9 ms·

What's in email tracking links and pixels?

173 points by bengtan 5y ago

bengtan 5y ago
Hi, Author here. This investigation into email tracking attempts to deconstruct tracking links and pixels and highlight the data that is being collected. It covers Mailchimp, ConvertKit, Substack and other Mailgun retailers. There's also some attempted (albeit unsuccessful) reverse-engineering of an opaque token in the Substack section (If you like reading stuff about reverse-engineering). Happy to answer any questions. Thanks.
- verdverm 5y ago
  Nice work! Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users...
  - dewey 5y ago
    > Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users... But that's usually done to add "state" to emails so they can be tied to one thread in the support system and people can reply to either the email chain or via some web interface. I don't think you necessarily want to interfere with that.
    - verdverm 5y ago
      There are privacy considerations on the unknown users side. Have I consented to HubSpot (et al) having PII and my email contents? (I don't know how this works today, with the GDPR, any future privacy laws) I have more experience with the sales product than the support ones, where typically more sensitive information can be discussed.
  - codingdave 5y ago
    How does that work? I mean, sure they can BCC an address when they send an email, but any replies that I send back won't include that BCC?
    - verdverm 5y ago
      If I reply to your reply, then they see the chain. I can only imagine how much insider info they could be holding on to. Also of concern, are you even aware which emails / other people have be uploaded to their systems?
      - codingdave 5y ago
        Ah, gotcha. That makes sense. As far as insider info, most larger companies I've been at use a variety of confidentiality levels for their data, the highest of which cannot be emailed or put in the cloud. I believe that most corporate governance professionals are well aware of the risks and options for how to work with such things. But to be fair, your average office worker is not, so compliance with such policies becomes a cultural and education concern.
  - bengtan 5y ago
    I don't have any regular emails from them so I don't have any data to work with. If someone can point me to a Salesforce or HubSpot newsletter, I can susbcribe, get some samples, and then investigate. Re: BCC ... Uh, that's a totally different topic/mechanism and I have no comment on it.
    - bombcar 5y ago
      You can subscribe to Hubspot's newsletter here: https://blog.hubspot.com https://blog.hubspot.com (I assume they use hubspot lol). Same with salesforce: https://www.salesforce.com/form/other/role-based-newsletter/ https://www.salesforce.com/form/other/role-based-newsletter/
- 02thoeva 5y ago
  Convertkit is a front-end for Sendgrid, so possibly they use the same format as them?
  - bengtan 5y ago
    Possibly, but I don't know. If someone points me to a Sendgrid-based newsletter that I can subscribe to, I'd be happy to look.
    - Thoughtful 5y ago
      Mondo uses SendGrid. They have a subscription bar at the bottom of the homepage: mondoshop.com
- OrvalWintermute 5y ago
  Appreciated the blog post, I found it very handy in understanding the tracking activities. Looking forward to more!
SimeVidas 5y ago
Those tracking links are so annoying. They make it hard to see where the link is actually going. A newsletter could be linking to Wikipedia, but if you open the message in Gmail, there could be two or more layers of trackers in that URL. Example: The Frontend Focus newsletter in Gmail The link of the first news headline is something like https://www.google.com/url?q=https%3A%2F%2Ffrontendfoc.us%2Flink%2F109272%2Fc0daad1d97&sa=D&sntz=1&usg=AFQgCNFEh5TaNZpHqsqyBGWEaq2iL9MwCg The actual URL is https://www.slashgear.com/safari-overhaul-includes-tab-groups-and-web-extensions-on-mobile-07676634/
- twobitshifter 5y ago
  Yes and then if you use a content blocker the link will inevitably end up blocked.
- professorsnep 5y ago
  I just had to deal with an annoying tracking link to unsubscribe from an unsolicited mailing list. uBlock even blocked the link click, I had to temporarily allow the tracker to unsubscribe.
  - legitster 5y ago
    Unsubscribe links have to have your identifier in them so you know who to unsubscribe when you click the link. We used to ask people for their email address to unsubscribe them, but then they accused us of using a dark pattern to keep them subscribed. So letting people unsubscribe easier with fewer hoops to jump through seems like the lesser of two evils.
- boneitis 5y ago
  Of course, this does nothing to subvert the tracking services like mailchimp that bury the final destination behind their own link, but... Ctrl+Alt+T $ python3 >>> from urllib import parse >>> parse.unquote('https%3A//www.google.com/url%3Fq%3Dhttps%3A//www.example.com/foo.php%3Fp0%3Darg0%26p1%3Darg1%26p2%3Darg2%26yoursoul%3DaXNtaW5l') 'https://www.google.com/url?q=https://www.example.com/foo.php?p0=arg0&p1=arg1&p2=arg2&yoursoul=aXNtaW5l' >>> from base64 import b64decode as bd >>> bd(b'aXNtaW5l') b'ismine' >>> Copy into clipboard: https://www.example.com/foo.php https://www.example.com/foo.php Ctrl+D Ctrl+D Why I even bother in 2021? I don't know.
dheera 5y ago
