3 ms·

Doesn't Google immediately download any external images/assets in an email and cache them to prevent exactly this?

by Sephr 9y ago

pjmlp 9y ago
You can in any way disable automatic downloads and only see what you actually wish.
gaius 9y ago
It's not for your benefit - you are Google's product, and only they get to milk their own cows.
mike-cardwell 9y ago
It's my understanding that they only download the assets when you first read the message. So it protects your IP address, but it doesn't protect the fact that you read the message. [edit] Yes, I have just confirmed this by using emailprivacytester.com
- gruez 9y ago
  So what you should do is have some sort of script running 24/7 that "reads" your emails the moment it's received.
- Sephr 9y ago
  You're right, I was misremembering the change.
englehardt 9y ago
Gmail's image proxying actually won't help much with this style of tracking. In the paper we found email addresses (or hashes of them) leaking to third parties via a query string parameter in the request URL. So the proxied URL still contains your email address and the third parties can still learn you opened and read the email. As another commenter mentions, we found these requests to occur the moment you first open the email in the Gmail web interface. Since the request URL is unique to you, it can still be used to serve you targeted content. See: https://web.archive.org/web/20170922213846/https://support.liveintent.com/hc/en-us/articles/208828206-Solving-for-Google-Proxy https://web.archive.org/web/20170922213846/https://support.l... Actually I suspect image proxying will also interfere with request blockers like ABP or uBlock Origin, which may have otherwise blocked all requests to that third-party domain.
- voidmain 9y ago
  This is particularly annoying, because if they just cached the image immediately upon receiving the e-mail, there would be no privacy impact AND you would get to see the image. (Yes, it might still send your e-mail address to third parties, but someone who has your e-mail address is free to send it to anyone they want without your help; there is no way to stop that.) I guess we didn't need further evidence that Google cares more about third party marketers than users' privacy.

Doesn't Google immediately download any external images/assets in an email and cache them to prevent exactly this?

by Sephr 9y ago

Doesn't Google immediately download any external images/assets in an email and cache them to prevent exactly this?

pjmlp 9y ago

You can in any way disable automatic downloads and only see what you actually wish.

gaius 9y ago

It's not for your benefit - you are Google's product, and only they get to milk their own cows.

mike-cardwell 9y ago

It's my understanding that they only download the assets when you first read the message. So it protects your IP address, but it doesn't protect the fact that you read the message. [edit] Yes, I have just confirmed this by using emailprivacytester.com

gruez 9y ago
So what you should do is have some sort of script running 24/7 that "reads" your emails the moment it's received.
Sephr 9y ago
You're right, I was misremembering the change.

englehardt 9y ago

Gmail's image proxying actually won't help much with this style of tracking. In the paper we found email addresses (or hashes of them) leaking to third parties via a query string parameter in the request URL. So the proxied URL still contains your email address and the third parties can still learn you opened and read the email. As another commenter mentions, we found these requests to occur the moment you first open the email in the Gmail web interface. Since the request URL is unique to you, it can still be used to serve you targeted content. See: https://web.archive.org/web/20170922213846/https://support.liveintent.com/hc/en-us/articles/208828206-Solving-for-Google-Proxy https://web.archive.org/web/20170922213846/https://support.l... Actually I suspect image proxying will also interfere with request blockers like ABP or uBlock Origin, which may have otherwise blocked all requests to that third-party domain.

voidmain 9y ago
This is particularly annoying, because if they just cached the image immediately upon receiving the e-mail, there would be no privacy impact AND you would get to see the image. (Yes, it might still send your e-mail address to third parties, but someone who has your e-mail address is free to send it to anyone they want without your help; there is no way to stop that.) I guess we didn't need further evidence that Google cares more about third party marketers than users' privacy.