BCC is hard, OK? Quite a lot of orgs blurted your email addresses in GDPR mailouts Amid the chaos of new European data protection rules coming into force at the end of last week, organisations are apparently struggling to grasp even the most basic of technical challenges, sending out non-blinded emails to their users. Topping the irony charts is ad-blocker Ghostery, which sent users an email with more than …
Or; my pet hate.
Idiots who use "Reply to All" on every ********** single email.
Outlook makes this far, far too easy.
It is an option that ought to be hidden under thirty menus. In the last thirty years of email use I've used it once.
So why, **********ing why is it an option at all?
I worked for a European energy company, and an email to all employees was sent in one of the directors names. Some fool "replied all" with their branespeak, and in a company with over 40,000 employees copied in, a small additional number of fuckwits were persuaded that this was a good way to raise their profile. This snowballing of bilge rapidly threatened to take down the entire IT infrastructure, until the CEO waded in and sent an email to all employees, promising that the next person using "reply all" to company wide email would find a compulsory meeting with him in their Outlook calendar, including paid travel to the German head office.
Surprising how many people suddenly realised that it was possible to NOT "reply all" - although only for a few days. I've concluded that "reply all" is the digital equivalent of liking the sound of your own voice.
"It's not helped by Outlook hiding the BCC box by default. If MS have the sense to check for the word 'attached' in an email and warn about forgetting the attachment, you'd think they'd do something about 100s of to or cc addresses."
Our company recently switched to O365. Outlook defaults to reply-all. Even the Android app does too. You have to click the tiny arrow on the button to change it or go into the settings to change the default. There is evidence in my inbox that demonstrates that at least some people in the company haven't figured that out yet.
Are you sure?
Because I'm still getting emails from companies selling me stuff, when those same companies asked me to keep in touch with them, which I refused to do.
Haven't had an email from my Nigerian Prince friend though. Poor guy, must be awful having to deal with this GDPR thing while not being able to access the money in his friend's account without my help.
One idiot, (normally in sales)to select the wrong field and you will have a serious issue.
It's easy enough to prevent in exchange etc by setting maximum recipients to a sensible value. At least it will limit the damage.
Sophos SEA (mail scanning appliance) can also do rule checking on outgoing mail to prevent this problem as well.
If your IT is encouraging people to do this in Outlook then IT is the problem. Customer comms should always be done from a dedicated tool (one that enforces consent and respects opt-outs), and customer email addresses should never be available in bulk outside of that tool.
And of your IT department doesn't provide that tool... well these days it's easy to bypass them. Sure it'll cause long-term problems but if you don't then you'll get short-term and long-term term problems.
Since Demon mail was outsourced to Office 365 the BCC function has been reported by BCC recipients as showing all the BCC addresses. My emailer is Pegasus.
Just sent a message to a user in my Demon subdomain from a different user in the same subdomain. Also BCC'd it to another user in that domain - and also BCC'd it to a user in a different domain.
The first received message's headers just shows the To: field.
The second message shows the same To: field - followed by the line "BCC:" with both the other two recipients' addresses which are in different domains.
That looks definitely like a breach of expected behaviour.
The third one has not arrived - possibly that is for the other BCC'd domain which should have done a redirection.
"My emailer is Pegasus."
Weird!
Just repeated the experiment to four addresses.
All addresses are in my Demon subdomain. One To: and three bcc:
Instead of receiving four emails - there are only two.
First one raw view only has the To: field
Second one has To: field - followed by the line "BCC:" - containing all three bcc addresses.
Something is wrong with the Office 365 handling of a header's BCC field - or Pegasus is coding the multiple addresses in a way that is not recognised beyond the first? one.
This the anonymised raw header view - the To: keyword is mixed case - the BCC is uppercase.
To: home@mydomain.demon.co.uk
Date: Tue, 29 May 2018 15:55:26 +0100
Subject: bcc test2
BCC: userone@mydomain.demon.co.uk,
usertwo@mydomain.demon.co.uk,
userthree@mydomain.demon.co.uk
" You wouldn’t have a bcc field - [...]"
Without digging out the RFC. My expectation is that my email application sets the outgoing header To: field for all the visible addresses - and sets the outgoing header BCC: field for all the bcc addresses.