PSA: (a) Disable automatic loading of e-mails in Gmail if you don't want to be tracked. (b) Don't ever click links from e-mails, Google for the content instead. Settings -> General -> Images -> Ask before displaying external images (I've also been debating sending an auto-reply back to users of such e-mail apps (e.g. Superhuman) with an autoresponse to the effect of "Due to the use of tracking pixels your e-mail has been de-prioritized. If you would like a faster response please send me a plain text e-mail" to discourage people from using these privacy invasions.)
OldGoodNewBad 5y ago
Do people load remote images in 2021?
- LeifCarrotson 5y ago
  Those that do get counted and optimized for. The rest of us might as well not exist.
- doc_gunthrop 5y ago
  That's like asking "do people allow javascript when opening webpages in 2021?" It's common for browser-based email services (such as Gmail) to default to loading remote images.
  - seedless-sensat 5y ago
    My impression is that Gmail prefetches ALL email images, and then serves them to the reader via their CDN. (Checking a random email in my inbox demonstrates this, https://ci3.googleusercontent.com/proxy/ https://ci3.googleusercontent.com/proxy/...) As a result, I thought there was no signal for tracking pixels? I might be wrong though
    - neolog 5y ago
      They know when google loads the image, which is when you open the email.
      - spicybright 5y ago
        They only know when google fetches the image, which can be any time between you receiving it and opening it. I highly doubt it's on the fly right when you open it.
        snowwrestler 5y ago
        It is in fact on the fly when you open it. All Gmail does is proxy the request to hide your IP from the server hosting the image file. Gmail does not change the timing of the request, the URL, or the image file.
legitster 5y ago
There's also Litmus, which uses a really advanced set of multiple pixels to give data on how long a user is reading an email. Presumably, they insert delays into how long it takes to load each pixel, and if any of the requests get cancelled they can get an idea of how long the email was open for. The Litmus pixels are usually dropped into another ESP's template, so the data you get would be used to supplement the normal tracking pixel email.
- cmehdy 5y ago
  Is it done with the "loading" attribute[1] for the img tag? (i.e. lazy loading) (in which case I assume it's only useful in some instances, since viewports might be of various sizes and there aren't that many emails that are long enough[2] to involve much scrolling for example. [1] https://developer.mozilla.org/en-US/docs/Web/Performance/Lazy_loading#images_and_iframes https://developer.mozilla.org/en-US/docs/Web/Performance/Laz... [2] https://sleeknote.com/blog/ideal-email-length https://sleeknote.com/blog/ideal-email-length
  - anonred 5y ago
    Presumably the server just delays the response for x seconds, with the assumption that any in-flight network requests are cancelled by the email client when the user closes the window or app.
  - legitster 5y ago
    In general, email clients are really, really, really dumb. Everything gets loaded at once. So unless it was an HTML attribute that was available in the 90s, it's better to assume the magic is happening server side.
- bengtan 5y ago
  Can someone point me to a Litmus-based newsletter (or some other semi-regular email)? Happy to look, though can't promise when.
sergiotapia 5y ago
I love my Hey email because of this. they block tracking with no configuration. It's great!
- msoad 5y ago
  Do they also block tracking of link clicks?
- mike-cardwell 5y ago
  "they block tracking" They block some tracking. What percentage of tracking they block is anyones guess. 99.999%, 90%, 50%, 10% ? Who knows. Also, they don't block targetted tracking, which would be used by a stalker for example. They only block widespread well known trackers. Only way to be safe is to disable loading of all remote resources and don't click links.
- bengtan 5y ago
  I don't think they block link tracking clicks. I don't see how they could possibly do that. (Unless they take what I've discovered and incorporate it into their system. Even then, it wouldn't be 100% coverage. Some tracking links, ie. Mailchimp, can't be avoided.)
austinkhale 5y ago
Per my most recent Substack email, they have 55k+ publications, 37M+ posts, and 19M+ users. Interesting.
zzyzxd 5y ago
This is an interesting reading. Although there are more tracking mechanisms than pixels. Surely you can configure your email client to not to load remote content automatically, but most of the clients will still leak information in various html/css elements. A while ago, I used https://www.emailprivacytester.com/ https://www.emailprivacytester.com/ to test several famous iOS email clients, and most of them more or less leaked _something_, even without loading remote content. In the end, I found Fastmail and Apple's built-in iOS mail client to be the top-notch in terms of privacy (Fastmail leaked nothing but only their server side DNS server via DNS prefetch[1][2], which has nothing to do with client. Apple is slightly worse, but still far better than any other email clients like Outlook, Spark, Edison...) 1. https://www.emailprivacytester.com/testDescription?test=dnsLink https://www.emailprivacytester.com/testDescription?test=dnsL... 2. https://www.emailprivacytester.com/testDescription?test=dnsAnchor https://www.emailprivacytester.com/testDescription?test=dnsA...
