Outlook Express

From Wikipedia, the free encyclopedia

This article has been nominated to be checked for its neutrality. Discussion of this nomination can be found on the talk page.

Outlook Express
A screenshot of Outlook Express in Windows XP.
Developer:	Microsoft
Latest release:	6.00.2900.2180 / August 3, 2004
OS:	Microsoft Windows (discontinued), Mac OS (unsupported)
Use:	E-mail client, News client
License:	Freeware
Website:	Outlook Express

Outlook Express had e-mail/news client that is included in versions of Microsoft Windows from Windows 95 OSR-2 to Windows XP Service Pack 2 (SP2). It is also bundled with Internet Explorer, and available for the classic Apple Macintosh operating system. Microsoft Entourage, which is sold as part of Microsoft Office for Macintosh, has replaced Outlook Express for Mac OS X.

Outlook Express is the successor of Microsoft Internet Mail and News, an early e-mail client add-on for Internet Explorer 3.0.

In October 2005, Microsoft announced that Windows Vista would include a new application named Windows Mail, based on large parts of Outlook Express source code. Microsoft is also developing Windows Live Mail Desktop, a client for Windows Live services superset of Windows Mail in Windows Vista. It's sometimes seen as a replacement for Outlook Express and Windows Mail.

Contents 1 Description 2 Criticism 2.1 Security issues 2.1.1 Obtaining security fixes 2.2 Handling of PGP/MIME signed messages 2.3 Storage location of e-mail data 2.4 E-mail addresses data 3 Versions and file formats 4 See also 5 External links 5.1 Microsoft 5.2 Other sites

[edit] Description

Outlook Express is a different program from the Microsoft Office Outlook e-mail client which ships with Microsoft Office for Windows. The two programs do not share common code, but do share a common architectural philosophy. The similar names lead many people to incorrectly conclude that Outlook Express is a stripped-down version of Outlook.

This was partially due to the naming scheme Microsoft was using with another free Microsoft product released about the same time (both released as part of the Internet Explorer 4 installer) known as FrontPage Express. Unlike Outlook Express, it did in fact stem from the same code base of another Microsoft Office product with a similar name, known as FrontPage 97.

Windows 95 included Internet Mail and News, a simple precursor to Outlook Express. Internet Mail and News handled plain text and rich text (or RTF) e-mail (not HTML which was a feature that was only seen in the NT version of Microsoft Mail), and had none of the security holes Outlook is known for. However, Microsoft did not provide it with a way to back up the address book except when migrating into a Microsoft Exchange e-mail environment—something that arguably created a great deal of frustration among some early users.

At one point, in a later beta version of Outlook Express 5, Outlook Express contained a sophisticated and adaptive spam filtering system; however this feature was removed shortly before launch. It was speculated on various sites and newsgroups at the time that the feature was not stable enough for the mass market. Nearly two years later, a similar system, using a similar method of adaptive filtering, appeared as a feature of Microsoft's Outlook product line.

Outlook Express has been vulnerable to a number of problems which could corrupt its files. This has led to a thriving market for programs which can backup, restore and recover corrupted OE files. A cursory Web search on the term Outlook Express will reveal dozens of such rescue programs. However, Microsoft has released a procedure for Windows XP which may be able to correct problems and restore access to e-mail messages, without resorting to third party solutions, using their Outlook Express Basic Repair Kit.

[edit] Criticism

[edit] Security issues

Outlook was one of the first^{[citation needed]} e-mail clients to allow a virus in the e-mail body (which is not in an attachment), disseminating e-mail viruses by only opening it. That's because Outlook allowed web pages and executable script as e-mail.

In the "Welcome e-mail" for both Outlook and Outlook Express, Microsoft acknowledged that with new HTML e-mail, security was a risk, and described their plan for foiling the security risk. Outlook Express and Internet Explorer both featured security zones—a feature not found in competing products^{[citation needed]}. The zones were Intranet, Internet, Trusted and Restricted. Internet was for any site not in a zone. Trusted sites could do things without asking the user's permission. The trusted zone was clearly designed for administrators who wanted to allow updating without any confusion. AOL used it to add http://free.aol.com to ensure that users who wanted to download their online service client software didn't have to grant them permission via an ActiveX dialog box. AOL was worried^{[citation needed]} that the warning might scare away potential customers. AOL's action required an Internet Explorer hack that should not have been possible if Microsoft's zones had worked as intended. Rather than the zones being controlled by the user, AOL had shown that remote sites could alter them.