When that outgoing email arrives at my service's mail server - it would then get duplicated as separate emails to each recipient. The BCC field is either omitted on those emails - or used to tell each single bcc recipient that what they have received was sent as a blind copy.
The Office 365 mail service seems to be recognising the BCC: field in the Pegasus outgoing header - but then acting as if there is only one bcc address - with the remainder of the addresses being treated as comment? text for that address.
"Without digging out the RFC. "
Have now dug it out. RFC-2822 makes various provisions for whether a blind copy recipient gets a Bcc: field in their copy of the email.
The only thing that appears unexpected about Bcc: in RFC-2822 section 3.6.3 is that is appears to allow an option of all the Bcc addresses to be sent to each Bcc recipient. See quote below.
That seems like a security weakness - assuming that a number of Bcc recipients are entitled to know who else was sent a blind copy?
"In the second case, recipients specified in the "To:" and "Cc:" lines each are sent a copy of the message with the "Bcc:" line removed as above, but the recipients on the "Bcc:" line get a separate copy of the message containing a "Bcc:" line. (When there are multiple recipient addresses in the "Bcc:" field, some implementations actually send a separate copy of the message to each recipient with a "Bcc:" containing only the address of that particular recipient.)"
It still appears that this Office 365 service is not correctly interpreting the Pegasus outgoing Bcc: field of multiple addresses "folded after each comma".
No, it means that an email sent from person A to person B, BCC to person C and person D will appear:
Person B:
From: A
To: B
_____
Person C:
From: A
To: B
Bcc: C
_____
Person D:
From: A
To: B
Bcc: D
_____
I.e. as a bcc recipient, the bcc line will only show you - no-one else, presumably so people can get a warm fuzzy feeling that they were specifically bcc'd and didn't receive it as a raw forward, or by accident.
(When there are multiple recipient addresses in the "Bcc:" field, some implementations actually send a separate copy of the message to each recipient with a "Bcc:" containing only the address of that particular recipient.)"
..... i.e. most simply won't bother sending a Bcc line, but some will actually make one, containing that particular recipient only
In Pegasus Mail:
Options - Sending Mail - Checkbox 'Suppress BCC listings when sending mail" should be checked!
To quote David Harris:
"Suppress BCC field listings in outgoing mail BCC (Blind Carbon Copy) is a useful, but poorly-standardized feature. There are at least four ways a BCC field could be written into a message:
It could be omitted altogether
It could be present, but contain no addresses at all
It could contain only each individual recipient's address
It could contain the addresses of all people receiving the BCC
All of these methods have adherents and detractors. By default, Pegasus Mail lists all the BCC recipients in the BCC field of mail it sends: if you would prefer that no addresses were shown in the field, then check this control. When this option is turned on, the BCC field will simply contain the text "(Suppressed)", without any addresses."
"Options - Sending Mail - Checkbox 'Suppress BCC listings when sending mail" should be checked!"
Thanks for that - and thanks to all the other people who replied.
Pity that the suppress Bcc option apparently has to be set individually for every user identity in Pegasus - rather than just in the base "default" SMTP identity.
Having switched on Pegasus SMTP logging I believe I now have some understanding of what happens.
On SMTP Pegasus sends a RCPT TO: line for each address in the To: field - followed by a single copy of the body.
It then sends a RCPT TO: line for each address in the Bcc: field. It also includes a BCC: line with all the bcc addresses - followed by a single copy of the body.
Office 365 mail service then seems to treat the multiple addresses in my Demon subdomain as one addressee. It sends only one email for each of the two Pegasus emails sent - rather than a copy for each name. Presumably it is something to do with the multiple addresses on my Demon subdomain being classed as "alias" names in Office 365.
That still leaves the mystery of what happened in my first test when a bcc to a different domain apparently did not arrive.
This post has been deleted by its author
This post has been deleted by its author
Oh boy, isn't this the excuse of the hour. How many other services require sharing people's data with 3rd parties with the sole narrow justification of cost savings etc. Following GDPR, I look forward to some of these services coming back home so to speak. Don't you? Here's an example...
