Bug 173428

Please give some examples where hiding your User-Agent is useful.

To avoid displaying your name in your emails, just create another identity. You will be able to select it after clicking on "View/From"

No feedback. Closing.

Strangely, I didn't get the previous mail.

Ok, back to this issue -- creating identity is not a solution because you have to double the number of identities -- soon enough it would be a mess.

And why keeping private data for yourself? Hmm, it it quite obvious -- to make tracking you down (I don't mean any serious stuff, but even at amateur level) a bit more harder for recipient. After all you don't send mail only to your trusted friends, but also companies, mailing lists, etc.

User should have be able to keep his/her privacy -- and send only those data which are technically required to send valid mail. Such countermeasures are present in other apps so I think it is pretty obvious what are the reasons.

> to make tracking you down a bit more harder for recipient.

If you don't want to be tracked down, wouldn't unplugging your Internet connection be easier ? 

Don't forget to turn your phone off and seal your (real) mailbox.


Anyway, identities already allow to do that, adding an option to do the same thing is just useless.

Christophe, next time you answer, please spare me this kind of "irony", ok? KDE has several features to protect privacy -- like clearing personal history, not allowing cookies, etc. The fact you want to go public does not mean everybody likes sharing personal information -- be a more mature and respect that, thank you. 

Back to the identities, let's assume duplicating every identity is a good choice -- where in the identity you can set clearing agent information (example)?

> where in the identity you can set clearing agent information (example)? 

That's very simple : 

- Settings / Configure KMail
- Composer
- Headers tab
- Create a new value with User-Agent as name
- put whatever you want in the value field.

Christophe, I think there is some misunderstanding.

Kmail use scenarios:
-------------------
I have address A, identity A, I send a mail to my friend, no problem. I send mail with some private stuff to my another friend -- I encrypt mail. This is already there.

And ... I send mail to the company, I switch "bare mail". And I wish for that behaviour.

What you described in the comment before would lead to "bare mail always". This is not my wish at all. And besides it has nothing to do with duplicating identities as you suggested before. What's more:
a) it requires technical knowledge from the user
b) it does not provide bare mail feature for real -- if I forget to strip manually my name from the from field

This feature (wish) is indented to be fully automatic and to do the tiresome and errorprone tasks instead of user. 

So, is there a workaround for this wish?

Once again, if you're concerned about your privacy, who you send your emails to is irrelevant : You can't be sure your email recipient doesn't have an active trojan nor that the SMTP servers won't collect some data about your MUA.

In other words, you _can't_ trust anyone.

Also, the RFC 2616 states that the User-Agent "SHOULD" include this field. (section 14.43).

Some paranoid sysadmin may even block invalid User-Agent (that's why posting using a Grabbit client is usually a bad idea).

What I described in comment #6 is a way to change the User-Agent (or add/edit any headers KMail uses).

Let's get back to your wish :

> And ... I send mail to the company, I switch "bare mail". And I wish for that behaviour.

This is what I call View/Identity and choose an alternate identity (which has a false name and a false email address).

About your other points :
a) it requires technical knowledge from the user 

Yes, of course. Changing the MUA fields implies understanding the possible risks and shall only be used by advanced users.

b) it does not provide bare mail feature for real -- if I forget to strip manually my name from the from field

Being concerned about your privacy will force you to check everything several times before sending a mail. If you display the identity field in your mail composer, you can hardly miss it.

> Once again, if you're concerned about your
> privacy, who you send your emails to is irrelevant : 

It is not.

> You can't be 
> sure your email recipient doesn't have an active trojan nor that
> the SMTP servers won't collect some data about your MUA.

Sure. But I am not talking about serious spying but rather amateur level.

For example -- some secretary get my email address and keep sending me (and not only me) spam -- notification of incoming conferences. In order to stop this I have to send "no" as reply. 

It is no problem, but I would like to reply and click "bare mail" so KMail would automatically strip all the not-needed information.

> Also, the RFC 2616 states that the User-Agent "SHOULD" include this
> field. (section 14.43).

See above -- I am not aware of what should be in the mail or not, the same for regular user. User would like to click "bare mail" and trust KMail remove all (technically) not-needed information.

> This is what I call View/Identity and choose an alternate identity
> (which has a false name and a false email address).

It is not a solution -- the mail address is usually known. Again: it is not about conspiracy or something, it is about common-sense, if you need to send "go away" mail it is not needed for recipient to know your mail client, or your first name, or your signature.

> About your other points :
> a) it requires technical knowledge from the user
>
> Yes, of course. Changing the MUA fields implies understanding the
> possible risks and shall only be used by advanced users.

So it is completely contrary to my wish -- this is supposed to be feature for everyone.

