4 ms·

What can be done with this information? Most companies have e-mail addresses that are completely predictable, so you can pretty much assume that this e-mail ad

What can be done with this information? Most companies have e-mail addresses that are completely predictable, so you can pretty much assume that this e-mail address exists. If this really was a security risk shouldn't you have UUID emails for everyone? Also how do you as an attacker know that it was user not a e-mail server checking those images?

chrisseaton 6y ago
> What can be done with this information? It will reveal if they're working right now, what time they work otherwise, their IP address, their approximate physical location, their internet provider. A lot you can do with that. > Most companies have e-mail addresses that are completely predictable That's the point. Predict an email address, send it, find out if such a person works there. If I email unusual.name@sis.gov.uk and they open it then guess what I've worked out? > Also how do you as an attacker know that it was user not a e-mail server checking those images? Agent signatures.
- pbowyer 6y ago
  >> Also how do you as an attacker know that it was user not a e-mail server checking those images? > Agent signatures. Can you Expand? Googling isn't helping me understand what this means/how it works.
  - eganist 6y ago
    The "user agent string" of the email client is different from that of the user's browser.
  - chrisseaton 6y ago
    Also called agent fingerprinting. You can look at exactly how the agent is responding and make educated guesses at what agent it is. You think one HTTP request looks like any other, but there's enough little bits of information here and there to leak info. The user agent is the simplest example. That can be spoofed, but there's more subtle traces as well, all the way down the stack https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting.
    - pbowyer 6y ago
      Thanks!
- mewpmewp2 6y ago
  I mean you can just get employees from LinkedIn and already know their e-mail addresses with high certainty and know when they work by the timezones. If this information was abusable, why is it so easy to guess in the first place and why is it not actionable then? It would be arbitrary to have the image links switched out by the server so they always go through a proxy/urldefense and it would never be the user ip address or user agent the attacker sees. I would assume a company like Gitlab would have such measures if this info was indeed abusable.
  - chrisseaton 6y ago
    > I mean you can just get employees from LinkedIn and already know their e-mail addresses with high certainty and know when they work by the timezones. Do you put your IP number on LinkedIn? When you travel do you put the hotel you're staying in on LinkedIn? Also, not everyone is on LinkedIn in the first place. > It would be arbitrary to have the image links switched out by the server so they always go through a proxy/urldefense and it would never be the user ip address or user agent the attacker sees. The word 'arbitrary' doesn't make any sense to me in this context so not sure what you mean sorry. In general, I don't know what you're trying to say - that there are ways to try to defend against these attacks? Yeah I know. I'm not sure what point of mine you're refuting or replying to anymore. You asked 'What can be done with this information?' - this is the list of things you can do with that information. Can you defend against some of it? Yes to some extent. But it still leaks for many people.
    - mewpmewp2 6y ago
      What I am trying to say is that someone opening an e-mail should not be considered a failure. You can't expect people not to do this. All of this can be avoided if you just use some service to proxy the images. So the IP would not be leaked because the proxy server is fetching the image and it could easily be doing this no matter what and even if it determines the message to be spam and user might not even see the e-mail.
    - msla 6y ago
      > Do you put your IP number on LinkedIn? Which companies own which IP address blocks is public information. > When you travel do you put the hotel you're staying in on LinkedIn? Conferences are announced; advertised, even. > Also, not everyone is on LinkedIn in the first place. That's OK, companies do a fine job publishing employee information all on their own. > You asked 'What can be done with this information?' - this is the list of things you can do with that information. You've moved from Step A, getting the information to Step B, correlating the information, but you've left off Step C, which is profiting from the information. What is a benefit you can gain from knowing someone at some IP address opened your email? Can you get that benefit some other way, such as by looking in a phone book or viewing the company's website?
- BenjiWiebe 6y ago
  Thunderbird blocks remote content from non-contact email. Is that not standard behavior? It prevents someone from knowing when you've opened their email.
Kalium 6y ago
> What can be done with this information? Now you know who's curious enough to open a shady-looking email, and perhaps click a link out of curiosity. It means your list for the next round of attacks is much smaller and more targeted, making it easier to evade detection.

