6 ms·
>Next step (please): block all 1x1 sized images. If you're not aware, the HTTP protocol specification[1] doesn't have a technical way of knowing ahead of time
by jasode 6y ago
>Next step (please): block all 1x1 sized images.
If you're not aware, the HTTP protocol specification[1] doesn't have a technical way of knowing ahead of time if it's a 1x1 tracking pixel.
So the remaining realistic options are:
(1) block ALL <img> tags downloads which then blocks any 1x1 tracking pixels
(2) allow <img> tags but block some (and maybe most but not all) 1x1 pixels via a blacklist of url domains (e.g. doubleclick.net) ... and/or heuristics based on the "style" attribute
The (1) already happens in many email clients that render HTML.
The (2) is happening with the ongoing cat & mouse game with AdBlock, EasyList, etc
[1] https://www.google.com/search?q=http+protocol+request+get+syntax https://www.google.com/search?q=http+protocol+request+get+sy...
- eli 6y ago(1) happens in relatively few email clients. Every major client loads images by default except Thunderbird and it is not common.
- throwaway120820 6y ago...and Outlook
- eli 6y agoNope, Outlook definitely loads images unless you or your administrator changed the setting.
- nvr219 6y agoThis is simply not true. Out of the box Outlook install does not display images for senders not marked safe, nor does Outlook Web App.
- jasode 6y ago>Outlook definitely loads images unless you or your administrator changed the setting. I just installed a fresh copy of Office 2019 in a vm and Outlook's default setting doesn't load images. This block-downloading-images-default behavior matches what I read here: https://support.microsoft.com/en-us/office/block-or-unblock-automatic-picture-downloads-in-email-messages-15e08854-6808-49b1-9a0a-50b81f2d617a https://support.microsoft.com/en-us/office/block-or-unblock-...
- eli 6y agoHm, I stand corrected
- SAI_Peregrinus 6y agoAnd except gmail's web interface, which is one of the biggest email clients these days.
- llacb47 6y agoGmail's web interface does load images by default.
- Joe8Bit 6y agoTechnically it loads all images through a Google proxy[0] which in theory prevents third parties from using images for tracking. The third parties only get a 'hit' when Google pulls the image into their cache, which is not when you open the mail. Google can still track you, but if you really care about that then you're probably not using Gmail anyway. [0]: https://gmail.googleblog.com/2013/12/images-now-showing.html https://gmail.googleblog.com/2013/12/images-now-showing.html
- readams 6y agoGmail won't load remote images when you open the mail. It will load images from Google servers that have been cached.
- eli 6y agoit doesn't pre-cache them, Google requests them in real-time when you view them
- asiachick 6y agoIt does not load them from 3rd parties. It cached them and loads them from Google's servers. Open your network tab and see https://arstechnica.com/information-technology/2013/12/gmail-blows-up-e-mail-marketing-by-caching-all-images-on-google-servers/ https://arstechnica.com/information-technology/2013/12/gmail...
- eli 6y agoThis protects your IP address and user agent string from being read by the sender, but otherwise doesn't change anything
- jachee 6y agoApple Mail on iOS doesn’t.
- eli 6y agoI don't think it does. Perhaps you changed the default. Or if you're on a managed device, perhaps your administrator did.
- emayljames 6y agoFairmail on Android blocks trackers.
- shultays 6y agoI always wondered why mail providers don't load all images automatically the moment the mail is received and present a cached image to the users. Wouldn't that make tracking useless?
- vlovich123 6y agoOr Firefox could crowdsource the building of a bloom filter of the URLs for images that are 1x1. Or you could learn 1x1 tracking locally since the set of pages you visit will probably be similar if you just want some more general protection. The bigger problem is that anything like this and the providers go up in size 1px at a time until it’s harder to distinguish from real content (at first transparent, then positioned off-screen, then overlays hiding it, then visible in a part of the page that doesn’t get as many views, dual-purposed with images/ads already on-screen, etc). A better way is if Firefox just bundled an ad blocker and pushed ad blocking technology forward (eg more hooks to do expensive processing natively to save on power like Safari does). The challenge though is that something like 100% of their funding comes from an ad company.
- mike-cardwell 6y agoBloom filter wouldn't work. The bloom filter will tell you that a particular URL is "possibly" in the list. What do you do then? Reject it because it might be a tracking image? [edit] Also, this ignores being able to: <iframe src="any-old-tracking-url"></iframe> <script src="any-old-tracking-url"> <link rel="stylesheet" type="text/css" href="any-old-tracking-url"> <img src="100px-width-tracking-image"> etc
- kaba0 6y agoGoogle pays mozilla in order to avoid a monopoly lawsuit. Just because it is good for mozilla, it doesn’t put any sort of incentive for them to follow.
- dreamcompiler 6y agoWhat we probably need is a client-side neural net within the browser to notice that certain high information-content IMG URLs (i.e. those with random-looking garbage in the URL) from certain domains tend to result in very low information-content imagery. And that's the signature of a likely tracker.
- dekerta 6y agoHow about this: - The browser does not load any images by default. <img> tags are replaced by gray rectangles - User must click on the placeholder rectangle to load the image - User can add image URLs to a whitelist so they load by default
- jefftk 6y agoI can't tell if you're being serious. Is "no images without clicks" something you think most people who use the web would prefer?
- dekerta 6y agoOf course not, it would have to be an opt-in feature. I'm sure some people who are worried about 1x1 tracking might use it though. In the same way that a lot of people browse the web with noscript
- kbelder 6y agoI remember loving that feature in Opera. Of course, that was during dial-up days, so it was a huge quality of life feature.
- m_eiman 6y agoEnable resources from the origin domain by default, and any Reasonable(tm) web page should have no problem with this.
- iudqnolq 6y agoUblock Origin does this.
- LinuxBender 6y agouBlock does not know the size until the file is requested. At that point it is too late, you have accessed the tracking file. That feature in uBlock is meant for people trying to save bandwidth/CPU. uBlock is great though, I would never browse the web without it.