgourmet reply address, here's my technical suggestion (for development). In the first few lines of the message, allow the user to put several header fields:
Code: Select all
X-FTfromName: Barack Obama
X-FTtoName: Ty Coon
Hello Ty Coon, your time is up (rest of message).

Of course, users with the technical capability to add custom headers (as real headers) should do so, but places like Yahoo cannot do that.

The advantage is that no extra database fields are required - the system gets a message, parses it, and strips (or not) accordingly, with the default being for more privacy. After the message is processed, there's nothing to store.

Nick.
nick4mony
 
Posts: 22
Joined: Wed Feb 13, 2008 11:13 pm

Postby josh » Tue Oct 06, 2009 3:34 am

good point nick4mony - we all are talking only about messages going *from* a spamgourmet user *to* somebody else, right?

(messages going the other way -- *from* somebody else *to* a spamgourmet user with reply address masking will sometimes have the display name preserved, but only if the display name + the new longer address are less than 80 characters (or some number - I can't remember what it is right now), I think - we had problems when we let the address field get longer than that)

Also, messages *from* a spamgourmet user *to* somebody else aren't altered unless you're sending to a redirection address -- another way to look at this is if you *don't* have reply address masking turned on, then there's no alteration.

so, to sum up the feature request, if I, the spamgourmet user, have reply address masking enabled and I send a message that way now, using, for example testaddress.josh@xoxy.net as the disposable address, it changes:

From: "Josh Hamilton" <joshrealaddress@example.com>

to

From: testaddress.josh@xoxy.net

(assuming my mail server uses the syntax on top - there are, unfortunately, different ways to do it, and so you can't count on consistency)

and what this feature would do is make it so that

From: "Josh Hamilton" <joshrealaddress@example.com>

would instead change to

From: "Josh Hamilton" <testaddress.josh@xoxy.net>


is this what we're all talking about?
josh
 
Posts: 1371
Joined: Fri Aug 29, 2003 2:28 pm

Spamgourmet user sending to someone else

Postby nick4mony » Tue Oct 06, 2009 12:15 pm

josh wrote:good point nick4mony - we all are talking only about messages going *from* a spamgourmet user *to* somebody else, right?
...
so, to sum up the feature request, if I, the spamgourmet user, have reply address masking enabled and I send a message that way now, using, for example testaddress.josh@xoxy.net as the disposable address, it changes:

From: "Josh Hamilton" <joshrealaddress@example.com>

to

From: testaddress.josh@xoxy.net

(assuming my mail server uses the syntax on top - there are, unfortunately, different ways to do it, and so you can't count on consistency)

and what this feature would do is make it so that

From: "Josh Hamilton" <joshrealaddress@example.com>

would instead change to

From: "Josh Hamilton" <testaddress.josh@xoxy.net>


is this what we're all talking about?


Yes, that is correct - for those that have reply-address-masking turned on. And because different people have different preferences, one needs to be able to control it (with my suggestion being to leave the default behaviour as current, but control it with custom headers or header-like lines in your message).

Two points come to mind
  1. The reason I use FT rather than SG is if the user (or the spamgourmet software) muffs it up and the header lines don't get intercepted, the recipient will see them. Presumably most recipients won't associate the "FT" with Spamgourmet.
  2. The Spamgourmet software needs to be able to dig out those header-like lines from inside a HTML-coded message (Urrghh!).


Nick
nick4mony
 
Posts: 22
Joined: Wed Feb 13, 2008 11:13 pm

Postby lwc » Tue Oct 06, 2009 2:38 pm

Yes, Josh, that's the request. All I want is the same thing as "messages going the other way". My point is asking why should there be any difference?

I'm sorry, but the natural way is to display your name. Spamgourmet is an "anti-spam tool", not a service to send anonymous messages and remove headers. Especially when your method is likely to cause blacklisting (officially or not) or suspicious treatment (of a nameless weird looking address). Keep in mind "no name" is a steady official factor in determining what's spam or not. Need I remind you 99.9% of the users never check their spam box? I challenge you to find the word "anonymizer" anywhere in the main page of FAQ. Besides, hiding one's name in one's mailer takes 2 clicks (or even 1 as some of smallest programs might let you change it right from the actual message), really unlike demanding of others to live their entire life using only special programs/services that add custom headers.

Don't believe me that Spamgourmet is - and even actively refuses to be an anonymizer and risk lawsuits? Which specifically means Spamgourmet officially refuses to modify/remove headers (which means the issue here is a glitch and not a feature)? Then click here to read it directly from Josh.

