[mseebach]

> But what if some random e-mail client prefetches the image and the e-mail end up never being read or whatever? This is not robust.

The whole point of not loading images is the privacy concern, so if your email client (which is any email client with any kind of traction in the past decade) offers (and defaults to) not loading images, it will indeed not hit the URL.

[nemeth]

> The whole point of not loading images is the privacy concern, so if your email client (which is any email client with any kind of traction in the past decade) offers (and defaults to) not loading images, it will indeed not hit the URL.

I'm not sure this is accurate, this link is a little old but it indicates quite a few webmail/desktop clients load images by default: http://www.campaignmonitor.com/blog/post/2559/current-condit...

[mseebach]

Several of the clients that is listed as displaying images by default doesn't do so any more. Yahoo, Hotmail, Apple Mail, Thunderbird, Outlook Express and Entourage are among these IIRC.

Perhaps "decade" was too generous a word to use. Certainly any client that has traction today defaults to not loading images. Now, that certainly doesn't mean that there are no clients that does this, and that no-one changed that setting.

[noobiscus]

Irrelevant.

That the possibility for an email client to be so configured that it would AUTOMATICALLY process a false positive validation, makes this system utterly unusable for any developer with a [brain|conscience].

[mseebach]

No, I do think it is relevant.

If the purpose of the validation is simply validation, then what you call a false positive isn't actually false, as the e-mail address evidently was valid.

Including a very clear "I did not ask for this" link in the e-mail would allow false positives to undo any damage done.

Just because a technology can be used for bad (and this one is indeed - anyone auto-loading images in e-mail will be flooded with spam for that exact reason) it does not imply that any use of the technology is bad.