But that was a relatively benign breach due to Microsoft's implementation of the plan. Another flaw was the fact that the "Restricted" security zone wasn't restrictive enough. A script could automatically open as an attachment. Another aggravating factor was a bug in Outlook Express's attachment handling that allowed an executable to appear to be a harmless attachment such as a graphics file. This bug was later fixed so that only the last '.' represented the end of the filename and the beginning of the file extension—the correct behavior for the Windows filesystem. Opening or previewing an e-mail can cause code to run without the user's knowledge or consent. In fact, turning off the preview pane only seemingly circumvents this vulnerability. Even when the preview pane is turned off, Outlook Express automatically "internally" opens the first message in the inbox (see). A host of viruses^{[citation needed]} exploited this.

Outlook Express uses Internet Explorer to render e-mail. So even if users completely avoid use of Internet Explorer and use only other browsers, they are exposed to all its security holes when using Outlook Express. And Internet Explorer is designed to try to execute almost any executable and script it encounters in an effort to make browsing an "easy" experience, which has also enabled it to be the vector of most^{[citation needed]} viruses and other malware.

[edit] Obtaining security fixes

Any security fix acknowledged by Microsoft is handled according to Microsoft's internal security policy, and when necessary, patches are distributed via Microsoft Update. Some minor non-security problems are documented in the knowledge base. Calls to Microsoft's technical support about obtaining patches are free of charge.

On the Macintosh version, Outlook Express uses the Tasman engine, and any support to be had should be found at Mactopia. Microsoft no longer formally supports the product, however.

Secunia's database of security vulnerabilities lists many more flaws (some dating back to 2002) for which Microsoft has not released a patch.

[edit] Handling of PGP/MIME signed messages

Outlook Express doesn't correctly handle MIME, and won't display the body of signed messages inline. Users get a blank e-mail and two attachments (one of the message text and one of the signature) and therefore need to open an attachment to see the e-mail.

[edit] Storage location of e-mail data

If a user has not been backing up Outlook Express periodically, they may find that the program does not permit an easy 'rescue' of data, for example from a hard drive that is accessible but can no longer be used to boot from. For those willing to tinker with files themselves in order to rescue their Inbox and Sent Items, it is useful to know that Outlook Express stores its e-mail files in a location such as the following: "C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Identities\{SDOCE8ABD-5896-3E3D5}\Microsoft\Outlook Express" where '%USERNAME%' is the user's logon ID and the value in curly-brackets {} is an arbitrary string. Corresponding folders should be found on both the new hard drive and the old one. However, simply copying files from old to new may not be ideal.

It may help to first run the new version of Outlook Express, to create some uniquely-named folders within Outlook Express, e.g. 'Rescued Inbox'. (Be sure to click on the new folder to actually force the program to create the file 'Rescued Inbox.dbx'.) Then quit Outlook Express, find the old inbox on the old hard drive and rename it 'Rescued Inbox.dbx', and finally copy it over to replace the newly-formed 'Rescued Inbox.dbx' on your new hard drive. This prevents loss of any new e-mails, and also ensures that the new version 'knows' about the rescued e-mails being copied over.

With latest patches applied Outlook Express makes backup copies of dbx files prior to compaction. They are stored in Recycle bin. When an error occurs during compaction and messages are lost dbx files can bye easily restored.

[edit] E-mail addresses data

Outlook Express does not store its own e-mail address list. Instead it relies on the Windows Address Book, which is actually a component of Windows. The address book data are typically found (in NT-based versions of Windows) at "C:\Documents and Settings\%USERNAME%\Application Data\Microsoft\Address Book\".

[edit] Versions and file formats

Outlook Express stores its e-mail messages in different formats depending on the version.

• Outlook Express 4.0, which was included in Windows 98 (June 1998), stored messages in *.mbx files (similar to the MBox format used in UNIX based systems).
• Outlook Express 5.0, which was included in Windows 98 Second Edition (SE) (June 1999), switched to *.dbx files, with a separate file for each mailbox folder.
• Outlook Express 5.0 was included in Windows 2000 (February 2000).
• Outlook Express 5.5 was included in Windows Me (June 2000).
• Outlook Express 6.0 was included in Windows XP (October 2001).

[edit] See also

• Windows Address Book
• Microsoft Internet Mail and News
• Windows Mail
• Windows Live Mail Desktop
• List of news clients
• Comparison of e-mail clients
• Commercial library providing API for Outlook Express

[edit] External links

[edit] Microsoft

• Outlook Express home page for Windows
• Outlook Express home page for Macintosh
• Differences between Outlook and Outlook Express, from the Microsoft knowledge base
• How to manually remove and reinstall Outlook Express

[edit] Other sites

• Inside Outlook Express Help, tips, FAQs and technical information to help you use, understand, and repair Outlook Express.
• Outlook Express Tips Avoiding viruses, spam and quicker usage of Outlook Express.
• Secunia commercial security firm compares the latest unpatched known flaws of Outlook Express with those of other e-mail clients
• Outlook Express API article article giving an introduction about how to use some of the Outlook Express API.