chrisseaton 6y ago

> What can be done with this information? It will reveal if they're working right now, what time they work otherwise, their IP address, their approximate physical location, their internet provider. A lot you can do with that. > Most companies have e-mail addresses that are completely predictable That's the point. Predict an email address, send it, find out if such a person works there. If I email unusual.name@sis.gov.uk and they open it then guess what I've worked out? > Also how do you as an attacker know that it was user not a e-mail server checking those images? Agent signatures.

pbowyer 6y ago
>> Also how do you as an attacker know that it was user not a e-mail server checking those images? > Agent signatures. Can you Expand? Googling isn't helping me understand what this means/how it works.
- eganist 6y ago
  The "user agent string" of the email client is different from that of the user's browser.
- chrisseaton 6y ago
  Also called agent fingerprinting. You can look at exactly how the agent is responding and make educated guesses at what agent it is. You think one HTTP request looks like any other, but there's enough little bits of information here and there to leak info. The user agent is the simplest example. That can be spoofed, but there's more subtle traces as well, all the way down the stack https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting.
  - pbowyer 6y ago
    Thanks!
mewpmewp2 6y ago
I mean you can just get employees from LinkedIn and already know their e-mail addresses with high certainty and know when they work by the timezones. If this information was abusable, why is it so easy to guess in the first place and why is it not actionable then? It would be arbitrary to have the image links switched out by the server so they always go through a proxy/urldefense and it would never be the user ip address or user agent the attacker sees. I would assume a company like Gitlab would have such measures if this info was indeed abusable.
- chrisseaton 6y ago
  > I mean you can just get employees from LinkedIn and already know their e-mail addresses with high certainty and know when they work by the timezones. Do you put your IP number on LinkedIn? When you travel do you put the hotel you're staying in on LinkedIn? Also, not everyone is on LinkedIn in the first place. > It would be arbitrary to have the image links switched out by the server so they always go through a proxy/urldefense and it would never be the user ip address or user agent the attacker sees. The word 'arbitrary' doesn't make any sense to me in this context so not sure what you mean sorry. In general, I don't know what you're trying to say - that there are ways to try to defend against these attacks? Yeah I know. I'm not sure what point of mine you're refuting or replying to anymore. You asked 'What can be done with this information?' - this is the list of things you can do with that information. Can you defend against some of it? Yes to some extent. But it still leaks for many people.
  - mewpmewp2 6y ago
    What I am trying to say is that someone opening an e-mail should not be considered a failure. You can't expect people not to do this. All of this can be avoided if you just use some service to proxy the images. So the IP would not be leaked because the proxy server is fetching the image and it could easily be doing this no matter what and even if it determines the message to be spam and user might not even see the e-mail.
  - msla 6y ago
    > Do you put your IP number on LinkedIn? Which companies own which IP address blocks is public information. > When you travel do you put the hotel you're staying in on LinkedIn? Conferences are announced; advertised, even. > Also, not everyone is on LinkedIn in the first place. That's OK, companies do a fine job publishing employee information all on their own. > You asked 'What can be done with this information?' - this is the list of things you can do with that information. You've moved from Step A, getting the information to Step B, correlating the information, but you've left off Step C, which is profiting from the information. What is a benefit you can gain from knowing someone at some IP address opened your email? Can you get that benefit some other way, such as by looking in a phone book or viewing the company's website?
BenjiWiebe 6y ago
Thunderbird blocks remote content from non-contact email. Is that not standard behavior? It prevents someone from knowing when you've opened their email.

Kalium 6y ago

> What can be done with this information? Now you know who's curious enough to open a shady-looking email, and perhaps click a link out of curiosity. It means your list for the next round of attacks is much smaller and more targeted, making it easier to evade detection.