7 ms·

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

funman7 6y ago
I think at one point Gmail was wanting to do that then didn’t do that.
xnx 6y ago
Gmail does. This is great for privacy because it destroys the usefulness of the tracking pixel to the marketer.
- alaties 6y ago
  Eh... Not really... It's pretty easy to generate a unique image url per customer and use that to determine whether a customer opened the mail or not and it's about the same cost as a traditional tracking pixel, complexity-wise.
  - ralph84 6y ago
    Indeed, the three email tracking services I'm familiar with (HubSpot, Yesware, and Outreach) all generate unique URLs per recipient. The only information you don't get for Gmail clients is location, but you get the most valuable info which is if/when/how many times the email is opened.
    - neeleshs 6y ago
      I remember reading that gmail caches these images, rendering the how-many-times useless.
      - alaties 6y ago
        GMail absolutely caches images. The cache is primarily for performant delivery of data over mobile networks though and reduced load of repeat same-day viewing, and less for privacy. While their cache is large, it's not infinite. If what you're interested in is whether a customer engages with an email multiple times over a few days, you'll likely get the pixel hits to confirm it over that time period. Of course, as you imply, you wouldn't be able to collect how many times an hour a single customer has viewed an email sent to them.
      - godmode2019 6y ago
        I have tested this and the cache expires pretty quickly. From memory 10min -30. I thought that was fine because its around about one hit per session. You get enough good information. The IP address would be even better however.
  - Mulpze15 6y ago
    Does Gmail download by default, whether you open the email or not?
    - minsc__and__boo 6y ago
      Gmail caches by default. The catch is that Gmail caches all the same images from the same servers, so email marketers get around it by serving tracking pixels with obscure, unique URLs per individual. Geotargeting fails because it loads on GMail servers.
      - Mulpze15 6y ago
        Yes, I understand the caching part. If Gmail proactively loads/cache the unique pixel before users open the email, then the email reporting is garbage. If they wait for the person to open the email, it is very interesting (even if repeat are not tracked).
    - xnx 6y ago
      I was confused on this, but it looks like the email has to be opened once for Google to cache the image.
- noja 6y ago
  How? https://jioegijogeijesgioegeg.tracking.example.com/niowefioe.png?sdgsdbuegiu=rojpopwmrmwk has four places to store unique information. Does Gooogle's proxy remove all of them?
  - bayindirh 6y ago
    Download via a proxy and cache the image when you receive the e-mail. It's processed in the queue and opened. Was it the user? Did it hit Inbox? Where did it got opened? When it's opened? How many times it opened? All these information's reliability got out of the window with a single optimization. You can't know how this mail was processed and it's fate. So, your tracking pixel and URL returned something useless to you.
    - noja 6y ago
      Aha so it's not just a proxy. It's a pre-fetching proxy. Understood you. Edit: oh :(
      - JimDabell 6y ago
        That’s not how Gmail works and it doesn’t protect your privacy that way: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
    - JimDabell 6y ago
      That’s not how Gmail works and it doesn’t protect your privacy that way: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
      - bayindirh 6y ago
        I didn't intend to say or have claimed that Google works this way, but it can be done that way, if one is so inclined.
- xnx 6y ago
  My mistake. It looks like google still waits for an initial email view to cache the image. Kind of wish they would load images for unviewed emails too.
wahern 6y ago
GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message. Apple's macOS Mail.app client displays external images by default, as does their iOS app.
- sep_field 6y ago
  on iOS: turn that off with Settings > Mail > Load remote images
  - officialjunk 6y ago
    recently i am seeing certain images still loaded, whereas in the past none loaded. i haven’t investigated what is different about these images yet, though. anyone else observe similar?
    - gtufano 6y ago
      You can embed the image inside the actual multi-part message, and it will be shown without accessing network. It is usually used for logos, signatures and the such and, afaik, can't be used for tracking mail opening.
