3 ms·
The catch is that images are not displayed by default. Why would an attacker click on show images? Only if the text of the email asked them to... EDIT: I'm wro
by revorad 15y ago
The catch is that images are not displayed by default. Why would an attacker click on show images? Only if the text of the email asked them to...
EDIT: I'm wrong as pointed out by others in the replies below.
- limmeau 15y agoAn IMAP client somewhere could poll the 'read' state of message 0x12345678 instead, alerting the owner when the message turns 'read'. However, that client would have to have access to the Gmail box...
- troels 15y agoYep, but it couldn't collect the IP of the attacker.
- pyre 15y agoYou're assuming that the attacked hasn't hidden his IP (i.e. Tor) or is in a country that will actually give a crap (i.e. not Russia/China).
- wladimir 15y agoBut would an attacker read a message marked as unread? A careful attacker would know that this alerts the owner of the mailbox, as he can't remember opening the message. His canary is a mail that has already been opened, so the attacker assumes he can look at it harmlessly.
- jarin 15y agoYou can tell GMail to always display images from a particular sender.
- revorad 15y agoAh yes of course. Duh me
- cmarshall 15y agoHe works around this by reading the email himself first, clicking the option to always display images from the sending email address and then starring it so the email is always at the top of his inbox even though it has been read. I suppose an attacker could bypass this method by turning off images in their browser though.