America Online may be late to the party, but its new, HTML-enabled e-mail
client offers unique security and privacy features that could put AOL’s
program on top. Too bad AOL had to spoil the effort by forcing HTML down
everyone’s throats.
While popular, standalone mail packages such as Qualcomm’s Eudora,
Microsoft’s Outlook and Outlook Express, and Netscape Messenger have been
able to compose and display HTML-based messages for years, AOL belatedly
added the capability in AOL 6, which was released to the public last week.
But testing by InternetNews.com in conjunction with Richard M. Smith, chief
technology officer for the Privacy Foundation, revealed
that AOL version 6 ships with superior protection against HTML-based
security threats.
According to Smith, AOL’s new e-mail client disables any JavaScript
code embedded in incoming e-mails. As a result, recipients are shielded from
a number of attacks
which use the scripting language, as well as from malicious ActiveX
controls contained in HTML-based messages. Microsoft’s and Netscape’s
popular e-mail clients, on the other hand, allow such active content in
e-mail by default.
“AOL implemented HTML in a safer form, and given that they have such a large
market share, that’s a good thing. Microsoft could take a cue here from AOL
in doing e-mail in a safer way by default,” said Smith.
What’s more, the AOL 6.0 mail client offers singular protection against a
stealthy privacy threat called web bugs.
These are the 1×1-pixel graphics that are sometimes embedded in web pages
and e-mails with links back to the sender’s server. With most e-mail
packages, when the user views the mail, his or her IP address is silently
logged by the sender. Some e-mail marketing companies use web bugs to
monitor how many people actually view their ads. They can also be used to
synchronize a browser cookie to a particular email address.
But a feature in AOL version 6 called the “Picture in E-Mail Warning” can
stop web bugs before they load. By default, the AOL software pops up a
warning box whenever a user tries to view a message with an embedded
graphic. While the warning can be disabled in the AOL 6 Mail Preferences
menu, Smith says the feature gives AOL users a unique privacy shield.
“Other e-mail readers don’t offer this option, and it’s going to have the
effect of raising awareness of web bugs. It keeps the marketers from nosing
around,” said Smith.
PLAIN TEXT IS NOT AN OPTION
While the AOL 6.0 e-mail client may have a leg up on other packages, the new
software is marred by a few blemishes.
Some users have reported formatting bugs when the software displays HTML
messages created by other packages such as Outlook Express.
Others are upset by the AOL 6 e-mail client’s inability to send messages in
plain-text format only. Unlike Outlook, Eudora, and Netscape, AOL 6 composes
all email in the multipart-alternative format.
In theory, recipients of AOL 6-generated e-mails with HTML-enabled email
readers should see HTML or so-called “styled text” formatting, while those
with plain-text readers will see just text. But some older email clients —
particularly some that run under UNIX — may not be able to handle multipart
formatting and won’t be able to display AOL 6-generated messages at all.
Others are reporting a messy combination of both the HTML and plain-text
versions in the same message.
Even when they display properly, AOL 6 messages are roughly twice the size
and require double the bandwidth of plan-text emails, based on test
ing by
InternetNews.com.
According to Eugene Spafford, a professor of computer sciences at Purdue
University and co-author of a guide to
etiquette for Internet newsgroup users, the lack of support in AOL 6.0 for
plain-text only e-mail is sloppy and inconsiderate.
“It is poor design to assume a format that is more complex than needed and
may not be readable by others. People who insist on encoding e-mail are
wasting bandwidth for the extra encoding and processing time,” said Spafford
in an email interview.
Adam Bailey, author of a list of
frequently-asked questions about AOL’s email service, said the company may
be trying to hasten the adoption of HTML in mail clients. “Being a Unix
geek,” said Bailey, “I see no particular reason to push HTML on the Internet
before it’s ready.”
Similarly, Debbie Doerrlamm, webmaster of the BeautyTech.com website and
moderator of several Internet discussion groups, said AOL should give users
a choice.
“It’s an intrusion that they’re forcing me to use styled text when I don’t
want to. It’s like the updates that they force you to take. Ask me first.
Don’t make me do stuff just because you think I need it,” said Doerrlamm.
America Online representatives were not available by newstime, but according
to one AOL 6 beta tester, the online service plans to update the email
client to allow text-only messages in the future.
Brian McWilliams
While the new e-mail client may provide good reasons for users to upgrade to
AOL 6, the program, as recently reported by InternetNews.com, is interfering with the networking settings on some user’s PCs, especially those with broadband connections or who are part of a local-area network.