5 ms·
>Most of the Basecamp team's recent rebelliousness, and seemingly the initial reason for building Hey, has to do with spy pixels. How can you tell the differen
by upofadown 6y ago
>Most of the Basecamp team's recent rebelliousness, and seemingly the initial reason for building Hey, has to do with spy pixels.
How can you tell the difference between a "spy pixel" and an image? Whatever criteria you use can be worked around.
Email clients should not allow emails to initiate outgoing network connections... period ... and most of the good ones don't by default.
- dhagz 6y agoI think the difference would be an image loaded remotely vs. an image inlined into the email as an attachment? But I'm not well-versed in how images are handled in HTML emails.
- tipalink 6y agoIf I were to guess, I'd say the same way adblockers work on browsers: blacklisting domains. Sendgrid was given as an example. They could also block using image size (1px) or location (end of message body). That being said, I see your point. It's a game of Whack-a-Mole. What's to stop businesses from setting up a cname record on their domain to Sendgrid, for example?
- corobo 6y agoThe next whack-a-mole move, inspect CNAMEs to see if they reference blocklisted domains
- baking 6y agoSeems like a simple correlation of size of the image vs. length of the url. Small images with long urls are suspect. Not sure what the work around would be. Edit: Also white/invisible pixels. Maybe number of visible/non-white pixels vs. url length.
- tobr 6y agoHow do you know image size and percentage of white or transparent pixels without loading the image?
- WrtCdEvrydy 6y agoStrip all params, hope for the best?
- Nextgrid 6y agoTo be fair, if this happens server-side then they can just preload all remote content at delivery time, negating the privacy impact of trackers because the only data they'll get is the IP/user agent of the email server.
- elsurudo 6y agoJason Fried in the demo says that they do precisely this – they act as a proxy.
- deleted 6y ago[deleted]
- remyp 6y agoAll of the suggestions in this thread are good, but there are others. I spent a couple years working on this at messagecontrol.com to build an enterprise email tracker blocker, and I'm sure they have continued to enhance it since I left.
- elliottinvent 6y agoI guess the "spy pixel" image URLs would all be unique, so by comparing the mail that was sent to different recipients you could reveal which were trackers and which were not. No idea if that's what they're doing.
- drchopchop 6y agoSo do we go back to a world of completely plain-text emails? No buttons? Links buried in a wall of ASCII? We use SendGrid to fire important, user-anticipated emails (i.e. "the Zoom class you paid for is starting at 8:30 AM, here's the private link"). Blocking all images is insane, and would set back email UX to the BBS ages. Blocking all SendGrid-served images would simply mean people host images on their own domain (or disguise the DNS), and could write their own open/click tracking systems, which would negate the point of blocking SG pixels in the first place.
- Nextgrid 6y ago> set back email UX to the BBS ages I don't understand why that's bad or why e-mail needs an "UX" beyond being text. E-mail is there to convey information and text is the most efficient way to do it. If images are really important, you can include them as attachments and they'll be displayed even with remote content blocked.
- upofadown 6y agoYou can after all just include the images with the email using something like a CID URL. ... and a link that a user has to explicitly click on is not a 10th as bad as any sort of process out of their control.
- alexmingoia 6y agoFastmail blocks loading of images by default. I have never needed to load the images to get whatever I need from the email. And if I need to I can click a button to load them if I trust the sender.