But why are we even arguing? Adding a choice of "strip display name" would solve that issue for those who want an auto anonymizer. Then you could update the FAQ and mention Spamgourmet can also be used as an anonymizer (Q: "Is it true Spamgourmet can also be an anonymizer?" A: "Yes, just enable strip display name, but be aware it is more likely to flag your messages - whether in the receiver's eyes or plain out technically - as spam. Also realize by doing so you may risk Spamgourmet itself legally.").
lwc
 
Posts: 455
Joined: Sat Aug 28, 2004 9:09 am

Re: Don't strip the display name in reply address masking

Postby lwc » Sun Jul 14, 2013 9:10 pm

josh (2013) wrote:this is pretty much working now, right? It's not an option, it's on all the time.

Believe me, even without it, sg is not an anonymizer.

I can't natively test it because you've already manually enabled it for me.
So I've created a new test user, and guess what - this "feature" is still off by default...

Worse still, my tests proved you've removed the display name for reply-masked addresses. That is, if I send to "Whatever" <...@ob.0sg.net> than the recipient sees it as simply "...@ob.0sg.net".
This may cause my outgoing messages to get flagged as spam.

Last but not least, please use "quotes" for display names ("Whatever" <...@ob.0sg.net> instead of Whatever <...@ob.0sg.net>) - this refers to users which you've fixed manually to have this "feature".
lwc
 
Posts: 455
Joined: Sat Aug 28, 2004 9:09 am

Re: Don't strip the display name in reply address masking

Postby josh » Tue Jul 16, 2013 7:21 pm

Yes, the feature is off by default, and it's only on for you and me, I think. I added quotes.
josh
 
Posts: 1371
Joined: Fri Aug 29, 2003 2:28 pm

Re: Don't strip the display name in reply address masking

Postby lwc » Wed Jul 17, 2013 6:39 am

josh wrote:Yes, the feature is off by default, and it's only on for you and me, I think. I added quotes.

Thanks for the quick fix!

For the accounts that use it, can you also fix it to keep the To field's display name? "If I send to "Whatever" <...@ob.0sg.net> than it currently becomes simply "...@ob.0sg.net".
Last edited by lwc on Sat Jul 03, 2021 8:40 am, edited 2 times in total.
lwc
 
Posts: 455
Joined: Sat Aug 28, 2004 9:09 am

Re: Don't strip the display name in reply address masking

Postby K6PDG » Mon Jun 02, 2014 11:13 pm

When I send directly from my email account to my recipient, the From: looks like From: Personal Name <username@mousepotato.com>.
When I relay my email through SpamGourmet.com, both parts of the From: are replaced by the SpamGourmet full address, thus From: username@spamgourmet.com <username@spamgourmet.com>. Is there someplace I can specify my Personal Name to SpamGourmet so the result is From: Personal Name <username@spamgourmet.com> ?

I ask because it makes the archive of any mailing list I use display the obfuscated full address rather than my Personal Name. It looks like I don't know how to use my email user agent.
K6PDG
 
Posts: 2
Joined: Mon Jun 02, 2014 8:38 pm

Re: Don't strip the display name in reply address masking

Postby lwc » Sat Jul 03, 2021 8:48 am

lwc wrote:
josh wrote:Yes, the feature is off by default, and it's only on for you and me, I think. I added quotes.

Thanks for the quick fix!

For the accounts that use it, can you also fix it to keep the To field's display name? "If I send to "Whatever" <...@ob.0sg.net> than it currently becomes simply "...@ob.0sg.net".

When josiah recently fixed a database issue he mentioned he took the fix from Spamgourmet's Github community repository.

Can someone thus please add this feature in GitHub?

Thanks!
lwc
 
Posts: 455
Joined: Sat Aug 28, 2004 9:09 am

Re: Don't strip the display name in reply address masking

Postby VanguardLH » Sat Jul 16, 2022 7:25 am

I must've missed an RFC that overrides prior RFCs regarding the To and From address headers. That "comment <address>" is commonly used doesn't alter the RFCs that define Internet Messaging. The To header is mandated: it must appear a minimum of 1 times, and a maximum of 1 times. The From header is mandated: it must appear a minimum of 1 times, and a maximum of 1 times. However, the comment token in those headers is optional: it may appear 0 or 1 times. Only the address token is required in those headers. Just because most e-mail users construct those headers to show "From: userA <userA@domain>" and "To: userB <userB@domain>" doesn't mean the comment token is required. It could be "We Cheat 'Em How <realtyspammer@domain>" . The comment token can be ANY string the sender wants to use, not their real name, not their name in the account, or anything identifying the person(s)." In fact, mailing lists often use a comment token that identifies the mailing list, not its admin, like "Garden Beauty Monthly Newsletter <noreply@domain>". There is no one named "Garden Beauty Monthly Newsletter" involved in sending out the mailing list. The only required token in the To or From headers is the address token.

