7 ms·

EmailOracle (YC W10) Tracks Your Emails and Confirms They've Been Opened

78 points by cominatchu 16y ago

ig1 16y ago
Don't most email clients (both web and desktop based) block images loading by default to specifically stop this kind of tracking ? I recall spammers using precisely this technique with early html supporting email clients in the late '90s to validate email accounts.
- ulf 16y ago
  I would suspect people to be far more liberal with the "Always display images in emails from ..." if they know the sender personally. But still an important objection, since it obviously breaks the process...
- NathanKP 16y ago
  Anyone who is concerned about security and tracking will leave images blocked by default, but most average people will turn image blocking off so that they can see the pictures in whatever trashy chain email is making the rounds. The don't realize that this allows spammers to track whether or not the email address is live, they just think that it saves them from having to click "Show All Images".
eli 16y ago
Gonna have a pretty high false negative rate though, right? Virtually all modern email programs and webmail systems block images by default (unless the sender has been marked as "safe" or sometimes if they've been added to your address book). You might as well steal some of the (very clever) tricks used here: http://litmus.com/email-analytics http://litmus.com/email-analytics to track whether the messages was forwarded and the time spent reading. They don't work all the time, but it's a pretty neat piece of code.
- NathanKP 16y ago
  Just from looking at the litmus site I can't tell what "very clever" tricks they use, and I don't want to spend money signing up to find out. Thinking off the top of my head, perhaps they could be requesting a CSS stylesheet or an CSS3 font from their server to track reads without using an image. But that is all I can think of right now. Could you tell me more about the "clever tricks" they use Eli? Edit: I just thought of another trick: using the background-image or list-style-image CSS property to request an image from your own server. I found a chart that shows CSS support in major email services. Gmail looks like it would be the hardest to implement tracking in. In many other email clients it would be trivially easy: http://www.campaignmonitor.com/downloads/documents-tools/Campaign_Monitor_Guide_to_CSS_Support_in_Email_April_2010.pdf http://www.campaignmonitor.com/downloads/documents-tools/Cam...
  - anthony_franco 16y ago
    They generate a unique image for each email and track when the image has been accessed. As others have mentioned, many email clients automatically block image downloads by default. So this way of tracking, at first glance, seems pretty limited.
    - NathanKP 16y ago
      Right. I was trying to think of clever tricks to get around image blocking. Some techniques, such as list-style-image look like they can get around most email services.
  - eli 16y ago
    I'm not actually sure they did much better than a regular image for tracking opens though I believe they also did a background-image. The clever bit was using some CSS with a background image to track the message being forwarded (outlook adds some predictable CSS class names to the message when it reformats it for forwarding) and the use of an image resource that never actually loads, but does a sleep/redirect loop so it can track how long the message has been open (assuming images aren't blocked in the first place). Also another CSS directive to see when the message is being printed. At least, that's what I remember when I disassembled the code some months ago. If I can dig it up when I'm back in the office, I'll post it. Though I think you have a much better chance of getting people to load images in a newsletter or marketing message where that's the norm versus a personal message where it might seem weird or unnecessary.
thingie 16y ago
I usually consider emails with some kind of read-receipt requests or (even worse) tracking images (which fortunately gets blocked in any decent email client) at least very rude.
- city41 16y ago
  I agree it's rude. If I received what would otherwise be a text email from a client/coworker/etc except now my mail client is saying "Images have not been downloaded", I'd get a little suspicious.
  - eli 16y ago
    I'd probably assume it's a stupid email signature and ignore it. Either way, it doesn't help the sender much. I remember noticing an image bug in a resume a web designer sent me once. I thought it was a bit tacky.
- cominatchu 16y ago
  To help alleviate this concern there is opt-out for emails received from free EmailOracle accounts (there is a link at the bottom of the email that says "Metrics by EmailOracle, click here to opt-out").
  - fhars 16y ago
