2 ms·

Just to follow up on this, I currently use Fastmail for email. I like Fastmail, a lot. But why doesn't Fastmail block remote images by default? Yes, they have

Just to follow up on this, I currently use Fastmail for email. I like Fastmail, a lot. But why doesn't Fastmail block remote images by default? Yes, they have a setting, but why isn't it turned on for new accounts? If I tell my parents to sign up for Fastmail, I don't want to have to worry about whether or not their default settings are safe.

troydavis 7y ago
FastMail does block (well, decline to load) remote images by default: https://www.fastmail.com/help/receive/remotecontent.html https://www.fastmail.com/help/receive/remotecontent.html If you aren't using FastMail's webmail, it's your email reader's responsibility. FastMail quite reasonably doesn't rewrite email content.
- danShumway 7y ago
  Is that new? I set up an account maybe a month ago, and when the Superhuman story broke, that was my reminder to check my settings in the webmail client. It was set to load all images. It's possible I would have turned that on by mistake, but only if I really wasn't paying attention. Edit: I just set up a brand new trial account and checked, and the webmail client is definitely set to load remote images by default. If that's not intended, maybe it's a bug that needs to be fixed.
  - troydavis 7y ago
    I'm not sure. I've been a FM customer for years and don't remember what the default was when I signed up, so I'm just trusting their docs.
    - nerdponx 7y ago
      Remote images have always been blocked for me by default in the web client. I've been a customer for a couple years now.
- bigiain 7y ago
  gmail does this too. (which just means you've chose to leak your privacy to Google instead of Superhuman...)
  - danShumway 7y ago
    I'm not a fan of Google, but to me leaking your privacy to a mail provider you chose to sign up for belongs to a different privacy category. It's very good that Gmail proxies images, it's one of the few features that I wish everyone else would copy. Now, on the other side of that, unless their policy has changed since the last time I checked, Gmail still loads images by default and it doesn't cache them, it only proxies them. So it's good that Gmail obscures your IP address, it's bad that Gmail still loads images from remote servers by default when you open a message, and it's bad that it will reload them every time you open it in a new client/environment instead of serving them from a Google cache. Read receipts do work in Gmail, and Google should be shamed for that. I didn't call out Gmail in particular because I don't think Google cares about privacy enough to change anything. I'm hopeful smaller companies like Fastmail might.
    - kbenson 7y ago
      > Read receipts do work in Gmail, and Google should be shamed for that. Work how? There's a responsible way to handle read receipts (where the client notifies you the remote side would like a read receipt, and offers the choice to send it), and if it's done in that manner, I'm not sure why they should need to be shamed. I'm not sure what Gmail does, but I see stuff when searching about how to configure it for G Suite accounts to always/never/selectively respond, and about how to disable Gmail's nagging about it, so I'm not sure the current status.
      - danShumway 7y ago
        > unless their policy has changed since the last time I checked, Gmail still loads images by default and it doesn't cache them, it only proxies them. That's a read receipt, in practice if not in name. I put a unique tracking pixel in the email, and when you open the email by default Google proxies it from my server. It's uncached, so unless the browser itself decides not to re-fetch it, I'll also know whenever you reopen the email. Google also allows you to request a read receipt the responsible, official way that you're thinking of, but why would I ever use that feature when I can just give you a tracking pixel instead? The responsible read receipts require consent, and tracking pixels don't. Again, I haven't checked Gmail's default settings in... probably years. So maybe this has changed, and it doesn't load images by default anymore. But any client that loads images by default has non-consensual read receipts, and they should be shamed for that.
weavie 7y ago
Proton mail blocks by default. Although there is of course nothing to prevent the email sender from putting some relevant or interesting content within an image which would then encourage me to load the remote data..

troydavis 7y ago

FastMail does block (well, decline to load) remote images by default: https://www.fastmail.com/help/receive/remotecontent.html https://www.fastmail.com/help/receive/remotecontent.html If you aren't using FastMail's webmail, it's your email reader's responsibility. FastMail quite reasonably doesn't rewrite email content.

danShumway 7y ago
Is that new? I set up an account maybe a month ago, and when the Superhuman story broke, that was my reminder to check my settings in the webmail client. It was set to load all images. It's possible I would have turned that on by mistake, but only if I really wasn't paying attention. Edit: I just set up a brand new trial account and checked, and the webmail client is definitely set to load remote images by default. If that's not intended, maybe it's a bug that needs to be fixed.
- troydavis 7y ago
  I'm not sure. I've been a FM customer for years and don't remember what the default was when I signed up, so I'm just trusting their docs.
  - nerdponx 7y ago
    Remote images have always been blocked for me by default in the web client. I've been a customer for a couple years now.
bigiain 7y ago
gmail does this too. (which just means you've chose to leak your privacy to Google instead of Superhuman...)
- danShumway 7y ago
  I'm not a fan of Google, but to me leaking your privacy to a mail provider you chose to sign up for belongs to a different privacy category. It's very good that Gmail proxies images, it's one of the few features that I wish everyone else would copy. Now, on the other side of that, unless their policy has changed since the last time I checked, Gmail still loads images by default and it doesn't cache them, it only proxies them. So it's good that Gmail obscures your IP address, it's bad that Gmail still loads images from remote servers by default when you open a message, and it's bad that it will reload them every time you open it in a new client/environment instead of serving them from a Google cache. Read receipts do work in Gmail, and Google should be shamed for that. I didn't call out Gmail in particular because I don't think Google cares about privacy enough to change anything. I'm hopeful smaller companies like Fastmail might.
  - kbenson 7y ago
    > Read receipts do work in Gmail, and Google should be shamed for that. Work how? There's a responsible way to handle read receipts (where the client notifies you the remote side would like a read receipt, and offers the choice to send it), and if it's done in that manner, I'm not sure why they should need to be shamed. I'm not sure what Gmail does, but I see stuff when searching about how to configure it for G Suite accounts to always/never/selectively respond, and about how to disable Gmail's nagging about it, so I'm not sure the current status.
    - danShumway 7y ago
      > unless their policy has changed since the last time I checked, Gmail still loads images by default and it doesn't cache them, it only proxies them. That's a read receipt, in practice if not in name. I put a unique tracking pixel in the email, and when you open the email by default Google proxies it from my server. It's uncached, so unless the browser itself decides not to re-fetch it, I'll also know whenever you reopen the email. Google also allows you to request a read receipt the responsible, official way that you're thinking of, but why would I ever use that feature when I can just give you a tracking pixel instead? The responsible read receipts require consent, and tracking pixels don't. Again, I haven't checked Gmail's default settings in... probably years. So maybe this has changed, and it doesn't load images by default anymore. But any client that loads images by default has non-consensual read receipts, and they should be shamed for that.

weavie 7y ago

Proton mail blocks by default. Although there is of course nothing to prevent the email sender from putting some relevant or interesting content within an image which would then encourage me to load the remote data..