- lprd 5y ago
  > Surely you can configure your email client to not to load remote content automatically, but most of the clients will still leak information in various html/css elements. I believe MailMate does this by default? I've been using MailMate for a little over a year now and I've fallen completely in love with it. https://freron.com/ https://freron.com/
  - defaultuser9 5y ago
    Long time user of MailMate and was just about to ask this! I love MailMate for this privacy feature and ability to compose in markdown (P.S. - this is also my first HN comment ever)
- entropyie 5y ago
  My email client / provider leaked only DNS prefetch... nothing else... Before I even opened the message! I reckon it was my provider, as the IP address reported was wrong for me.
- ipaddr 5y ago
  Thunderbird by default. Turning in html should be an option done only when really needed.
dynm 5y ago
Here's an question... Suppose I'd like to send emails that include images. The images are content, I don't care about tracking. Is there any way to do that in a way that's privacy friendly? The natural way of doing this would be embedded images. However, it seems that many mail clients don't support these. (https://www.emaillistvalidation.com/blog/embedded-image-support-in-html-email/ https://www.emaillistvalidation.com/blog/embedded-image-supp...) Are there any other options? The only other option I can see would be to use SVG images and then sort of "compile" the SVG into the html source. However, given how email clients have limited html support, this doesn't seem workable either... It's frustrating that these tracking pixels have made genuine content images so unreliable.
- colechristensen 5y ago
  Gmail proxies images, if you send everybody the same image you will get very little information about who is grabbing the image and when (i.e. you'll be able to tell when google (re)populates the cache which gives some small indication that your email is being opened).
  - dynm 5y ago
    This indeed prevents me from tracking. I should have been more clear that my "real" goal is that privacy-sensitive readers will be able to see images. I think these people won't know that the image isn't unique, and so won't load the images.
- kayodelycaon 5y ago
  The email validation page is incorrect (possible due to being out of date). Apple Mail on iPhone can render embedded images just like Safari can. I use them in a few personal projects.
- legitster 5y ago
  Tracking pixels and tracking links only work because there are unique identifiers in the URL. So if you just reference the image's direct link in the HTML of the email there's really no information to be gleaned outside of the normal email server handshake. However, when Google proxies the image in an email, there is no way for the user to know the original URL and see if it has a unique identifier or not.
reader_1000 5y ago
One interesting thing I noticed with Linkedin emails is that it dynamically fetches unread notification count. For example, if someone views your profile, there will be a notification in the website. If you go to your mail and open an old Linkedin email before you check the notification in the website, you will see a little red 1 on the corner of Linkedin logo. Later, if you go to website, clear notification, and then open the same email, you will see that notification counter is gone. If find it quite interesting that Gmail lets this behaviour.
- RussianCow 5y ago
  The image is dynamically generated at request time, so there isn't much Gmail can do, aside from eagerly preloading all images as soon as the email comes in.
  - reader_1000 5y ago
    As far as I remember, Gmail used to prefetch images to prevent senders learning if and when recepient opens an email, but if this behaviour changed, I didn't know that.
    - snowwrestler 5y ago
      All Gmail does (or ever did) is proxy the image file so the server hosting it cannot do reverse IP lookup to collect client metadata like geolocation. The server hosting the image sees a Google IP address request the image, not (for example) your phone’s IP address. But the image request still happens at the time you open the email. Google does not prefetch the images in unopened emails. And if the image URL is personalized, it can still be correlated with your email address by the sender to record an open. Google does not try to guess which part of the URL they can dump without breaking the image.
- have_faith 5y ago
  >gmail let's this behaviour I'm assuming the server is just responding with a different image depending on a query param embedded in the image url? (an old technique), what should google do? any remote image url could respond with a new image in an old email it's just rare that it happens.
polyrand 5y ago
Related to the post, I've enjoyed using the Trocker extension[0]. [0] https://trockerapp.github.io/ https://trockerapp.github.io/
- jerrygoyal 5y ago
  I wish something like this existed for Mobile also. Seems like it's impossible to block trackers from gmail app.
  - polyrand 5y ago
    I guess your best chance in mobile is blocking automatic image loading, at least to avoid tracking pixels.
blibble 5y ago