    That is too late. Collecting data like this is only legitimate (or, if the reciever is european, legal) if the collection only ever starts after the collecting party has recieved a qualified declaration of consent from the reciever of the bugged mail. If they don't get this consent before sending the mail, they are just scum.
- emailoracle 16y ago
  What EmailOracle does is to enable prosumers with the ability to deal with outgoing email overload. We are a business tool and we have studies that show that this is a feature that is well-received and well-intentioned in enterprise communication. This is also evidenced in how MS Outlook provides read-receipts for their emails, and Blackberry messages that also automatically do read-tracking. Makers of a kitchen knives cannot really prevent customers from using the tool for nefarious purposes. We do our best to preserve the privacy of recipients and allow opting out as well.
timdorr 16y ago
The website mentions nothing of pricing. That's a little off-putting because it either suggests to me there is a hidden charge or they are doing something nefarious with access to my email account (like reading my email to send me targeted spam or something like that).
- gbelote 16y ago
  Once you sign up you can find an upgrade page: http://img.skitch.com/20101011-jgpkhbquapptemp64ggajwhuxx.png http://img.skitch.com/20101011-jgpkhbquapptemp64ggajwhuxx.pn...
  - emailoracle 16y ago
    Thanks Greg! Yes, we have the pricing table shown once you login.
- deleted 16y ago
  [deleted]
knuckle_cake 16y ago
I recall a similar service a few years back which went a step further and encoded the text into an image, which allowed the sender to revoke the entire message at a later time. Google is not finding anything; maybe it's gone now.
- anthony_franco 16y ago
  I think there are a few. BigString was the most popular I heard about.
  - pavel_lishin 16y ago
    > Until now, you’ve been the person with the least control over your emails because, after you send them, they can be stored and scanned in more places than you can imagine. Do you want anyone to permanently store your messages? Do you want your words to possibly live in infamy without your knowledge? Um, isn't that kind of an accepted risk when giving someone something? This whole thing sounds very fishy to me, actually. How does it work? Their about page is very very vague, and uses some double-talk to make your message seem incredibly secure (specifically, the hard-to-print FAQ entry: http://www.bigstring.com/info/faqs/answers/printed.php http://www.bigstring.com/info/faqs/answers/printed.php)
anonymous245 16y ago
Somebody please write a blocker for this. Do we need something special, or can we just add some rules to AdBlock Plus to work around these antisocials? Good job funding this garbage, PG.
- cominatchu 16y ago
  I'm sorry you feel this way. You can opt-out of emails sent to you from free EmailOracle accounts. Maybe we should add to our website the ability to automatically opt-out of all future tracking?
  - bobds 16y ago
    A pre-emptive opt-out could work, but how exactly would you implement it? Do I have to give you all my email addresses that I want to opt-out with? Do I have to get an "optout" cookie so that the server with the tracking pixels and whatnot knows not to track me? I think I'd rather block this at the email client level. This way I don't have to trust anyone's optout procedures, as well as being protected from any nefarious trackers that don't care about things such as opting-out.
    - emailoracle 16y ago
      Yes, users are free to still continue whatever means they have used in the past to opt-out, including at the client level. We don't (and can't) prevent any of that.
      - bobds 16y ago
        Of course you can't prevent it, however one of your application's goals is to work around email client filters that would block traditional tracking methods. Just to be clear, I have no problem with what you are doing. I would like to know if blocking images is enough to not be tracked. Do email clients have sufficient image blocking or do they let through images specified in CSS (or similar) through?
  - fhars 16y ago
yellowbkpk 16y ago
It appears that one of the features this site offers is the ability to find e-mails you've sent that need followup because they haven't been responded to. I'd love to have that feature built into Gmail (and it seems like something very doable). Does anyone have a search/filter setup that allows you to find these "need to followup" e-mails?
- cominatchu 16y ago
  EmailOracle does build this feature right into Gmail :) It adds a link in the left panel of Gmail (under "Contacts") that lets you open up a new pane (just like the "Tasks" pane) that contains all of your emails needing follow-up.
anon-e-moose 16y ago
As others have pointed out, Gmail and other mail clients are designed to specifically block this kind of thing. How is an apparently viable business based on such a non-platform?
- emailoracle 16y ago