    - m_eiman 6y ago
      Could be images with image data included in the email, that don't need to load remotely.
- musicale 6y ago
  I'm somewhat disappointed that Apple doesn't offer better default privacy for Mail. Perhaps they can't figure out a good solution to differentiate between benign images and tracking images; it does seem like it would be nearly impossible to do so, but I wouldn't mind a) blocking external images by default, b) per-sender/recipient settings, and c) clearly displaying "invisible" images and warning about them. Perhaps someone has some better ideas on how to fight this scourge? I tend to think that the only practical solution is to block them entirely, but then malicious senders will send URLs that say "click here to view message." Maybe HTML email wasn't such a great idea.
gorgoiler 6y ago
iOS mail, alas. I just found it turned on. I forgot to disable it again after my annual OPSEC-cosplay device-wipe.
- im3w1l 6y ago
  I've seen this expression here a few times and I don't mean to single you out, but arghhh! The cos in cosplay stands for costume. Roleplay! Unless you are putting on a literal white hat I suppose, that would be cool.
  - Griffinsauce 6y ago
    It's figurative? The point is that they're pretending to be something they're not.
    - encom 6y ago
      That would be larping. Not cosplaying. I disavow both.
      - im3w1l 6y ago
        And to elaborate on this Larp = live action role playing. Where you act as your character, as opposed to table-top role playing, where you say what your character does.
kibibyte 6y ago
Many third-party mobile email clients I've used in the past never gave you the option of disabling image loading, though some of them finally added the feature after many years (e.g. Outlook).
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
m463 6y ago
Apple mail will load them if you forward an email, even if you have remote images turned off. (last I checked)
- IndySun 6y ago
  Can Little Snitch and similar software be used to stop images, pixels, from loading and from being sent on a reply or forward?
  - m463 6y ago
    yes, but although little snitch has managed to survive on macos, on ios you have no thing to verify or protect you.
bennyelv 6y ago
Not only that, but the way the article came about seems to be a bit strange. Apparently the BBC asked Hey to some analysis on their emails, and have written what appears to be a publicity piece for them on the result. Did you know that Hey allows you to block tracking pixels for the low price of $99/year? Now you do! Not the kind of thing I'd expect to see from the publicly funded BBC.
- grey_earthling 6y ago
  The BBC has form on this. They periodically publish news articles reporting that a person's life was saved by the app What3Words, without mentioning the existence of similar proprietary and open systems. See for example: => https://www.bbc.co.uk/news/uk-england-stoke-staffordshire-55921168 https://www.bbc.co.uk/news/uk-england-stoke-staffordshire-55... 2021-02-03 What3words: Stafford women rescued from flooded river after using app => https://www.bbc.co.uk/news/technology-49754820 https://www.bbc.co.uk/news/technology-49754820 2019-09-20 What3words: 'Life-saving app' divides opinion => https://www.bbc.co.uk/news/uk-england-49319760 https://www.bbc.co.uk/news/uk-england-49319760 2019-08-15 What3words: The app that can save your life (Yes, that's the headline they used.) => https://www.bbc.co.uk/news/technology-47705912 https://www.bbc.co.uk/news/technology-47705912 2019-03-26 Three-unique-words 'map' used to rescue mother and child => https://www.bbc.co.uk/news/technology-40935774 https://www.bbc.co.uk/news/technology-40935774 2017-08-30 TEDGlobal: Three words that give people an address => https://www.bbc.co.uk/news/business-32444811 https://www.bbc.co.uk/news/business-32444811 2015-04-29 Giving everyone in the world an address
  - bennyelv 6y ago
    They're even using the company's marketing materials for the images in the articles. If I had the time or energy, I'd complain about all of the above.
  - deleted 6y ago
    [deleted]
eqvinox 6y ago
My email client doesn't even have the capability to display images or download anything... (It's mutt.)
eli 6y ago
ALL of the top 10 email clients download external images by default.
- mappu 6y ago
  My Thunderbird doesn't. Is it no longer in the top 10? (Was it ever in the top 10?)
  - eli 6y ago
    Hard to say since the data I'm aware of on email client usage comes from... loading images. But Apple Mail, iOS Mail, Gmail, and Outlook alone are probably 80% to 90% of recipients.