if you were a large email service and you really wanted to mess with this sort of tracking could you - fetch the images at the point the mail is accepted for delivery - cache the result - rewrite the URLs transparently in the UI to point to your cached copy
- legitster 5y ago
  This is already how Gmail handles images.
  - mike-cardwell 5y ago
    No it's not. Gmail fetches images when you open an email to read it. You can test this yourself using https://www.emailprivacytester.com https://www.emailprivacytester.com. The only thing Gmail does is hide your IP when it fetches the image. It doesn't hide the fact that you've opened the email. Which frankly, is the most useful piece of information to the tracker.
    - legitster 5y ago
      The email privacy detector is seeing Google fetch the image. In the HTML of the email the sent me the image URL points to a Google proxy link. On subsequent opens of the email, the detector is not seeing the image being requested again. Unless you were proposing the email server should download and proxy ALL images, even before the email is delivered. Some anti-spam clients already do a version of this, although it should be noted that giving an email sender the signal that you are eagerly reading all of their emails may produce unintended consequences.
      - mike-cardwell 5y ago
        > Unless you were proposing the email server should download and proxy ALL images, even before the email is delivered. That is precisely what the OP proposed, and which you then stated is the way that gmail works. I then pointed out that gmail does not work that way. And you have now confirmed that. > giving an email sender the signal that you are eagerly reading all of their emails may produce unintended consequences. That's the whole point of this. The moment the big providers implement "fetch on delivery", there is no signal any more. The spammers wont suddenly think, "oh look, our spam campagain is going swimmingly. 100% of our gmail, hotmail and yahoo recipients are now opening our email", and then continue along oblivious of this new major change from all the main email providers, thinking that all of their email is being opened.
smbv 5y ago
CyberChef helped me decode the URL: It was a zlib deflate and a URL-safe Base64 code. https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9-_',false)Zlib_Inflate(0,0,'Adaptive',false,false)From_Quoted_Printable()&input=ZUp5TmpMME9nekFRZzUtR2JLQmNPQUlaTXJSUVhnUGw3eWdTaEtwTjFkY3ZvQTRka2V6QmxqOTdqYzVDRFd6U2dndmdsY0RkeUFzb1VNcTI3N29PaGJyZUJMUVpjaHZpbUV3czNMcXd1M1lLRkRsRkhCdkhxNXE3V29WZ1NLRVRFb1VuTnV0N1NvOVhWbDR5MFdfNnc3ZkVudnBYd0hZOUxtYWFqLU9rUzZpRE5FUTVKMGs1LW1CejZ3UGxwa0pIalRKR1FjWHNPNlUxLXZVVGg3Q3p3LVRQZ2NmNjFQUUxVdFJWdXc https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z... Update: Finishing reading the article, someone beat me to this.
eric4smith 5y ago
Here we are talking as if it’s the big companies that’s the problem. The problem is their clients. Your mom and pop store down the street sending out the weekly newsletter that helps keeps their business alive is the ones sending the mail that annoys you so. The mail sending companies offered the feature of knowing when a subscriber opened an email and when they clicked on something. So that tiny blogger who sends a weekly update in sub stack to subscribers eagerly awaits her click and open stats. It’s hard for the likes of Mailchimp to pull back those features because their customers so rely on them. How do I know? I write this kind of sending software all the time for thousands of these small customers. We are talking husband and wife operations here. People who know nothing about email sending or what goes on behind it. But take away their click and open tracking and you lose their business the next day —- that part — they know and want. Add in the part of them knowing who opened and who clicked on what and it’s gosh darned magic for most small business owners. Don’t blame Mailchimp, Sendgrid, Substack etc — that’s pointless. Blame your mom as she sits writing next weeks newsletter update.
- Santosh83 5y ago
  Apart from unproductive blame, what would be a solution, or set of solutions, that could make everyone happy here?
  - throwaways885 5y ago
    Email open tracking where an association isn't being made is fine, much like the web counters of ole.
miked85 5y ago
I have found MailTrackerBlocker [1] to be useful to block tracking. 1. https://github.com/apparition47/MailTrackerBlocker https://github.com/apparition47/MailTrackerBlocker
withinboredom 5y ago
Opening emails in text mode (vs. HTML mode) usually results in links stripped of tracking information.
kevincox 5y ago
After using Firefox's HTTPS only mode I have noticed that quite disturbingly a lot of these auto-injected tracking links redirect through HTTP. I have seen nearly a dozen of websites that have this for password reset links. It makes me wonder if it could be a viable attack to set up a WiFi hotspot, block login attempts so that some users think that they forgot their password (the error won't be right, but many users may try resetting their password anyways). Then you just intercept the HTTP tracking link and reset their password for them. Now you have stolen their account. Of course you could just do this passively but prompting it by trying to fail login attempts would get you more hits.