  Open-rate tracking is only one of the features we are providing with EmailOracle, and we see many other business opportunities in this space.
jesspugsley 16y ago
All I see when I read about this tool is the forthcoming lawsuit from Oracle.
- expertcs 16y ago
  I think that is why they have kept it. It will give them insanely high publicity. Moreover, I think they might be able to keep it too. It's not like Oracle sued Matrix team for having an Oracle. :) Also, to the people who are saying images are not displayed in most of the email clients, browsers, don't forget smartphones where there is no option of blocking images.
  - jbail 16y ago
    Gmail on my smartphone (running Froyo) doesn't load images. In fact it has a "Show pictures" button which I must explicitly press to load images.
    - mike-cardwell 16y ago
      Android 1.6 on my G1 loads the following content before I click "Show Pictures": iframes inline css style tags with an @import option. external css style tags object embed tags It also honours meta refresh tags and opens the standard web browser entire automatically just by viewing the email. Can you please test Froyo using my app at https://secure.grepular.com/email_privacy_tester/ https://secure.grepular.com/email_privacy_tester/ I'd be interested to know if all of these flaws still exist in newer versions of Android...
      - jbail 16y ago
        Just submitted to test. Should I get an email?
        mike-cardwell 16y ago
        You should, unless your spam filter blocks it...?
apfan 16y ago
So what'll be the next yc-funded company? shoecam.com: take unobtrusive upskirt shots without being found out?
andrewf 16y ago
If anyone wanted to burn their relationship with me, spying on what most would consider to be unwatched activity, involving something as specific and interpersonal as email, would be a pretty good way. It's just... creepy. If you have a legal need to make sure I've received something, use registered post.
- tomjen3 16y ago
  Spying on people is rude, but you do know that there are at least 4 intelligence agencies from various countries between you and your recipient right?
edanm 16y ago
Reading this was very surprising for me, because I'd always assumed this kind of thing was impossible. After going over the comments here, there is apparently a (well known) trick of adding images to email, then tracking hits for that image on your server, thus giving you "email analytics". Apparently this is one of the reasons that most email programs block images by default. In fact, I've long wondered why images are blocked by default, and only now found out. Always amazes me how many things I have yet to learn!
shimon 16y ago
Seems almost identical to this company (from a previous YC round, I think): https://etacts.com/ https://etacts.com/ I really like the idea of an "expect followup with in N days" feature for GMail. It's interesting that GMail's dominance as a client for heavy email users has accidentally enabled a market of add-ons delivered as browser extensions.
towndrunk 16y ago
What a terrible name for the company. When I first read the title I thought "Email Oracle? Why would would I do that?". Not to mention Oracle will probably make claims to it.
thraxil 16y ago
As a diehard mutt user, I wish them the best of luck.
deleted 16y ago
[deleted]
johngalt 16y ago
I'd rather have a "successful delivery response". It's enough to know that the email was delivered to a device you are responsible for. Tracking who's opening it and when seems a little creepy, also you'll have false positives if the email is blind forwarded. Having worked with attorney's. "I didn't get the email" is common. I'd like just to have a list of the response codes from their server to prove that they accepted delivery.
scalyweb 16y ago
A visually attractive site and sounds like a great plugin! But quickly looking through the site...who are you? DNS records show private whois...GoDaddy's Domain By Proxy service. I'm logging in by giving my Gmail or GoogleApp credentials but is this through OpenID? Is there a terms of service before I do this? If you were a known entity I'm sure I would be quite a bit more forgiving. Also, I saw a previous comment here by Tim about no visible pricing info by Tim...why should I have to login just to see what is required for an upgrade? I'm interested but too many reasons for hesitation has me clicking away...
qeorge 16y ago
This could be really useful for e-commerce apps that deliver critical information via email, e.g., product keys or download links.
heresy 16y ago
Forwarded this to our network guys for blocking at the source, cheers.
malbiniak 16y ago
wow, well at least you know who your customers are NOT. don't let it discourage you. i, for one, am looking forward to incorporating this into my workflow.
chris_l 16y ago
That service working without the recipient changing his settings is by definition a security hole in the email app.