funman7 6y ago

I think at one point Gmail was wanting to do that then didn’t do that.

xnx 6y ago

Gmail does. This is great for privacy because it destroys the usefulness of the tracking pixel to the marketer.

alaties 6y ago
Eh... Not really... It's pretty easy to generate a unique image url per customer and use that to determine whether a customer opened the mail or not and it's about the same cost as a traditional tracking pixel, complexity-wise.
- ralph84 6y ago
  Indeed, the three email tracking services I'm familiar with (HubSpot, Yesware, and Outreach) all generate unique URLs per recipient. The only information you don't get for Gmail clients is location, but you get the most valuable info which is if/when/how many times the email is opened.
  - neeleshs 6y ago
    I remember reading that gmail caches these images, rendering the how-many-times useless.
    - alaties 6y ago
      GMail absolutely caches images. The cache is primarily for performant delivery of data over mobile networks though and reduced load of repeat same-day viewing, and less for privacy. While their cache is large, it's not infinite. If what you're interested in is whether a customer engages with an email multiple times over a few days, you'll likely get the pixel hits to confirm it over that time period. Of course, as you imply, you wouldn't be able to collect how many times an hour a single customer has viewed an email sent to them.
    - godmode2019 6y ago
      I have tested this and the cache expires pretty quickly. From memory 10min -30. I thought that was fine because its around about one hit per session. You get enough good information. The IP address would be even better however.
- Mulpze15 6y ago
  Does Gmail download by default, whether you open the email or not?
  - minsc__and__boo 6y ago
    Gmail caches by default. The catch is that Gmail caches all the same images from the same servers, so email marketers get around it by serving tracking pixels with obscure, unique URLs per individual. Geotargeting fails because it loads on GMail servers.
    - Mulpze15 6y ago
      Yes, I understand the caching part. If Gmail proactively loads/cache the unique pixel before users open the email, then the email reporting is garbage. If they wait for the person to open the email, it is very interesting (even if repeat are not tracked).
  - xnx 6y ago
    I was confused on this, but it looks like the email has to be opened once for Google to cache the image.
noja 6y ago
How? https://jioegijogeijesgioegeg.tracking.example.com/niowefioe.png?sdgsdbuegiu=rojpopwmrmwk has four places to store unique information. Does Gooogle's proxy remove all of them?
- bayindirh 6y ago
  Download via a proxy and cache the image when you receive the e-mail. It's processed in the queue and opened. Was it the user? Did it hit Inbox? Where did it got opened? When it's opened? How many times it opened? All these information's reliability got out of the window with a single optimization. You can't know how this mail was processed and it's fate. So, your tracking pixel and URL returned something useless to you.
  - noja 6y ago
    Aha so it's not just a proxy. It's a pre-fetching proxy. Understood you. Edit: oh :(
    - JimDabell 6y ago
      That’s not how Gmail works and it doesn’t protect your privacy that way: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
  - JimDabell 6y ago
    That’s not how Gmail works and it doesn’t protect your privacy that way: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
    - bayindirh 6y ago
      I didn't intend to say or have claimed that Google works this way, but it can be done that way, if one is so inclined.
xnx 6y ago
My mistake. It looks like google still waits for an initial email view to cache the image. Kind of wish they would load images for unviewed emails too.

wahern 6y ago

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message. Apple's macOS Mail.app client displays external images by default, as does their iOS app.

sep_field 6y ago
on iOS: turn that off with Settings > Mail > Load remote images
- officialjunk 6y ago
  recently i am seeing certain images still loaded, whereas in the past none loaded. i haven’t investigated what is different about these images yet, though. anyone else observe similar?
  - gtufano 6y ago
    You can embed the image inside the actual multi-part message, and it will be shown without accessing network. It is usually used for logos, signatures and the such and, afaik, can't be used for tracking mail opening.
  - m_eiman 6y ago
    Could be images with image data included in the email, that don't need to load remotely.
musicale 6y ago
I'm somewhat disappointed that Apple doesn't offer better default privacy for Mail. Perhaps they can't figure out a good solution to differentiate between benign images and tracking images; it does seem like it would be nearly impossible to do so, but I wouldn't mind a) blocking external images by default, b) per-sender/recipient settings, and c) clearly displaying "invisible" images and warning about them. Perhaps someone has some better ideas on how to fight this scourge? I tend to think that the only practical solution is to block them entirely, but then malicious senders will send URLs that say "click here to view message." Maybe HTML email wasn't such a great idea.

