6 ms·
MailTrackerBlocker – email tracker and spy pixel blocker plugin for Apple Mail
- spzb 6y agoDoesn't Mail do this by default by not loading remote images?
- xoa 6y agoYeah, I'm mildly confused by what the sell point here is. I sort of assume that any loading of remote resources automatically represents tracking information for this use-case, every email can be trivially individualized to the receiver and in turn I don't see how it's feasible to prevent resource tracking. You either load remote resources, or you don't. I guess if techniques remain relatively unsophisticated for email and few people bother then individuals might slip under the radar, though partial blocking itself represents a signal. But unlike the web individual messaging remote resources seems like an arms race users would be destined to lose. The only thing I could see really working would depending on a really big service that processed every received email immediately and proxied all remote resources without any user interaction. Plenty of challenges there too though, and harder to make it work with regular clients. Maybe dynamically rewriting the email to point to the proxied resources? Or automatically rendering/inlining them?
- gruez 6y ago>Maybe dynamically rewriting the email to point to the proxied resources? AFAIK gmail already does that. It prevents people from knowing your IP address, but they still know whether you opened the email or not, since it's lazy loaded. Preferably there's a email service that always loads the images and stores it, so you can view images without any spying.
- deleted 6y ago[deleted]
- gruez 6y agoIt does, but I guess this is for people who like images most of the time, and just want to avoid the tracking without sacrificing ux. I'm guessing it's inspired by https://hey.com/spy-trackers/ https://hey.com/spy-trackers/, which also has a similar feature that works on a blacklist basis (presumably).
- WhyNotHugo 6y agoI'm curious why they wouldn't also eager-load _other_ images. As soon as an email is received (regardless of whether the recipient account exists or not), load the image from the remote host. This also degrades the spying capabilities of third parties. If they track image loads to translate this to "email opened", they'll immediately get pure false positives from any email they sent to @hey.com -- even if the account doesn't exist.
- m463 6y agoNote that apple has a bug, and has had it for years and years. If you have it turned off it won't load remote images... EXCEPT: if you forward an email - it will load them all, all of them. This is especially troublesome if you want to forward a phishing email to IT. (thank you little snitch. also I am not using the latest catalina apple mail)
- LeoPanthera 6y agoYou can bypass this by doing "forward as attachment", which you should be doing anyway, since it preserves the headers.
- PostPlummer 6y agoThanks for posting this. Your friendly email inspector who needs to explain this x times a day.
- miles 6y agoFor anyone not using it, the great thing about Little Snitch is being able to set just the precise port numbers and remote hosts you want a given app to access while blocking everything else, rendering plug-ins like MailTrackerBlocker unnecessary. You can also set profiles for different networks, and even have them switch automatically: https://help.obdev.at/littlesnitch/adv-profiles https://help.obdev.at/littlesnitch/adv-profiles .
- captn3m0 6y agoIs it possible to port this to iOS?
- imposterr 6y agoMany email providers have dealt with this by proxying all external image links in emails through their own services. See Gmail: https://support.google.com/mail/answer/145919?p=display_images https://support.google.com/mail/answer/145919?p=display_imag... See Fastmail: https://fastmail.blog/2014/09/16/better-security-and-privacy-through-image-proxying/ https://fastmail.blog/2014/09/16/better-security-and-privacy... Although, I'm not sure if these protections extend to those using third party email clients with these services.
- techsupporter 6y ago> I'm not sure if these protections extend to those using third party email clients with these services In Fastmail's case, those protections don't extend. I've tested this and Fastmail rewrites the image URLs when viewing through their webmail client but passes the message unmodified when fetching via IMAP. I understand why they'd do this but I'd love to have a setting that says to do this privacy rewrite when using an external client.
- imposterr 6y agoThanks for clarifying. Might be worth shooting them a message to ask for this feature. They've always been good about fixing bugs and at least responding to requests, even if they decide not to pursue it.
- rmccue 6y agoGmail’s don’t extend, at least via the IMAP API.
- jabroni_salad 6y agoSome 3rd party antispam products also follow all the links they can find gauge their intent. My company's marketing department has complained about this after noticing that our own clients have a 100% click rate. It's because we are reselling Barracuda.
- m463 6y ago
- techsupporter 6y agoThis plugin is awesome but one thing I've noticed lately is several financial institutions use tracking pixels to verify e-mail addresses and if you don't open an e-mail in a way that loads the pixel once every so often, they drop you from paperless statements. I've run into this with Capital One and Discover. Every year I have to log in and click "yes I want paperless statements" and then 11 statements later I get one in the mail with a message about "we miss you, you're not opening our e-mails so here's a paper statement unless you tell us you want e-statements and you open our e-mails." Never mind that I log into the mobile apps and web-based account management systems multiple times per month...
- tinus_hn 6y agoPretty dumb because like most clients, the #1 email client Outlook does not load these.
- joncp 6y agoHmmm. They email you your statements? Am I getting that right? If so, that seems like a pretty big security issue.
- techsupporter 6y agoNo, they e-mail to tell me that a statement is available for viewing on their web site or mobile application. But if I don't "open" one of those e-mails every 12 months, they kick me off of paperless statements and go back to sending them via regular mail.
- mindfulhack 6y agoWhat's the rationale for your bank doing this? The litigation-heavy environment of its jurisdiction? Someone once sued a bank due to a loss caused by not knowing what was in their bank account, and they demonstrated that they were not 'receiving' their statements?
- 6y ago