CODEWITHSUNDEEP
phpemailphpmailerprivacybcc
DWilliams
DWilliams

Reputation: 451

Is it a good idea to trust BCC to not reveal other people's addresses?

I'm using PHPMailer to send emails with SMTP from my script. The emails in question are actually cell numbers utilizing email-to-SMS gateways. Now, ideally I want to build up a big BCC list to send everything in one batch instead of looping through a big list of addresses and sending them one at a time.

Should I completely trust BCC functionality to hide other recipient's addresses (which in this case are mostly phone numbers)?

Upvotes: 2

Views: 4575

Answers (8)

Esteban Araya
Esteban Araya

Reputation: 29664

From Wikipedia:

RFC 3864 describes registration procedures for message header fields at the IANA; it provides for permanent and provisional message header field names, including also fields defined for MIME, netnews, and http, and referencing relevant RFCs. Common header fields for email include: Bcc: Blind Carbon Copy; addresses added to the SMTP delivery list but not (usually) listed in the message data, remaining invisible to other recipients.

It's up to you to figure out if you care for "usually".

Upvotes: 0

Luke Stevenson
Luke Stevenson

Reputation: 10341

BCC ("Blind Carbon Copy") should not be visible to any other recipients, and should (in the majority of cases) be secure. Of course, nothing is perfect. If you wanted to be 100% certain that the email addresses remained secure, just create a loop and send a separate email for each of the numbers/addresses individually.

So, instead of:

/* $mailer assumed as PHPMailer Object */
foreach( $recipient as $r ){
  $mailer->AddBCC( $r['emailAddress'] );
}
$mailer->Send();

You could use:

/* $mailer assumed as PHPMailer Object */
foreach( $recipient as $r ){
  $mailer->ClearAllRecipients();
  $mailer->AddAddress( $r['emailAddress'] );
  $mailer->Send();
}

Upvotes: 1

contactmatt
contactmatt

Reputation: 18610

Gmail will show all Bcc addresses.

To see this, open your gmail account, compose a new email to yourself and bcc a fake address (i.e. [email protected])

When you receive the email, click the 'Show Details' button and you'll be able to see the Bcc's. I've used Gmail bcc before...it didn't end well.

Upvotes: 0

Brian Sniffen
Brian Sniffen

Reputation: 234

A number of MTAs will respond to a broken To field by dumping all the BCC addresses into an "Apparently-To" header---not what you want. Sounds like you'd benefit from reading up on SMTP: there are two places where To addresses are set, and they need not be the same. Set the envelope address to what you need, and the data To address to some convenient gibberish.

Upvotes: 4

paxdiablo
paxdiablo

Reputation: 881653

I trust computer software about as far as I can comfortably spit out a rat (attribution required to the excellent "BlackAdder" TV show for that little gem).

If you're worried about it, don't use it. I'm sure people thought their Facebook profiles were safe as well. Not to mention all the credit card numbers that have been released to the wild by supposedly secure sites.

Upvotes: 0

NullUserException
NullUserException

Reputation: 85468

That might be depend on the implementation, but I think that most of them would not reveal emails in a BCC, after all that's what it's meant to do.

There's an easy way to find out, just send an email to yourself, put some addresses in the BCC list and check the raw message to see if you can find the BCC'd emails.

Upvotes: 3

paulsm4
paulsm4

Reputation: 121699

The phone numbers are going out over the wire in clear-text. Whether it's in the "To:" or "Bcc:" line; whether it's one e-mail at a time or the whole batch at once.

So the real questions are: 1. Do you trust your transport (in terms of confidentiality) ... and ... 2. Which is the more efficient method?

Sounds like you probably have no choice about e-mailing the phone#'s ... ... and it also sounds like "send-all-at-once" might be considerably more efficient.

IMHO .. PSM

PS: "On the third hand..." - I don't think the "bcc" phone #'s will ever show up on any recipient's cell phone. So I honestly don't think that's an issue...

Upvotes: 1

Billy ONeal
Billy ONeal

Reputation: 106569

Yes. That is the point of the BCC: field in the first place.

Upvotes: 0

Related Questions