173 points by bengtan 5y ago

Hi, Author here. This investigation into email tracking attempts to deconstruct tracking links and pixels and highlight the data that is being collected. It covers Mailchimp, ConvertKit, Substack and other Mailgun retailers. There's also some attempted (albeit unsuccessful) reverse-engineering of an opaque token in the Substack section (If you like reading stuff about reverse-engineering). Happy to answer any questions. Thanks.

verdverm 5y ago
Nice work! Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users...
- dewey 5y ago
  > Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users... But that's usually done to add "state" to emails so they can be tied to one thread in the support system and people can reply to either the email chain or via some web interface. I don't think you necessarily want to interfere with that.
  - verdverm 5y ago
    There are privacy considerations on the unknown users side. Have I consented to HubSpot (et al) having PII and my email contents? (I don't know how this works today, with the GDPR, any future privacy laws) I have more experience with the sales product than the support ones, where typically more sensitive information can be discussed.
- codingdave 5y ago
  How does that work? I mean, sure they can BCC an address when they send an email, but any replies that I send back won't include that BCC?
  - verdverm 5y ago
    If I reply to your reply, then they see the chain. I can only imagine how much insider info they could be holding on to. Also of concern, are you even aware which emails / other people have be uploaded to their systems?
    - codingdave 5y ago
      Ah, gotcha. That makes sense. As far as insider info, most larger companies I've been at use a variety of confidentiality levels for their data, the highest of which cannot be emailed or put in the cloud. I believe that most corporate governance professionals are well aware of the risks and options for how to work with such things. But to be fair, your average office worker is not, so compliance with such policies becomes a cultural and education concern.
- bengtan 5y ago
  I don't have any regular emails from them so I don't have any data to work with. If someone can point me to a Salesforce or HubSpot newsletter, I can susbcribe, get some samples, and then investigate. Re: BCC ... Uh, that's a totally different topic/mechanism and I have no comment on it.
  - bombcar 5y ago
    You can subscribe to Hubspot's newsletter here: https://blog.hubspot.com https://blog.hubspot.com (I assume they use hubspot lol). Same with salesforce: https://www.salesforce.com/form/other/role-based-newsletter/ https://www.salesforce.com/form/other/role-based-newsletter/
02thoeva 5y ago
Convertkit is a front-end for Sendgrid, so possibly they use the same format as them?
- bengtan 5y ago
  Possibly, but I don't know. If someone points me to a Sendgrid-based newsletter that I can subscribe to, I'd be happy to look.
  - Thoughtful 5y ago
    Mondo uses SendGrid. They have a subscription bar at the bottom of the homepage: mondoshop.com
OrvalWintermute 5y ago
Appreciated the blog post, I found it very handy in understanding the tracking activities. Looking forward to more!

SimeVidas 5y ago

Those tracking links are so annoying. They make it hard to see where the link is actually going. A newsletter could be linking to Wikipedia, but if you open the message in Gmail, there could be two or more layers of trackers in that URL. Example: The Frontend Focus newsletter in Gmail The link of the first news headline is something like https://www.google.com/url?q=https%3A%2F%2Ffrontendfoc.us%2Flink%2F109272%2Fc0daad1d97&sa=D&sntz=1&usg=AFQgCNFEh5TaNZpHqsqyBGWEaq2iL9MwCg The actual URL is https://www.slashgear.com/safari-overhaul-includes-tab-groups-and-web-extensions-on-mobile-07676634/

twobitshifter 5y ago
Yes and then if you use a content blocker the link will inevitably end up blocked.
professorsnep 5y ago
I just had to deal with an annoying tracking link to unsubscribe from an unsolicited mailing list. uBlock even blocked the link click, I had to temporarily allow the tracker to unsubscribe.
- legitster 5y ago
  Unsubscribe links have to have your identifier in them so you know who to unsubscribe when you click the link. We used to ask people for their email address to unsubscribe them, but then they accused us of using a dark pattern to keep them subscribed. So letting people unsubscribe easier with fewer hoops to jump through seems like the lesser of two evils.
boneitis 5y ago
Of course, this does nothing to subvert the tracking services like mailchimp that bury the final destination behind their own link, but... Ctrl+Alt+T $ python3 >>> from urllib import parse >>> parse.unquote('https%3A//www.google.com/url%3Fq%3Dhttps%3A//www.example.com/foo.php%3Fp0%3Darg0%26p1%3Darg1%26p2%3Darg2%26yoursoul%3DaXNtaW5l') 'https://www.google.com/url?q=https://www.example.com/foo.php?p0=arg0&p1=arg1&p2=arg2&yoursoul=aXNtaW5l' >>> from base64 import b64decode as bd >>> bd(b'aXNtaW5l') b'ismine' >>> Copy into clipboard: https://www.example.com/foo.php https://www.example.com/foo.php Ctrl+D Ctrl+D Why I even bother in 2021? I don't know.

