3 ms·
Hi, Author here. This investigation into email tracking attempts to deconstruct tracking links and pixels and highlight the data that is being collected. It c
by bengtan 5y ago
Hi,
Author here.
This investigation into email tracking attempts to deconstruct tracking links and pixels and highlight the data that is being collected. It covers Mailchimp, ConvertKit, Substack and other Mailgun retailers.
There's also some attempted (albeit unsuccessful) reverse-engineering of an opaque token in the Substack section (If you like reading stuff about reverse-engineering).
Happy to answer any questions.
Thanks.
- verdverm 5y agoNice work! Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users...
- dewey 5y ago> Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users... But that's usually done to add "state" to emails so they can be tied to one thread in the support system and people can reply to either the email chain or via some web interface. I don't think you necessarily want to interfere with that.
- verdverm 5y agoThere are privacy considerations on the unknown users side. Have I consented to HubSpot (et al) having PII and my email contents? (I don't know how this works today, with the GDPR, any future privacy laws) I have more experience with the sales product than the support ones, where typically more sensitive information can be discussed.
- codingdave 5y agoHow does that work? I mean, sure they can BCC an address when they send an email, but any replies that I send back won't include that BCC?
- verdverm 5y agoIf I reply to your reply, then they see the chain. I can only imagine how much insider info they could be holding on to. Also of concern, are you even aware which emails / other people have be uploaded to their systems?
- codingdave 5y agoAh, gotcha. That makes sense. As far as insider info, most larger companies I've been at use a variety of confidentiality levels for their data, the highest of which cannot be emailed or put in the cloud. I believe that most corporate governance professionals are well aware of the risks and options for how to work with such things. But to be fair, your average office worker is not, so compliance with such policies becomes a cultural and education concern.
- bengtan 5y agoI don't have any regular emails from them so I don't have any data to work with. If someone can point me to a Salesforce or HubSpot newsletter, I can susbcribe, get some samples, and then investigate. Re: BCC ... Uh, that's a totally different topic/mechanism and I have no comment on it.
- bombcar 5y agoYou can subscribe to Hubspot's newsletter here: https://blog.hubspot.com https://blog.hubspot.com (I assume they use hubspot lol). Same with salesforce: https://www.salesforce.com/form/other/role-based-newsletter/ https://www.salesforce.com/form/other/role-based-newsletter/
- 02thoeva 5y agoConvertkit is a front-end for Sendgrid, so possibly they use the same format as them?
- bengtan 5y agoPossibly, but I don't know. If someone points me to a Sendgrid-based newsletter that I can subscribe to, I'd be happy to look.
- Thoughtful 5y agoMondo uses SendGrid. They have a subscription bar at the bottom of the homepage: mondoshop.com
- OrvalWintermute 5y agoAppreciated the blog post, I found it very handy in understanding the tracking activities. Looking forward to more!