5 ms·
What surprises me more is that tracking pixels even work anymore. What email clients don't bother to filter them out?
by microcolonel 7y ago
What surprises me more is that tracking pixels even work anymore. What email clients don't bother to filter them out?
- giancarlostoro 7y agoDo any email clients block tracking pixels? My understanding is that they block images by default but if you choose to view them you will load all the tracking pixels.
- iamacyborg 7y agoArticle author here - Tracking pixels aren't blocked per se in most email clients but you're correct that they rely on images being loaded.
- giancarlostoro 7y agoThanks for answering, it's curious enough that I'm now looking into Thunderbird plugins to see if there's one to block (or try to) tracking pixels.
- microcolonel 7y agoI guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless. I always assumed that disabling 1x1px images would be first on the list of mitigations against this technique. I was under the impression that email clients, in addition to an option to block images in general (usually on by default for an address or origin), generally prevented the loading of remote images. Embedding images directly into emails is fine, isn't it?
- iamacyborg 7y agoDepending on the platform used to send the email, it's trivial to change that pixel to any other image, ie a brand logo in the template. On the whole, disabling images entirely is the only real defence against email tracking.
- microcolonel 7y agoOr I guess the mail server could just always precache all images at the time of receipt. Then nothing new happens when the mail is read. I think somebody here is describing GMail's approach that way.
- iamacyborg 7y agogmail's cache hides a users location but you can still tell when they've opened an email, and you can still get a ton of information if they click a tracked link within the email as well.
- accatyyc 7y agoThen email servers would have to download billions of images of which 99% the corresponding email won't even be opened
- giancarlostoro 7y agoThe easiest way is to disable them by default which is why Thunderbird defaults to not loading from senders not yet whitelisted, which thankfully most HTML email has the text on the email, it's those darn emails that have all the text in an image that I get suspicious of and delete (usually spam / probably malware). It would be nice to see plugins to block them for sure. I use Thunderbird for work, keep forgetting to use it for regular email. At least even webmail email services block pictures by default now, probably to prevent browser exploitation, never know when someone finds some rogue PNG exploit.
- mobjack 7y agoYou can't tell if an image is a 1x1 pixel until you load it from the server. At that point, the pixel has already done its job. Most email clients these days don't block images by default unless it ends up in the spam mailbox. They never embed images directly into emails either.
- dessant 7y agoGmail, among others. Gmail proxies remote content when the email is opened, so the IP address of the user is not disclosed, but the time and number of opens can be tracked. Google could proxy and cache remote content in emails when they are accepted by Gmail servers, and that would render Gmail users untrackable by third-parties.
- sempron64 7y agoThe decision to not cache was a compromise with email marketers after many years. Originally, gmail would not show embedded images by default at all: https://nakedsecurity.sophos.com/2013/12/16/gmail-takes-image-loading-out-of-users-hands-heres-how-to-take-it-back/ https://nakedsecurity.sophos.com/2013/12/16/gmail-takes-imag...
- Nextgrid 7y agoI am surprised that Apple's built-in email clients on both macOS and iOS load remote content by default. One of the first things I disable when I set up a new machine.
- isostatic 7y agoDo they? I've just loaded a gmail email on my phone, it says "This message contains unloaded emails", with an option to load them.
- Shivetya 7y agoWell recently they were used in an underhanded means by the DOJ against a Seal team member they were prosecuting, they did it to his lawyers https://www.theguardian.com/us-news/2019/may/13/navy-seals-lawyers-received-emails-embedded-with-tracking-software https://www.theguardian.com/us-news/2019/may/13/navy-seals-l...