5 ms·
Why do e-mail clients still load images by default? This is not a new attack, or even hard to predict.
by deogeo 7y ago
Why do e-mail clients still load images by default? This is not a new attack, or even hard to predict.
- staunch 7y agoI thought Gmail's solution to this was to always download every image in your email and then proxy the image from their own servers when you view it. This results in a meaningless 100% "open rate" for Gmail and does not reveal an end-user's IP address.
- deleted 7y ago[deleted]
- bduerst 7y agoThis is correct: https://gmail.googleblog.com/2013/12/images-now-showing.html https://gmail.googleblog.com/2013/12/images-now-showing.html
- chimeracoder 7y ago> This is correct: https://gmail.googleblog.com/2013/12/images-now-showing.html https://gmail.googleblog.com/2013/12/images-now-showing.html No, it's wrong. The first time you open the email, the image is retrieved. It's only subsequent views that are cached. So the sender can still see when you read the email; they just can't see how many times you read it afterwards.
- bduerst 7y agoNot quite, the sender still doesn't get location and your browser fingerprint. The receipt of email is still received though.
- chimeracoder 7y ago> Not quite, the sender still doesn't get location and your browser fingerprint. Yes, but the key question was about the open rate. The statement: > I thought Gmail's solution to this was to always download every image in your email and then proxy the image from their own servers when you view it. This results in a meaningless 100% "open rate" for Gmail is incorrect because a) GMail does not always download every image in your email b) GMail does not have a 100% open rate.
- thejohnstone 7y agoYou are right, but do not trust in Gmail, because they like to store your data on their servers!
- concernedctzn 7y agoWhile you're mostly correct, they do not automatically download every image, it only initiates the download when you go to read the email. So they're still letting the sender know when you read the email, but yes they are masking the IP by using their own servers to download it. This can still be disabled if you use the setting to not download images, which is frustratingly unavailable in the gmail for ios app.
- staunch 7y agoAh, okay. I keep meaning to test this out myself. It's unfortunate that Gmail doesn't mask opens entirely.
- jerf 7y agoThey don't necessarily. Thunderbird lately makes me opt-in, or whitelist a particular address if I want. I haven't dug in to ensure that it's 100% rigidly shielded from all possible info leaks (e.g., "blocks img and script but still loads bgsound tags", which is an example of something I've seen before), but it's definitely at least trying to not load by default.
- koolba 7y agoBecause some idiot thought it was a good idea a long time ago and if they turned it off now there would be a widespread user backlash complaining that every non-human written email they receive is just "blank squares with a click to load button".
- slenk 7y agoNot all of them do. Check out FairEmail on Android. It actually shows you the tracking pixels it doesn't load
- harryh 7y agoBecause more and more emails are HTML and not text and loading the images is critical to make the emails actually readable.
- ajmurmann 7y agoThat's mostly true for marketing emails which nobody wants to receive anyways.
- bduerst 7y agoAnd product emails - receipts, product updates that affect you, account status changes, passwords, etc.
- deleted 7y ago[deleted]
- firethief 7y agoI use mutt, and AFAIK I've never missed anything due to it being in rendered into an image instead of included textually in the email. The images are useless static content, not real information rasterized on demand. Sometimes I do get HTML-only emails, but it's usually not hard to find the important stuff, if there is any, among the tags.
- deleted 7y ago[deleted]
- vbsteven 7y agoIt’s not very hard to configure (neo)Mutt to display html only emails with w3m in the terminal. Makes it even easier to parse/read them
- craftyguy 7y agow3m will still fetch external assets, including tracking pixels. You have to use something like socksify to basically cut off network access for w3m.
- paulryanrogers 7y agoApparently big players like Google can preload and cache for others, somewhat mitigating img tracking/attacks. Maybe clients could use Tor to limit the damage when img are needed but not necessarily trusted.
- mathnmusic 7y agoHow would caching work if it is a (uniquely) _tracking_ pixel?
- umeshunni 7y agoThey cache the image when the email is received, not when it is opened.
- mathnmusic 7y agoWhich would break tracking because open-rate would be 100% even if the user is on vacation.
- deleted 7y ago[deleted]
- kabwj 7y agoDesktop email clients I know don’t load images by default, neither does gmail (well it does but it’s proxified) so this is quite literally not an issue