gorgoiler 6y ago

iOS mail, alas. I just found it turned on. I forgot to disable it again after my annual OPSEC-cosplay device-wipe.

im3w1l 6y ago
I've seen this expression here a few times and I don't mean to single you out, but arghhh! The cos in cosplay stands for costume. Roleplay! Unless you are putting on a literal white hat I suppose, that would be cool.
- Griffinsauce 6y ago
  It's figurative? The point is that they're pretending to be something they're not.
  - encom 6y ago
    That would be larping. Not cosplaying. I disavow both.
    - im3w1l 6y ago
      And to elaborate on this Larp = live action role playing. Where you act as your character, as opposed to table-top role playing, where you say what your character does.

kibibyte 6y ago

Many third-party mobile email clients I've used in the past never gave you the option of disabling image loading, though some of them finally added the feature after many years (e.g. Outlook).

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

m463 6y ago

Apple mail will load them if you forward an email, even if you have remote images turned off. (last I checked)

IndySun 6y ago
Can Little Snitch and similar software be used to stop images, pixels, from loading and from being sent on a reply or forward?
- m463 6y ago
  yes, but although little snitch has managed to survive on macos, on ios you have no thing to verify or protect you.

bennyelv 6y ago

Not only that, but the way the article came about seems to be a bit strange. Apparently the BBC asked Hey to some analysis on their emails, and have written what appears to be a publicity piece for them on the result. Did you know that Hey allows you to block tracking pixels for the low price of $99/year? Now you do! Not the kind of thing I'd expect to see from the publicly funded BBC.

grey_earthling 6y ago
The BBC has form on this. They periodically publish news articles reporting that a person's life was saved by the app What3Words, without mentioning the existence of similar proprietary and open systems. See for example: => https://www.bbc.co.uk/news/uk-england-stoke-staffordshire-55921168 https://www.bbc.co.uk/news/uk-england-stoke-staffordshire-55... 2021-02-03 What3words: Stafford women rescued from flooded river after using app => https://www.bbc.co.uk/news/technology-49754820 https://www.bbc.co.uk/news/technology-49754820 2019-09-20 What3words: 'Life-saving app' divides opinion => https://www.bbc.co.uk/news/uk-england-49319760 https://www.bbc.co.uk/news/uk-england-49319760 2019-08-15 What3words: The app that can save your life (Yes, that's the headline they used.) => https://www.bbc.co.uk/news/technology-47705912 https://www.bbc.co.uk/news/technology-47705912 2019-03-26 Three-unique-words 'map' used to rescue mother and child => https://www.bbc.co.uk/news/technology-40935774 https://www.bbc.co.uk/news/technology-40935774 2017-08-30 TEDGlobal: Three words that give people an address => https://www.bbc.co.uk/news/business-32444811 https://www.bbc.co.uk/news/business-32444811 2015-04-29 Giving everyone in the world an address
- bennyelv 6y ago
  They're even using the company's marketing materials for the images in the articles. If I had the time or energy, I'd complain about all of the above.
- deleted 6y ago
  [deleted]

eqvinox 6y ago

My email client doesn't even have the capability to display images or download anything... (It's mutt.)

eli 6y ago

ALL of the top 10 email clients download external images by default.

mappu 6y ago
My Thunderbird doesn't. Is it no longer in the top 10? (Was it ever in the top 10?)
- eli 6y ago
  Hard to say since the data I'm aware of on email client usage comes from... loading images. But Apple Mail, iOS Mail, Gmail, and Outlook alone are probably 80% to 90% of recipients.