78 points by cominatchu 16y ago

ig1 16y ago

Don't most email clients (both web and desktop based) block images loading by default to specifically stop this kind of tracking ? I recall spammers using precisely this technique with early html supporting email clients in the late '90s to validate email accounts.

ulf 16y ago
I would suspect people to be far more liberal with the "Always display images in emails from ..." if they know the sender personally. But still an important objection, since it obviously breaks the process...
NathanKP 16y ago
Anyone who is concerned about security and tracking will leave images blocked by default, but most average people will turn image blocking off so that they can see the pictures in whatever trashy chain email is making the rounds. The don't realize that this allows spammers to track whether or not the email address is live, they just think that it saves them from having to click "Show All Images".

eli 16y ago

Gonna have a pretty high false negative rate though, right? Virtually all modern email programs and webmail systems block images by default (unless the sender has been marked as "safe" or sometimes if they've been added to your address book). You might as well steal some of the (very clever) tricks used here: http://litmus.com/email-analytics http://litmus.com/email-analytics to track whether the messages was forwarded and the time spent reading. They don't work all the time, but it's a pretty neat piece of code.

NathanKP 16y ago
Just from looking at the litmus site I can't tell what "very clever" tricks they use, and I don't want to spend money signing up to find out. Thinking off the top of my head, perhaps they could be requesting a CSS stylesheet or an CSS3 font from their server to track reads without using an image. But that is all I can think of right now. Could you tell me more about the "clever tricks" they use Eli? Edit: I just thought of another trick: using the background-image or list-style-image CSS property to request an image from your own server. I found a chart that shows CSS support in major email services. Gmail looks like it would be the hardest to implement tracking in. In many other email clients it would be trivially easy: http://www.campaignmonitor.com/downloads/documents-tools/Campaign_Monitor_Guide_to_CSS_Support_in_Email_April_2010.pdf http://www.campaignmonitor.com/downloads/documents-tools/Cam...
- anthony_franco 16y ago
  They generate a unique image for each email and track when the image has been accessed. As others have mentioned, many email clients automatically block image downloads by default. So this way of tracking, at first glance, seems pretty limited.
  - NathanKP 16y ago
    Right. I was trying to think of clever tricks to get around image blocking. Some techniques, such as list-style-image look like they can get around most email services.
- eli 16y ago
  I'm not actually sure they did much better than a regular image for tracking opens though I believe they also did a background-image. The clever bit was using some CSS with a background image to track the message being forwarded (outlook adds some predictable CSS class names to the message when it reformats it for forwarding) and the use of an image resource that never actually loads, but does a sleep/redirect loop so it can track how long the message has been open (assuming images aren't blocked in the first place). Also another CSS directive to see when the message is being printed. At least, that's what I remember when I disassembled the code some months ago. If I can dig it up when I'm back in the office, I'll post it. Though I think you have a much better chance of getting people to load images in a newsletter or marketing message where that's the norm versus a personal message where it might seem weird or unnecessary.

thingie 16y ago

I usually consider emails with some kind of read-receipt requests or (even worse) tracking images (which fortunately gets blocked in any decent email client) at least very rude.

city41 16y ago
I agree it's rude. If I received what would otherwise be a text email from a client/coworker/etc except now my mail client is saying "Images have not been downloaded", I'd get a little suspicious.
- eli 16y ago
  I'd probably assume it's a stupid email signature and ignore it. Either way, it doesn't help the sender much. I remember noticing an image bug in a resume a web designer sent me once. I thought it was a bit tacky.
cominatchu 16y ago
To help alleviate this concern there is opt-out for emails received from free EmailOracle accounts (there is a link at the bottom of the email that says "Metrics by EmailOracle, click here to opt-out").
- fhars 16y ago
  That is too late. Collecting data like this is only legitimate (or, if the reciever is european, legal) if the collection only ever starts after the collecting party has recieved a qualified declaration of consent from the reciever of the bugged mail. If they don't get this consent before sending the mail, they are just scum.
emailoracle 16y ago
What EmailOracle does is to enable prosumers with the ability to deal with outgoing email overload. We are a business tool and we have studies that show that this is a feature that is well-received and well-intentioned in enterprise communication. This is also evidenced in how MS Outlook provides read-receipts for their emails, and Blackberry messages that also automatically do read-tracking. Makers of a kitchen knives cannot really prevent customers from using the tool for nefarious purposes. We do our best to preserve the privacy of recipients and allow opting out as well.