dheera 5y ago

PSA: (a) Disable automatic loading of e-mails in Gmail if you don't want to be tracked. (b) Don't ever click links from e-mails, Google for the content instead. Settings -> General -> Images -> Ask before displaying external images (I've also been debating sending an auto-reply back to users of such e-mail apps (e.g. Superhuman) with an autoresponse to the effect of "Due to the use of tracking pixels your e-mail has been de-prioritized. If you would like a faster response please send me a plain text e-mail" to discourage people from using these privacy invasions.)

OldGoodNewBad 5y ago

Do people load remote images in 2021?

LeifCarrotson 5y ago
Those that do get counted and optimized for. The rest of us might as well not exist.
doc_gunthrop 5y ago
That's like asking "do people allow javascript when opening webpages in 2021?" It's common for browser-based email services (such as Gmail) to default to loading remote images.
- seedless-sensat 5y ago
  My impression is that Gmail prefetches ALL email images, and then serves them to the reader via their CDN. (Checking a random email in my inbox demonstrates this, https://ci3.googleusercontent.com/proxy/ https://ci3.googleusercontent.com/proxy/...) As a result, I thought there was no signal for tracking pixels? I might be wrong though
  - neolog 5y ago
    They know when google loads the image, which is when you open the email.
    - spicybright 5y ago
      They only know when google fetches the image, which can be any time between you receiving it and opening it. I highly doubt it's on the fly right when you open it.
      - snowwrestler 5y ago
        It is in fact on the fly when you open it. All Gmail does is proxy the request to hide your IP from the server hosting the image file. Gmail does not change the timing of the request, the URL, or the image file.

legitster 5y ago

There's also Litmus, which uses a really advanced set of multiple pixels to give data on how long a user is reading an email. Presumably, they insert delays into how long it takes to load each pixel, and if any of the requests get cancelled they can get an idea of how long the email was open for. The Litmus pixels are usually dropped into another ESP's template, so the data you get would be used to supplement the normal tracking pixel email.

cmehdy 5y ago
Is it done with the "loading" attribute[1] for the img tag? (i.e. lazy loading) (in which case I assume it's only useful in some instances, since viewports might be of various sizes and there aren't that many emails that are long enough[2] to involve much scrolling for example. [1] https://developer.mozilla.org/en-US/docs/Web/Performance/Lazy_loading#images_and_iframes https://developer.mozilla.org/en-US/docs/Web/Performance/Laz... [2] https://sleeknote.com/blog/ideal-email-length https://sleeknote.com/blog/ideal-email-length
- anonred 5y ago
  Presumably the server just delays the response for x seconds, with the assumption that any in-flight network requests are cancelled by the email client when the user closes the window or app.
- legitster 5y ago
  In general, email clients are really, really, really dumb. Everything gets loaded at once. So unless it was an HTML attribute that was available in the 90s, it's better to assume the magic is happening server side.
bengtan 5y ago
Can someone point me to a Litmus-based newsletter (or some other semi-regular email)? Happy to look, though can't promise when.

sergiotapia 5y ago

I love my Hey email because of this. they block tracking with no configuration. It's great!

msoad 5y ago
Do they also block tracking of link clicks?
mike-cardwell 5y ago
"they block tracking" They block some tracking. What percentage of tracking they block is anyones guess. 99.999%, 90%, 50%, 10% ? Who knows. Also, they don't block targetted tracking, which would be used by a stalker for example. They only block widespread well known trackers. Only way to be safe is to disable loading of all remote resources and don't click links.
bengtan 5y ago
I don't think they block link tracking clicks. I don't see how they could possibly do that. (Unless they take what I've discovered and incorporate it into their system. Even then, it wouldn't be 100% coverage. Some tracking links, ie. Mailchimp, can't be avoided.)

austinkhale 5y ago

Per my most recent Substack email, they have 55k+ publications, 37M+ posts, and 19M+ users. Interesting.

