4 ms·

Doesn't Mail do this by default by not loading remote images?

by spzb 6y ago

xoa 6y ago
Yeah, I'm mildly confused by what the sell point here is. I sort of assume that any loading of remote resources automatically represents tracking information for this use-case, every email can be trivially individualized to the receiver and in turn I don't see how it's feasible to prevent resource tracking. You either load remote resources, or you don't. I guess if techniques remain relatively unsophisticated for email and few people bother then individuals might slip under the radar, though partial blocking itself represents a signal. But unlike the web individual messaging remote resources seems like an arms race users would be destined to lose. The only thing I could see really working would depending on a really big service that processed every received email immediately and proxied all remote resources without any user interaction. Plenty of challenges there too though, and harder to make it work with regular clients. Maybe dynamically rewriting the email to point to the proxied resources? Or automatically rendering/inlining them?
- gruez 6y ago
  >Maybe dynamically rewriting the email to point to the proxied resources? AFAIK gmail already does that. It prevents people from knowing your IP address, but they still know whether you opened the email or not, since it's lazy loaded. Preferably there's a email service that always loads the images and stores it, so you can view images without any spying.
deleted 6y ago
[deleted]
gruez 6y ago
It does, but I guess this is for people who like images most of the time, and just want to avoid the tracking without sacrificing ux. I'm guessing it's inspired by https://hey.com/spy-trackers/ https://hey.com/spy-trackers/, which also has a similar feature that works on a blacklist basis (presumably).
- WhyNotHugo 6y ago
  I'm curious why they wouldn't also eager-load _other_ images. As soon as an email is received (regardless of whether the recipient account exists or not), load the image from the remote host. This also degrades the spying capabilities of third parties. If they track image loads to translate this to "email opened", they'll immediately get pure false positives from any email they sent to @hey.com -- even if the account doesn't exist.
m463 6y ago
Note that apple has a bug, and has had it for years and years. If you have it turned off it won't load remote images... EXCEPT: if you forward an email - it will load them all, all of them. This is especially troublesome if you want to forward a phishing email to IT. (thank you little snitch. also I am not using the latest catalina apple mail)
- LeoPanthera 6y ago
  You can bypass this by doing "forward as attachment", which you should be doing anyway, since it preserves the headers.
  - PostPlummer 6y ago
    Thanks for posting this. Your friendly email inspector who needs to explain this x times a day.
- miles 6y ago
  For anyone not using it, the great thing about Little Snitch is being able to set just the precise port numbers and remote hosts you want a given app to access while blocking everything else, rendering plug-ins like MailTrackerBlocker unnecessary. You can also set profiles for different networks, and even have them switch automatically: https://help.obdev.at/littlesnitch/adv-profiles https://help.obdev.at/littlesnitch/adv-profiles .

Doesn't Mail do this by default by not loading remote images?

by spzb 6y ago

Doesn't Mail do this by default by not loading remote images?

xoa 6y ago

Yeah, I'm mildly confused by what the sell point here is. I sort of assume that any loading of remote resources automatically represents tracking information for this use-case, every email can be trivially individualized to the receiver and in turn I don't see how it's feasible to prevent resource tracking. You either load remote resources, or you don't. I guess if techniques remain relatively unsophisticated for email and few people bother then individuals might slip under the radar, though partial blocking itself represents a signal. But unlike the web individual messaging remote resources seems like an arms race users would be destined to lose. The only thing I could see really working would depending on a really big service that processed every received email immediately and proxied all remote resources without any user interaction. Plenty of challenges there too though, and harder to make it work with regular clients. Maybe dynamically rewriting the email to point to the proxied resources? Or automatically rendering/inlining them?

gruez 6y ago
>Maybe dynamically rewriting the email to point to the proxied resources? AFAIK gmail already does that. It prevents people from knowing your IP address, but they still know whether you opened the email or not, since it's lazy loaded. Preferably there's a email service that always loads the images and stores it, so you can view images without any spying.

deleted 6y ago

[deleted]

gruez 6y ago

It does, but I guess this is for people who like images most of the time, and just want to avoid the tracking without sacrificing ux. I'm guessing it's inspired by https://hey.com/spy-trackers/ https://hey.com/spy-trackers/, which also has a similar feature that works on a blacklist basis (presumably).

WhyNotHugo 6y ago
I'm curious why they wouldn't also eager-load _other_ images. As soon as an email is received (regardless of whether the recipient account exists or not), load the image from the remote host. This also degrades the spying capabilities of third parties. If they track image loads to translate this to "email opened", they'll immediately get pure false positives from any email they sent to @hey.com -- even if the account doesn't exist.

m463 6y ago

Note that apple has a bug, and has had it for years and years. If you have it turned off it won't load remote images... EXCEPT: if you forward an email - it will load them all, all of them. This is especially troublesome if you want to forward a phishing email to IT. (thank you little snitch. also I am not using the latest catalina apple mail)

LeoPanthera 6y ago
You can bypass this by doing "forward as attachment", which you should be doing anyway, since it preserves the headers.
- PostPlummer 6y ago
  Thanks for posting this. Your friendly email inspector who needs to explain this x times a day.
miles 6y ago
For anyone not using it, the great thing about Little Snitch is being able to set just the precise port numbers and remote hosts you want a given app to access while blocking everything else, rendering plug-ins like MailTrackerBlocker unnecessary. You can also set profiles for different networks, and even have them switch automatically: https://help.obdev.at/littlesnitch/adv-profiles https://help.obdev.at/littlesnitch/adv-profiles .