timdorr 16y ago

The website mentions nothing of pricing. That's a little off-putting because it either suggests to me there is a hidden charge or they are doing something nefarious with access to my email account (like reading my email to send me targeted spam or something like that).

gbelote 16y ago
Once you sign up you can find an upgrade page: http://img.skitch.com/20101011-jgpkhbquapptemp64ggajwhuxx.png http://img.skitch.com/20101011-jgpkhbquapptemp64ggajwhuxx.pn...
- emailoracle 16y ago
  Thanks Greg! Yes, we have the pricing table shown once you login.
deleted 16y ago
[deleted]

knuckle_cake 16y ago

I recall a similar service a few years back which went a step further and encoded the text into an image, which allowed the sender to revoke the entire message at a later time. Google is not finding anything; maybe it's gone now.

anthony_franco 16y ago
I think there are a few. BigString was the most popular I heard about.
- pavel_lishin 16y ago
  > Until now, you’ve been the person with the least control over your emails because, after you send them, they can be stored and scanned in more places than you can imagine. Do you want anyone to permanently store your messages? Do you want your words to possibly live in infamy without your knowledge? Um, isn't that kind of an accepted risk when giving someone something? This whole thing sounds very fishy to me, actually. How does it work? Their about page is very very vague, and uses some double-talk to make your message seem incredibly secure (specifically, the hard-to-print FAQ entry: http://www.bigstring.com/info/faqs/answers/printed.php http://www.bigstring.com/info/faqs/answers/printed.php)

anonymous245 16y ago

Somebody please write a blocker for this. Do we need something special, or can we just add some rules to AdBlock Plus to work around these antisocials? Good job funding this garbage, PG.

cominatchu 16y ago
I'm sorry you feel this way. You can opt-out of emails sent to you from free EmailOracle accounts. Maybe we should add to our website the ability to automatically opt-out of all future tracking?
- bobds 16y ago
  A pre-emptive opt-out could work, but how exactly would you implement it? Do I have to give you all my email addresses that I want to opt-out with? Do I have to get an "optout" cookie so that the server with the tracking pixels and whatnot knows not to track me? I think I'd rather block this at the email client level. This way I don't have to trust anyone's optout procedures, as well as being protected from any nefarious trackers that don't care about things such as opting-out.
  - emailoracle 16y ago
    Yes, users are free to still continue whatever means they have used in the past to opt-out, including at the client level. We don't (and can't) prevent any of that.
    - bobds 16y ago
      Of course you can't prevent it, however one of your application's goals is to work around email client filters that would block traditional tracking methods. Just to be clear, I have no problem with what you are doing. I would like to know if blocking images is enough to not be tracked. Do email clients have sufficient image blocking or do they let through images specified in CSS (or similar) through?
- fhars 16y ago

yellowbkpk 16y ago

It appears that one of the features this site offers is the ability to find e-mails you've sent that need followup because they haven't been responded to. I'd love to have that feature built into Gmail (and it seems like something very doable). Does anyone have a search/filter setup that allows you to find these "need to followup" e-mails?

cominatchu 16y ago
EmailOracle does build this feature right into Gmail :) It adds a link in the left panel of Gmail (under "Contacts") that lets you open up a new pane (just like the "Tasks" pane) that contains all of your emails needing follow-up.

anon-e-moose 16y ago

As others have pointed out, Gmail and other mail clients are designed to specifically block this kind of thing. How is an apparently viable business based on such a non-platform?

emailoracle 16y ago
Open-rate tracking is only one of the features we are providing with EmailOracle, and we see many other business opportunities in this space.