zzyzxd 5y ago

This is an interesting reading. Although there are more tracking mechanisms than pixels. Surely you can configure your email client to not to load remote content automatically, but most of the clients will still leak information in various html/css elements. A while ago, I used https://www.emailprivacytester.com/ https://www.emailprivacytester.com/ to test several famous iOS email clients, and most of them more or less leaked _something_, even without loading remote content. In the end, I found Fastmail and Apple's built-in iOS mail client to be the top-notch in terms of privacy (Fastmail leaked nothing but only their server side DNS server via DNS prefetch[1][2], which has nothing to do with client. Apple is slightly worse, but still far better than any other email clients like Outlook, Spark, Edison...) 1. https://www.emailprivacytester.com/testDescription?test=dnsLink https://www.emailprivacytester.com/testDescription?test=dnsL... 2. https://www.emailprivacytester.com/testDescription?test=dnsAnchor https://www.emailprivacytester.com/testDescription?test=dnsA...

lprd 5y ago
> Surely you can configure your email client to not to load remote content automatically, but most of the clients will still leak information in various html/css elements. I believe MailMate does this by default? I've been using MailMate for a little over a year now and I've fallen completely in love with it. https://freron.com/ https://freron.com/
- defaultuser9 5y ago
  Long time user of MailMate and was just about to ask this! I love MailMate for this privacy feature and ability to compose in markdown (P.S. - this is also my first HN comment ever)
entropyie 5y ago
My email client / provider leaked only DNS prefetch... nothing else... Before I even opened the message! I reckon it was my provider, as the IP address reported was wrong for me.
ipaddr 5y ago
Thunderbird by default. Turning in html should be an option done only when really needed.

dynm 5y ago

Here's an question... Suppose I'd like to send emails that include images. The images are content, I don't care about tracking. Is there any way to do that in a way that's privacy friendly? The natural way of doing this would be embedded images. However, it seems that many mail clients don't support these. (https://www.emaillistvalidation.com/blog/embedded-image-support-in-html-email/ https://www.emaillistvalidation.com/blog/embedded-image-supp...) Are there any other options? The only other option I can see would be to use SVG images and then sort of "compile" the SVG into the html source. However, given how email clients have limited html support, this doesn't seem workable either... It's frustrating that these tracking pixels have made genuine content images so unreliable.

colechristensen 5y ago
Gmail proxies images, if you send everybody the same image you will get very little information about who is grabbing the image and when (i.e. you'll be able to tell when google (re)populates the cache which gives some small indication that your email is being opened).
- dynm 5y ago
  This indeed prevents me from tracking. I should have been more clear that my "real" goal is that privacy-sensitive readers will be able to see images. I think these people won't know that the image isn't unique, and so won't load the images.
kayodelycaon 5y ago
The email validation page is incorrect (possible due to being out of date). Apple Mail on iPhone can render embedded images just like Safari can. I use them in a few personal projects.
legitster 5y ago
Tracking pixels and tracking links only work because there are unique identifiers in the URL. So if you just reference the image's direct link in the HTML of the email there's really no information to be gleaned outside of the normal email server handshake. However, when Google proxies the image in an email, there is no way for the user to know the original URL and see if it has a unique identifier or not.

reader_1000 5y ago

One interesting thing I noticed with Linkedin emails is that it dynamically fetches unread notification count. For example, if someone views your profile, there will be a notification in the website. If you go to your mail and open an old Linkedin email before you check the notification in the website, you will see a little red 1 on the corner of Linkedin logo. Later, if you go to website, clear notification, and then open the same email, you will see that notification counter is gone. If find it quite interesting that Gmail lets this behaviour.

RussianCow 5y ago
The image is dynamically generated at request time, so there isn't much Gmail can do, aside from eagerly preloading all images as soon as the email comes in.
- reader_1000 5y ago
  As far as I remember, Gmail used to prefetch images to prevent senders learning if and when recepient opens an email, but if this behaviour changed, I didn't know that.
  - snowwrestler 5y ago
    All Gmail does (or ever did) is proxy the image file so the server hosting it cannot do reverse IP lookup to collect client metadata like geolocation. The server hosting the image sees a Google IP address request the image, not (for example) your phone’s IP address. But the image request still happens at the time you open the email. Google does not prefetch the images in unopened emails. And if the image URL is personalized, it can still be correlated with your email address by the sender to record an open. Google does not try to guess which part of the URL they can dump without breaking the image.
have_faith 5y ago
>gmail let's this behaviour I'm assuming the server is just responding with a different image depending on a query param embedded in the image url? (an old technique), what should google do? any remote image url could respond with a new image in an old email it's just rare that it happens.

polyrand 5y ago

Related to the post, I've enjoyed using the Trocker extension[0]. [0] https://trockerapp.github.io/ https://trockerapp.github.io/

jerrygoyal 5y ago
I wish something like this existed for Mobile also. Seems like it's impossible to block trackers from gmail app.
- polyrand 5y ago
  I guess your best chance in mobile is blocking automatic image loading, at least to avoid tracking pixels.

