1
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
Mike Cardwell
Mike Love's blog on Linux, security, and privacy — tutorials, analysis, and tools
- Popular posts
- 6
- Total points
- 765
- HN comments
- 516
- Rank
- #3,062 personal
Visit grepular.com → RSS feedOn Hacker News Jan 2011 – Mar 2026
Security & Privacy 6Web & Frontend 4Tools & Productivity 1Networking & Internet 1
2
Neat trick for getting private info for Facebook, GMail, Twitter and Digg users
Hidden img and script tags with onload and onerror let any site tell if you're logged into GMail, Facebook, Twitter or Digg. Google called it expected.
3
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
4
The Sad State of HTML Email Input Fields and IDNs
Chrome and Firefox disagree on IDN addresses in type=email inputs: punycode, validity and the value JavaScript sees. Feature detection is the workaround.