Why would the recipient of a reply showing just their e-mail address not know they are identified by just an e-mail address? A spammer wouldn't know, because they puke out from temporary or bogus e-mail sources, but you should NEVER reply to a spammer to validate they hit an active and monitored e-mail account.

There is a problem if those headers do not enclose the address token within angle brackets. The address token is supposed to be angle bracketed; else, it become indistinguisable from the comment token. "To: user@domain" specifies only a comment token, and the address token is missing. Clients and servers might allow sloppy syntax (i.e., the address token is not clearly delineated with angle brackets), but sloppiness can result in delivery problems, especially with NDRs (Non-Delivery Reports) saying your message could not be delivered, because you didn't specify the address token. If SG is deleting the comment field, including only the address token, but not delineating the address token, then SG is generating invalidly syntaxed headers. Just because some clients or servers are sloppy isn't cause for SG to do the same.

https://datatracker.ietf.org/doc/html/r ... tion-3.6.2
from = "From:" mailbox-list CRLF
https://datatracker.ietf.org/doc/html/r ... ection-3.4
mailbox-list = (mailbox *("," mailbox)) / obs-mbox-list
and
mailbox = name-addr / addr-spec
and
name-addr = [display-name] angle-addr
angle-addr = [CFWS] "<" addr-spec ">" [CFWS] / obs-angle-addr

The address token is ALWAYS to be angle bracketed, not shown as a text string that could be confused as the comment token (aka display-name). If SG is changing:

To: Your Friend <friend@theirserver.com>

to:

To: friend@theirserver.com

then SG is generating an invalidly syntaxed To header. There is no address spec in that To header, just a comment, so the message may not get delivered due to invalid syntax. To show in another syntax format, the headers should be:

To: [comment] <addrspec>
From: [comment] <addrspec>

where brackets indicate optional tokens (i.e., the comment token). The angle-addrs token is still required, and that means enclosing in angle brackets. Regardless of how humans might interpret a comment-less header with a non-delineated address spec, SG should still comply with RFC standards. Don't make the clients and servers guess which token is specified in a sloppily syntaxed header.
VanguardLH
 
Posts: 51
Joined: Sun Oct 11, 2009 10:01 pm

Re: Don't strip the display name in reply address masking

Postby lwc » Sun Jul 17, 2022 11:13 am

VanguardLH wrote:SG should still comply with RFC standards. Don't make the clients and servers guess which token is specified in a sloppily syntaxed header.

You make it sound worse than I thought.

But when you send mail from Gmail to just an address, Gmail does not use brackets.
Are you sure Gmail breaks RFC?

But RFC aside, please accept the simple fact that even if someone fixes this and adds brackets for address-only to fields, Spamgourmet will still cause spam issues due to sending pure addresses.
Comments might be optional, but spam detections will still give a worse grade to those that don't use them.

You might say (again, if you're right about RFC and Gmail is wrong): comments > no comments but brackets > no comments and also no brackets

For that matter, RFC completely finds it legitimate for you to write words like "pills" inside your messages, and yet you're more likely to get classified as a spammer if you try it...

P.S.
Don't forget comments are also expected to use quotes ("Your name or comment" <address>).
Attachments
no_brackets_gmail.png
Gnail does NOT use brackets for addess-only TO fields.
no_brackets_gmail.png (32.01 KiB) Viewed 12362 times
lwc
 
Posts: 455
Joined: Sat Aug 28, 2004 9:09 am

Re: Don't strip the display name in reply address masking

Postby LarryEngholm » Thu Jun 01, 2023 5:16 pm

VanguardLH said specifying an email address without angle brackets in a To or From header field violates RFC 5322. He misinterpreted the RFC that he quoted.

The RFC explicitly says:
There is an alternate simple form of a mailbox where
the addr-spec address appears alone, without the recipient's name or
the angle brackets.

He mentioned that the syntax specifies
Code: Select all
mailbox = name-addr / addr-spec
which means a mailbox can be either a name-addr or an addr-spec, but he went on to describe only name-addr, which does require angle brackets, and he ignored addr-spec, which doesn't.

While this SpamGourmet behavior doesn't violate the RFC, I also wish SpamGourmet would include the display-name (which VanguardLH incorrectly referred to as a comment) rather that just the address.
LarryEngholm
 
Posts: 2
Joined: Tue Jul 20, 2021 6:54 pm


Return to Developers

Who is online

Users browsing this forum: No registered users and 2 guests

cron