jesspugsley 16y ago

All I see when I read about this tool is the forthcoming lawsuit from Oracle.

expertcs 16y ago
I think that is why they have kept it. It will give them insanely high publicity. Moreover, I think they might be able to keep it too. It's not like Oracle sued Matrix team for having an Oracle. :) Also, to the people who are saying images are not displayed in most of the email clients, browsers, don't forget smartphones where there is no option of blocking images.
- jbail 16y ago
  Gmail on my smartphone (running Froyo) doesn't load images. In fact it has a "Show pictures" button which I must explicitly press to load images.
  - mike-cardwell 16y ago
    Android 1.6 on my G1 loads the following content before I click "Show Pictures": iframes inline css style tags with an @import option. external css style tags object embed tags It also honours meta refresh tags and opens the standard web browser entire automatically just by viewing the email. Can you please test Froyo using my app at https://secure.grepular.com/email_privacy_tester/ https://secure.grepular.com/email_privacy_tester/ I'd be interested to know if all of these flaws still exist in newer versions of Android...
    - jbail 16y ago
      Just submitted to test. Should I get an email?
      - mike-cardwell 16y ago
        You should, unless your spam filter blocks it...?

apfan 16y ago

So what'll be the next yc-funded company? shoecam.com: take unobtrusive upskirt shots without being found out?

andrewf 16y ago

If anyone wanted to burn their relationship with me, spying on what most would consider to be unwatched activity, involving something as specific and interpersonal as email, would be a pretty good way. It's just... creepy. If you have a legal need to make sure I've received something, use registered post.

tomjen3 16y ago
Spying on people is rude, but you do know that there are at least 4 intelligence agencies from various countries between you and your recipient right?

edanm 16y ago

Reading this was very surprising for me, because I'd always assumed this kind of thing was impossible. After going over the comments here, there is apparently a (well known) trick of adding images to email, then tracking hits for that image on your server, thus giving you "email analytics". Apparently this is one of the reasons that most email programs block images by default. In fact, I've long wondered why images are blocked by default, and only now found out. Always amazes me how many things I have yet to learn!

shimon 16y ago

Seems almost identical to this company (from a previous YC round, I think): https://etacts.com/ https://etacts.com/ I really like the idea of an "expect followup with in N days" feature for GMail. It's interesting that GMail's dominance as a client for heavy email users has accidentally enabled a market of add-ons delivered as browser extensions.

towndrunk 16y ago

What a terrible name for the company. When I first read the title I thought "Email Oracle? Why would would I do that?". Not to mention Oracle will probably make claims to it.

thraxil 16y ago

As a diehard mutt user, I wish them the best of luck.

deleted 16y ago

[deleted]

johngalt 16y ago

I'd rather have a "successful delivery response". It's enough to know that the email was delivered to a device you are responsible for. Tracking who's opening it and when seems a little creepy, also you'll have false positives if the email is blind forwarded. Having worked with attorney's. "I didn't get the email" is common. I'd like just to have a list of the response codes from their server to prove that they accepted delivery.

scalyweb 16y ago

A visually attractive site and sounds like a great plugin! But quickly looking through the site...who are you? DNS records show private whois...GoDaddy's Domain By Proxy service. I'm logging in by giving my Gmail or GoogleApp credentials but is this through OpenID? Is there a terms of service before I do this? If you were a known entity I'm sure I would be quite a bit more forgiving. Also, I saw a previous comment here by Tim about no visible pricing info by Tim...why should I have to login just to see what is required for an upgrade? I'm interested but too many reasons for hesitation has me clicking away...

qeorge 16y ago

This could be really useful for e-commerce apps that deliver critical information via email, e.g., product keys or download links.

heresy 16y ago

Forwarded this to our network guys for blocking at the source, cheers.

malbiniak 16y ago

wow, well at least you know who your customers are NOT. don't let it discourage you. i, for one, am looking forward to incorporating this into my workflow.

chris_l 16y ago

That service working without the recipient changing his settings is by definition a security hole in the email app.