> b) it does not provide bare mail feature for real -- if I forget to
> strip manually my name from the from field
>
> Being concerned about your privacy will force you to check
> everything several times before sending a mail. If you display the
> identity field in your mail composer, you can hardly miss it.

I see a big difference between ensuring "bare mail" is on and checking each possible field and knowing which field is required and which is not.

When user signs mail, or encrypts it, it takes just one checkbox to set, user does not have to check all possible fields, check mime is correct, the attachment is really attached, etc.


One remark -- I cannot get it you show such opposition to this idea. When Konqueror have easy to manage privacy features, like enabling/disabling cookies, which also does not require anything more then clicking "yes/no" now all of the sudden in KMail it is more useful to do privacy checks by hand.

> Sure. But I am not talking about serious spying but rather amateur level.

Installing a trojan is something any amateur could do, it doesn't require much skill, just an opportunity.

> For example -- some secretary get my email address and keep sending me (and not only me) spam -- notification of incoming conferences. In order to stop this I have to send "no" as reply

and ? will she delete your email address just because you used a fake identity and sent "no" ?

Selecting "bare mail" button doesn't need more skill than selecting another identity.

> See above -- I am not aware of what should be in the mail or not, the same for regular user.

That's the real issue I think, you have absolutely no idea of what is mandatory and what is optional.

Just a quick thought, the MTA will also add some of your personal informations such as your IP address. If you have to enter a username/password, it may also add your name.


> User would like to click "bare mail" and trust KMail remove all (technically) not-needed information. 

For the moment, only _you_ want that. A normal user doesn't care whether his User-Agent is sent or not.

> It is not a solution -- the mail address is usually known. Again: it is not about conspiracy or something, it is about common-sense, if you need to send "go away" mail it is not needed for recipient to know your mail client, or your first name, or your signature. 

and once again, adding another identity with a fake name, a fake email address is the solution. Unless you ask KMail to add a signature, it won't.
oh, and if your email recipient can not verify that you're the real owner of the spammed email, why would he "go away" ? 

What is common sense is that answering to any spam will just generate even more spam.

> I see a big difference between ensuring "bare mail" is on and checking each possible field and knowing which field is required and which is not. 

Why this is not possible is simple : you can only set up your MUA, you have no control over the MTA which may :
- Reject your User-Agent,
- Reject your domain name,
- Mention your real address/name if you used a fake one and used authentification
- Reject your IP address (see how RBLs do work)
- Reject the FROM: values (if the MTA does some VRFY checking).

In any case, this is not something KMail can guess and it is not his role.

> When user signs mail, or encrypts it, it takes just one checkbox to set

Oh, and it also guess what is your encryption key and if you have several ones associated with your email address it can guess which one to use or you had to configure something before ? 

> One remark -- I cannot get it you show such opposition to this idea. When Konqueror have easy to manage privacy features, like enabling/disabling cookies, which also does not require anything more then clicking "yes/no" now all of the sudden in KMail it is more useful to do privacy checks by hand. 

Congratulations, you discovered why a MUA is not a web browser. BTW, your web browser also sends your IP address and if you use a proxy, the proxy admin may log your activity... scary, isn't it ?


This was my last comment for this bug. I've wasted enough time for it.

> > Sure. But I am not talking about serious spying but rather
> > amateur level.
> Installing a trojan is something any amateur could do, it doesn't
> require much skill, just an opportunity.

So...?

It is my friend responsibility, not mine.

> > For example -- some secretary get my email address and keep
> > sending me (and not only me) spam -- notification of incoming
> > conferences. In order to stop this I have to send "no" as reply
>
> and ? will she delete your email address just because you used a
> fake identity and sent "no" ?

What fake identity? 

> > When user signs mail, or encrypts it, it takes just one checkbox
> > > to set 
> Oh, and it also guess what is your encryption key and if you have
> several ones 
> associated with your email address it can guess which one to use or
> you had to 
> configure something before ?

Yes, once in lifetime. 

Christophe, I asked you before -- spare me your irony, ok? This is not about conspiracy theory, so be a bit more mature and stop bringing this stuff about sealing mailbox, tracing IPs, etc. This is __NOT__ the case!


Once again -- this my typical mailing workflow:
a) I answer to my friends, so my name in the mail is helpful for them
b) I answer to conference invitation ML without adding any personal information (I am not using fake identity because it would be pointless, the mail address has to be same as the address I get mail to)

ad.b) currently I have to delete all the info -- signature, my name by hand. Also when I look at the headers there a lot of information, not directly about me, but about my system

Since I delete all those stuff my hand (not once) it could be automated as well. And the wish is exactly about that -- stripping everything that is not technically needed. That's all -- I am not saying what is needed or what is not, because I don't want to deal with technical details.