4 ms·

Maybe the proxy removes metadata such as useragent, but often the pic urls contain uniquely identifiable information, eg a number that is unique to that email t

Maybe the proxy removes metadata such as useragent, but often the pic urls contain uniquely identifiable information, eg a number that is unique to that email that received the email. That way you still leak that it is opened, how often, etc (unless they cache, I don't know).

wnevets 6y ago
Isnt the proxy downloading and caching the image before the user opens the email? If so doesnt that prevent tracking if/when the user actually opens the email?
- ygjb 6y ago
  It may have changed since then, but Fillipo Valsorda wrote up some details about this, and how to validate how the proxy works - https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
- mike-cardwell 6y ago
  It does not. That's how it should work, but it does not work that way. It downloads them on demand if and when the user views an email. So it protectes the users IP address from the spammer/marketter, but not the fact that the message was viewed nor when it was viewed.
  - spullara 6y ago
    The amount of email that is sent and not opened would probably destroy the origins - might be ok. But it would waste a huge, huge amount of bandwidth and CPU to download them which would open up an attack vector (DoS) on any email service that did this. Images can be legitimately very big...
    - mike-cardwell 6y ago
      I'm not convinced that this would be as big a problem as you're suggesting. If somebody is sending thousands of emails with html containing embedded images, the receiving system of those emails only needs to download each of those images once, and cache them. Unless they're using different URLs for each image for tracking purposes. Which would become pointless if the images were downloaded immediately. They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large. It would even work for people using normal IMAP clients if they attached the images to the email directly and switched out the href in the img tags to point at the attachment instead. This whole thing could be a user setting which can be toggled. Defaulting to the most privacy friendly option.
      - benlivengood 6y ago
        > They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large. Or only allow inline images.

wnevets 6y ago

Isnt the proxy downloading and caching the image before the user opens the email? If so doesnt that prevent tracking if/when the user actually opens the email?

ygjb 6y ago
It may have changed since then, but Fillipo Valsorda wrote up some details about this, and how to validate how the proxy works - https://blog.filippo.io/how-the-new-gmail-image-proxy-works-and-what-this-means-for-you/ https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...
mike-cardwell 6y ago
It does not. That's how it should work, but it does not work that way. It downloads them on demand if and when the user views an email. So it protectes the users IP address from the spammer/marketter, but not the fact that the message was viewed nor when it was viewed.
- spullara 6y ago
  The amount of email that is sent and not opened would probably destroy the origins - might be ok. But it would waste a huge, huge amount of bandwidth and CPU to download them which would open up an attack vector (DoS) on any email service that did this. Images can be legitimately very big...
  - mike-cardwell 6y ago
    I'm not convinced that this would be as big a problem as you're suggesting. If somebody is sending thousands of emails with html containing embedded images, the receiving system of those emails only needs to download each of those images once, and cache them. Unless they're using different URLs for each image for tracking purposes. Which would become pointless if the images were downloaded immediately. They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large. It would even work for people using normal IMAP clients if they attached the images to the email directly and switched out the href in the img tags to point at the attachment instead. This whole thing could be a user setting which can be toggled. Defaulting to the most privacy friendly option.
    - benlivengood 6y ago
      > They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large. Or only allow inline images.