Many people are sending HTML e-mail for no obvious reason or benefit. HTML e-mail can be recognized by colored backgrounds or typefaces. It sometimes has designs or other decorations in the messages. Unfortunately, HTML e-mail is a security risk.

HTML messages can easily contain unwanted, mislabeled links, Web bugs, harmful active content, and outright worms and viruses.

Richard Smith warned of emerging e-mail vulnerabilities in 1999, when he listed dozens of problems related to HTML e-mail. A particularly detailed analysis showed how HTML code in e-mail could allow breaches of privacy using images and cookies:
http://www.computerbytesman.com/privacy/cookleak.htm

Invisible single-pixel images (called Web bugs) can enable this kind of user e-mail tracking without alerting the naïve user because most people don’t examine the HTML code underlying received e-mail messages.

Other vulnerabilities inherent in HTML e-mail include the ability to run Visual Basic scripts, ActiveX controls, and Macromedia flash, all of which can execute unauthorized and unsafe code.

Some organizations and individuals are blocking HTML messages outright. Blocking incoming HTML e-mail is easy because it always includes recognizable strings associated with the HTML underlying the fancy display.

I urge everyone to send plain text instead of HTML as the default format for outgoing e-mail.

If you need to send a message with features beyond text, you can always create a word-processing document and send that. However, you should be aware that when you send a Microsoft Word document, not only are you putting the recipient at risk from embedded macros, but the appearance of your document may be quite different on the recipient’s computer if you do not share the same set of fonts. RTF files typically do not carry macros (although the font problem still exists).

Some recipients prefer a platform-independent format such as an Adobe Acrobat PDF file rather than a platform-specific file such as a Word document; PDF files do not depend on the recipient’s fonts for proper display, and they do not carry Word macros.

So to repeat: set your default format for outbound e-mail from HTML to TEXT in your e-mail client. Here are some hints on how to do that:

* If you are using Netscape Messenger as your client, click Edit | Mail & Newsgroups | Formatting to reach the panel that allows the configuration. Then at the top of the page, in the section labeled, "Message formatting" you can select the lower option, "Use the plain text editor to compose messages." The other section is labeled, "When sending HTML messages to recipients who are not listed as being able to receive them." You can select the second option there, "Convert the message into plain text."

M. E. Kabay, PhD, CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance program at Norwich University.