Mandrillapp.com powered emails started arriving this week. But there's no way to load the webpage to check the consent settings, or email anyone to explain it isn't working. What's the odds the ass who put this together was signed-in from their own local network, and didn't test logged-off or on an outside network / other device, so everything only 'appeared to work'!
This is my 10th case seeing this just on a personal level. Jesus Christ when will firms start testing this on outside networks and devices before assuming they're compliant! Even better than that though... Start asking, whether you should even be holding onto people's email addresses. Why is there NO audit process? In all 10 cases this week, the firms involved had no right to keep my email anymore! Its just a liability to them, WTF?
Agreed. I've said for years that the defaults should be Reply and CC, with Reply All and BCC more difficult to access, and given exactly your reason for why. I used to get most people agreeing with me, but now people don't seem to understand what I'm getting at - is it a function of Facebook/Twitter etc where people expect everyone else to be suffer every random thought?
PS I notice that the obligate downvoter is busy again!
The mass mailer (I wrote for a club I help run) just sends (same) mail to each user, so bandwidth heavy but no chance of email address leakage. As the membership is only in 3 figures and the mailings are just text then the bandwidth "waste" is not really an issue, but would be if mail numbers were significant
Sounds like mine is pretty much the same - also for a kid's club I helped to run (small world!). I've got an extra level of security - everyone gets their own club address, and has to post through a proxy, which modifies all the mails so that no-one ever gets a 'real' outside-world mail address. It never uses BCC, of course - it's far too wooly.
'Nutrition biz Vitl – which pushes "tailor-made" diet and liefstyle plans'
The innerwebs tells me that "lief" is indeed an English word, but asks me "Did you mean: lifestyle" when I tried searching for "liefstyle". My own spell checkers underline "liefstyle" with a red squiggly line, but are happy with "lief". Maybe El Reg editors are colour blind, and don't spot the red squiggly lines? Or perhaps Vitl customers would just as lief have a tailor made diet?
My old university computing society did the same. Nice email with 1000 emails in 'To'.
A fairly friendly (but a bit arsey) email later and I got a data breach email from them the next day announcing what they'd done.
And yeah. I also work in a place where 'Reply All' is pretty much the default option. Cue hundreds of email a day.
There is a problem with BCC in some email systems if you use encrypted mails.
Some systems prefer to encrypt the mail contents and then send the decryption keys in lock boxes on the front of the email... and some include all the bcc recipients in the lock boxes. If you know how to find these then you can find all the recipients - tos, ccs and bccs. Not all systems are that bad but often those doing encrypted from mobile and some of the MS products do this (others create separate mails for each bcc recipient but that is clearly costly for data on mobile especially)
As a contract trainer, I did some work for a training company which neglected to pay the trainers. The owner sent an email wishing us all a happy Christmas and craving our indulgence while the company worked its way through its cash flow problems.
Unfortunately, the owner put us all in the CC list, and one of the others replied to all of us that the owner has a history of bad debts and was never going to pay up. This quickly developed into an impromptu action group as we banded together.
It turned out that the owner had been barred from running a company, and had stolen money to manage his cash flow. He ended up serving time in prison.
We never did get our money, but at least I can say that somebody who foolishly CCed the mailing list ended up in prison, so that should be an object lesson.
I had a brilliant one, not only did a Forklift Truck Training company send out just CC'd with all their customer and supplier database listed, in the ensuing apology a couple of minutes later some bright spark used the original e-mail to profoundly apologise to all the recipients and yes, included all the said customer and suppliers e-mails again. MASSIVE FAIL.
So I come the the comments section to comment on GDPR and/or BCC and end up commenting on interface design.
You think they would hide 'CC' and 'Reply All' in the menu and just use buttons for BCC and Reply single
{note to self :Edit tool bar}
IT appears with regular software update, that IT's not the good stuff being updated but the bad design, bugs, holes and the like. IT will continue far into the future.
I was reading my work emails when a seriously politically incorrect joke appeared in my in box. It had been sent as a reply to all. It was swiftly followed by an Outlook recall but remained in my Outlook web client long enough for me to save it (it was very funny).
Needless to say the individual who sent it departed shortly afterwards.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
