3 ms·
I guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless. I always assumed that d
by microcolonel 7y ago
I guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless.
I always assumed that disabling 1x1px images would be first on the list of mitigations against this technique. I was under the impression that email clients, in addition to an option to block images in general (usually on by default for an address or origin), generally prevented the loading of remote images. Embedding images directly into emails is fine, isn't it?
- iamacyborg 7y agoDepending on the platform used to send the email, it's trivial to change that pixel to any other image, ie a brand logo in the template. On the whole, disabling images entirely is the only real defence against email tracking.
- microcolonel 7y agoOr I guess the mail server could just always precache all images at the time of receipt. Then nothing new happens when the mail is read. I think somebody here is describing GMail's approach that way.
- iamacyborg 7y agogmail's cache hides a users location but you can still tell when they've opened an email, and you can still get a ton of information if they click a tracked link within the email as well.
- accatyyc 7y agoThen email servers would have to download billions of images of which 99% the corresponding email won't even be opened
- giancarlostoro 7y agoThe easiest way is to disable them by default which is why Thunderbird defaults to not loading from senders not yet whitelisted, which thankfully most HTML email has the text on the email, it's those darn emails that have all the text in an image that I get suspicious of and delete (usually spam / probably malware). It would be nice to see plugins to block them for sure. I use Thunderbird for work, keep forgetting to use it for regular email. At least even webmail email services block pictures by default now, probably to prevent browser exploitation, never know when someone finds some rogue PNG exploit.
- mobjack 7y agoYou can't tell if an image is a 1x1 pixel until you load it from the server. At that point, the pixel has already done its job. Most email clients these days don't block images by default unless it ends up in the spam mailbox. They never embed images directly into emails either.
- benjymo 7y agoAt least Thunderbird and Outlook on Mac block images by default and you can whitelist people from your address book.