4 ms·

Media queries in email would allow a number of information leaks about how the email is being viewed, which I don't especially like. Allowing external images is

by ryan-c 11y ago

Media queries in email would allow a number of information leaks about how the email is being viewed, which I don't especially like. Allowing external images is already pretty awful.

icebraining 11y ago
Images are much less problematic for Gmail users since they started proxying them[1]. Now the sender can't tell if you opened the email by checking if the image was downloaded. [1] http://arstechnica.com/information-technology/2013/12/gmail-blows-up-e-mail-marketing-by-caching-all-images-on-google-servers/ http://arstechnica.com/information-technology/2013/12/gmail-...
- ryan-c 11y ago
  I was aware of the proxying, but didn't realize that gmail always prefetched the image. This implies that even sending each recipient a unique image URL will not work?
  - icebraining 11y ago
    I believe that's correct - it always fetches the image, so there's no leak.
  - jkturbo 11y ago
    Author here. Gmail does not prefetch the image. Appending a unique image URL will still allow the sender to know when you've opened the email. The proxy eliminates your IP as well as user-agent so the sender can't tell where you are and what you're using to read the email.
    - ocdtrekkie 11y ago
      I was going to argue with you and go get a link to wave in your face. But you're right: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
- scintill76 11y ago
  Huh, I was going to argue that the User-Agent string would probably leak the same data as media queries, but if it's a generic proxy fetching them, then I guess not.
  - icebraining 11y ago
    It's a server-side proxy, no user-agent except whatever the Gmail devs set :)
    - scintill76 11y ago
      Yeah, I guess it could reveal which interface you're using or something, but it is probably static and doesn't reveal anything except maybe that it's Gmail's auto-fetcher.

by ryan-c 11y ago

Media queries in email would allow a number of information leaks about how the email is being viewed, which I don't especially like. Allowing external images is already pretty awful.

icebraining 11y ago

Images are much less problematic for Gmail users since they started proxying them[1]. Now the sender can't tell if you opened the email by checking if the image was downloaded. [1] http://arstechnica.com/information-technology/2013/12/gmail-blows-up-e-mail-marketing-by-caching-all-images-on-google-servers/ http://arstechnica.com/information-technology/2013/12/gmail-...

ryan-c 11y ago
I was aware of the proxying, but didn't realize that gmail always prefetched the image. This implies that even sending each recipient a unique image URL will not work?
- icebraining 11y ago
  I believe that's correct - it always fetches the image, so there's no leak.
- jkturbo 11y ago
  Author here. Gmail does not prefetch the image. Appending a unique image URL will still allow the sender to know when you've opened the email. The proxy eliminates your IP as well as user-agent so the sender can't tell where you are and what you're using to read the email.
  - ocdtrekkie 11y ago
    I was going to argue with you and go get a link to wave in your face. But you're right: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
scintill76 11y ago
Huh, I was going to argue that the User-Agent string would probably leak the same data as media queries, but if it's a generic proxy fetching them, then I guess not.
- icebraining 11y ago
  It's a server-side proxy, no user-agent except whatever the Gmail devs set :)
  - scintill76 11y ago
    Yeah, I guess it could reveal which interface you're using or something, but it is probably static and doesn't reveal anything except maybe that it's Gmail's auto-fetcher.