Blind carbon copy

In the context of correspondence, blind carbon copy (abbreviated Bcc:) refers to the practice of sending a message to multiple recipients in such a way that conceals the fact that there may be additional addressees from the complete list of recipients. This concept originally applied to paper correspondence and now also applies to email. ^[1]

In some circumstances, the typist creating a paper correspondence must ensure that multiple recipients of such a document not see the names of other recipients. To achieve this the typist can:

• Add the names in a second step to each copy, without carbon paper;
• Set the ribbon not to strike the paper, which leaves names off the top copy (but may leave letter impressions on the paper).

With email, recipients of a message are specified using addresses in any of these three fields:

• To: Primary recipients
• Cc: Carbon copy to secondary recipients—other interested parties
• Bcc: Blind carbon copy to tertiary recipients who receive the message. The primary and secondary recipients cannot see the tertiary recipients. The tertiary recipients can only see their own email address in Bcc.

It is common practice to use the Bcc: field when addressing a very long list of recipients, or a list of recipients that should not (necessarily) know each other, e.g. in mailing lists. ^[2]

Contents 1 Benefits 2 Visibility 3 Security considerations 4 Carbon vs Courtesy 5 See also 6 References 7 External links

Benefits

There are a number of reasons for using this feature:

• BCC is often used to prevent an accidental "Reply All" from sending a reply intended for only the originator of the message to the entire recipient list.^[3]
• To send a copy of one's correspondence to a third party (for example, a colleague) when one does not want to let the recipient know that this is being done (or when one does not want the recipient to know the third party's e-mail address, assuming the other recipient is in the To: or Cc: fields).
• To send a message to multiple parties with none of them knowing the other recipients. This can be accomplished by addressing a message to oneself and filling in the actual intended recipients in the Bcc: field. However, this does not ensure that the Bcc: addresses will be hidden from other Bcc: addresses in all implementations.
• To prevent the spread of computer viruses, spam, and malware by avoiding the accumulation of block-list e-mail addresses available to all Bcc: recipients.

Visibility

In most implementations, the recipient of an email can see any email address specified by the Sender in the To: or Cc: fields. If on the other hand the Sender has specified addresses in the Bcc: field, the recipient in this case cannot see these Bcc addresses.

The internet standard for e-mail messages is RFC 2822 and the Bcc: header is discussed in section 3.6.3. It is unclear whether Bcc: is designed to ensure the Bcc: addresses are hidden from each other. On the one hand, it says:

The "BCC:" field (where the "BCC" means "Blind Carbon Copy") contains addresses of recipients of the message whose addresses are not to be revealed to other recipients of the message.

It also states:

There are three ways in which the "BCC:" field is used.

1. In the first case, when a message containing a "BCC:" field is prepared to be sent, the "BCC:" line is removed even though all of the recipients (including those specified in the "BCC:" field) are sent a copy of the message.
2. In the second case, recipients specified in the "To:" and "CC:" lines each are sent a copy of the message with the "BCC:" line removed as above, but the recipients on the "BCC:" line get a separate copy of the message containing a "BCC:" line. (When there are multiple recipient addresses in the "BCC:" field, some implementations actually send a separate copy of the message to each recipient with a "BCC:" containing only the address of that particular recipient.)
3. Finally, since a "BCC:" field may contain no addresses, a "BCC:" field can be sent without any addresses indicating to the recipients that blind copies were sent to someone.

Which method to use with Bcc: fields is implementation dependent and may depend on both one's mail user agent (e.g. Outlook, Thunderbird) and mail submission agent (usually provided by one's ISP).

Since the hiding of the Bcc: addresses from other Bcc: addresses is not required by RFC 2822, one cannot assume the Bcc: addresses will be hidden from other Bcc: addresses.

Security considerations

Both RFC 2821 and RFC 2822 discuss problems with Bcc: in their "Security Consideration" sections, in part because, as mentioned above, the processing for the Bcc: header is not standardized and there are several different ways that it can commonly be implemented.

• RFC 2821 notes that some mail systems will add private headers showing all recipients that the e-mail was sent to, thus leaking the Bcc: list.

• RFC 2822 notes three problems:
  • If the Bcc: header is completely removed, people who receive a blind copy may not notice they are not on either the To: or Cc: and reply to everyone, thus leaking that blind copies were sent.
  • If the Bcc: header is not removed for people being sent a blind copy, then all blind copy recipients will know who got blind copies.
  • If the email addresses on the Bcc: header are removed, but the header is not, this will leak the fact that some blind copies were sent.

• E-mail spam occasionally uses Bcc: to create fake accidental leaks of confidential information, e.g. in a variant of the pump and dump scheme.

Carbon vs Courtesy

The interpretation of "Bcc:" as "blind courtesy copy" is a backronym and not the original meaning; the historic RFC 733 has an explicit "blind carbon" annotation in its definition of the Bcc: header field syntax. "Cc:" and "Bcc:" mean "carbon copy" and "blind carbon copy" respectively.

Sending courtesy copies of mailing list replies also directly to the author(s) of answered message(s) is a common practice on some lists, and matches a new interpretation of "Cc:" as abbreviation for "courtesy copy".

See also

• Carbon copy

References

External links

• US-CERT Cyber Security Tip ST04-008, "Benefits of BCC"
• A good reply to mass mails not using BCC
• Enabling BCC in Microsoft Outlook
• How to use BCC in various programs at wikihow.com