blibble 5y ago

if you were a large email service and you really wanted to mess with this sort of tracking could you - fetch the images at the point the mail is accepted for delivery - cache the result - rewrite the URLs transparently in the UI to point to your cached copy

legitster 5y ago
This is already how Gmail handles images.
- mike-cardwell 5y ago
  No it's not. Gmail fetches images when you open an email to read it. You can test this yourself using https://www.emailprivacytester.com https://www.emailprivacytester.com. The only thing Gmail does is hide your IP when it fetches the image. It doesn't hide the fact that you've opened the email. Which frankly, is the most useful piece of information to the tracker.
  - legitster 5y ago
    The email privacy detector is seeing Google fetch the image. In the HTML of the email the sent me the image URL points to a Google proxy link. On subsequent opens of the email, the detector is not seeing the image being requested again. Unless you were proposing the email server should download and proxy ALL images, even before the email is delivered. Some anti-spam clients already do a version of this, although it should be noted that giving an email sender the signal that you are eagerly reading all of their emails may produce unintended consequences.
    - mike-cardwell 5y ago
      > Unless you were proposing the email server should download and proxy ALL images, even before the email is delivered. That is precisely what the OP proposed, and which you then stated is the way that gmail works. I then pointed out that gmail does not work that way. And you have now confirmed that. > giving an email sender the signal that you are eagerly reading all of their emails may produce unintended consequences. That's the whole point of this. The moment the big providers implement "fetch on delivery", there is no signal any more. The spammers wont suddenly think, "oh look, our spam campagain is going swimmingly. 100% of our gmail, hotmail and yahoo recipients are now opening our email", and then continue along oblivious of this new major change from all the main email providers, thinking that all of their email is being opened.

smbv 5y ago

CyberChef helped me decode the URL: It was a zlib deflate and a URL-safe Base64 code. https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9-_',false)Zlib_Inflate(0,0,'Adaptive',false,false)From_Quoted_Printable()&input=ZUp5TmpMME9nekFRZzUtR2JLQmNPQUlaTXJSUVhnUGw3eWdTaEtwTjFkY3ZvQTRka2V6QmxqOTdqYzVDRFd6U2dndmdsY0RkeUFzb1VNcTI3N29PaGJyZUJMUVpjaHZpbUV3czNMcXd1M1lLRkRsRkhCdkhxNXE3V29WZ1NLRVRFb1VuTnV0N1NvOVhWbDR5MFdfNnc3ZkVudnBYd0hZOUxtYWFqLU9rUzZpRE5FUTVKMGs1LW1CejZ3UGxwa0pIalRKR1FjWHNPNlUxLXZVVGg3Q3p3LVRQZ2NmNjFQUUxVdFJWdXc https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z... Update: Finishing reading the article, someone beat me to this.

eric4smith 5y ago

Here we are talking as if it’s the big companies that’s the problem. The problem is their clients. Your mom and pop store down the street sending out the weekly newsletter that helps keeps their business alive is the ones sending the mail that annoys you so. The mail sending companies offered the feature of knowing when a subscriber opened an email and when they clicked on something. So that tiny blogger who sends a weekly update in sub stack to subscribers eagerly awaits her click and open stats. It’s hard for the likes of Mailchimp to pull back those features because their customers so rely on them. How do I know? I write this kind of sending software all the time for thousands of these small customers. We are talking husband and wife operations here. People who know nothing about email sending or what goes on behind it. But take away their click and open tracking and you lose their business the next day —- that part — they know and want. Add in the part of them knowing who opened and who clicked on what and it’s gosh darned magic for most small business owners. Don’t blame Mailchimp, Sendgrid, Substack etc — that’s pointless. Blame your mom as she sits writing next weeks newsletter update.

Santosh83 5y ago
Apart from unproductive blame, what would be a solution, or set of solutions, that could make everyone happy here?
- throwaways885 5y ago
  Email open tracking where an association isn't being made is fine, much like the web counters of ole.

miked85 5y ago

I have found MailTrackerBlocker [1] to be useful to block tracking. 1. https://github.com/apparition47/MailTrackerBlocker https://github.com/apparition47/MailTrackerBlocker

withinboredom 5y ago

Opening emails in text mode (vs. HTML mode) usually results in links stripped of tracking information.

kevincox 5y ago

After using Firefox's HTTPS only mode I have noticed that quite disturbingly a lot of these auto-injected tracking links redirect through HTTP. I have seen nearly a dozen of websites that have this for password reset links. It makes me wonder if it could be a viable attack to set up a WiFi hotspot, block login attempts so that some users think that they forgot their password (the error won't be right, but many users may try resetting their password anyways). Then you just intercept the HTTP tracking link and reset their password for them. Now you have stolen their account. Of course you could just do this passively but prompting it by trying to fail login attempts would get you more hits.