8 ms·

How to Delete Gmail Attachments Without Deleting the Emails

137 points by strnisa 4y ago

rajasimon 4y ago
What do they mean by this word "has been verified by Google"? Say If I have the app that involve third-party and verifying badge provided by the same third-party is life changing.
- encryptluks2 4y ago
  It is ridiculous. They have a publicly verified OAuth API app on Google. This doesn't mean much as I have many. It isn't any serious security audit.
- scottydelta 4y ago
  It's a marketing shenanigan.
- strnisa 4y ago
  Disclaimer: I’m the author of the web app. The web app needs write permissions to the user’s Gmail account. In such cases, Google requires the author to explain how the permissions are used, submit a video showing this, and ideally to have a reference from someone working at Google.
1659447091 4y ago
This reminded me of a google apps script hack/solution on stack overflow [1] Havent used it in awhile so not sure if anything changed [1] https://stackoverflow.com/questions/46434390/remove-an-attachment-of-a-gmail-email-with-google-apps-script/46591868 https://stackoverflow.com/questions/46434390/remove-an-attac...
- strnisa 4y ago
  Yes, Gmail API does not support this out of the box. However, you can download the raw email, update it locally, upload the modified copy, and then delete the original. This is how the web app (Unattach) described in the blog post does it. Disclaimer: I am the author.
  - teruakohatu 4y ago
    Any chance of an client side app?
    - strnisa 4y ago
      It is a client-side app that runs inside the browser. Or do you mean something else?
nousermane 4y ago
Mutt can do that. Open an email, "v", select attachment to delete, "d". Done. Works with gmail, too - assuming you've jumped through the necessary hoops to enable full read-write IMAP access to your account. Edit: Hoops are: - Gmail Settings > Enable IMAP - Gmail Settings > Auto-Expunge: off - Gmail Settings > When a message is marked as deleted and expunged from the last visible IMAP folder: Immediately delete the message forever - Gmail Settings > Folder size limits: Do not limit - Account Settings > Secutiry > Signing in > App password > (create one)
- strnisa 4y ago
  Does it work for all types of attachments (e.g. inline) and can be done across many emails at once? Can it add information about what was removed?
  - nousermane 4y ago
    Yes, for any attachment/mime-section ("inline" is just a flag of "Content-Disposition" header in corresponding mime section). No, across many emails, at least not without writing some macros. Sort-of, labeling deleted attachment. You can attach a label to whole email, or edit raw, to edit/replace an attachment with placeholder/label text. A bit fiddly, but doable with some vim-fu.
    - strnisa 4y ago
      I've just tried doing this with Mutt. It's quite awkward, but (after fidling with the interface) it did create a new email with an empty attachment, i.e. the attachment is still there, but it has zero bytes. Also, the original email remained within Gmail. So, it seems that Mutt doesn't work well with Gmail for this use case. (Disclaimer: I am the author of the web app Unattach.)
      - nousermane 4y ago
        > Also, the original email remained within Gmail. That's a "feature" of gmail's IMAP server that is easy to confuse for a client bug - see pugio's comment about having exact same problem when using Thunderbird. Gmail knows nothing about folders (where given email is in exactly one of those), instead using "labels" (which an email can have zero or more of). Problematic "feature" here is that their IMAP interface exposes labels as folders. So, if client asks server to delete message from given folder, instead gmail removes label with that name (then adds "Archive" label, to confuse thing just that little bit more) Luckily, there is an obscure "When a message is marked as deleted and expunged from the last visible IMAP folder" option to rectify this intentional defect.
kevincox 4y ago
Thunderbird can also do this. You can select which attachments to remove. IDK if it supports in-place quality reduction though.
- pugio 4y ago
  I tried to use Thunderbird for this for a while, but there's a weird bug where it creates copies of emails that have the deleted attachments. You then have to delete those copies to fully delete everything. Switch to the featured app here and everything worked seamlessly. Definitely worth it, as this way I don't have to pay for Google storage and can clean out a bunch of pure junk from my emails.
  - nousermane 4y ago
    > there's a weird bug where it creates copies of emails that have the deleted attachments. As saying goes, it's not a bug, it a feature. You can disable it by setting following gmail options: - Auto-Expunge: off - When a message is marked as deleted and expunged from the last visible IMAP folder: Immediately delete the message forever
- strnisa 4y ago
  Yes, you can remove attachments with Thunderbird, but it requires a lot of configuration and it is highly error-prone. Disclaimer: I'm the author of Unattach.
  - psKama 4y ago
    A disclaimer about your relationship to unattach.app would be very welcome when you submit a comment about it or about their alternatives.
    - strnisa 4y ago
      Apologies, added a disclaimer now.
  - ale42 4y ago
V__ 4y ago
> From a technical point of view, the app deletes the attachment by inserting a new email (the one without the attachment) into your Gmail, and then deleting the original email (the one with the attachments). I hope there is a big warning when using the app, because this makes these emails (maybe even the whole conversation chain?) wortheless should they be needed as some kind of legal evidence.
- strnisa 4y ago
  The app will soon support the ability to back up the whole original email (in .eml format) before any changes are made, should the originals be needed for whatever reason.
  - gruez 4y ago
    Good luck explaining to a judge that the .eml backup you have on disk, with no chain of custody is just as good as the original.
    - KMnO4 4y ago
      I’ve actually never needed to present emails to a court. I assume the overwhelming majority of people could say the same.
    - angry_octet 4y ago
      If it keeps the original email then the DKIM signature from the sending domain will still be intact. As people have pointed out, it might be necessary to keep a copy of the public keys of all the senders in order to perform that validation. Frustratingly, Exchange breaks this possibility immediately, because it decomposes the email into components. It does preserve and validate some fancier signature schemes, but those are rarely used and have their own problems.
- georgyo 4y ago
  Does it though? IMAP is really kinda a object store, where the objects are emails. Modify emails stored remotely is already extremely trivial. DKIM and ARC make this a bit more secure, but they are the only way to validate an email is authentic. DKIM key rotation with providers like AWS SES and others, after a period of time it is impossible to validate old emails as authentic. For SES it takes only 9 months for that to happen.
gerdesj 4y ago
crazygringo 4y ago
I had no idea there was an API to modify the content of existing e-mails. Sorry if this is a dumb question, but doesn't this open up the ability alter e-mail history at will? And so alter e-mails you'd received and/or sent? Is there a record of this somewhere? What effect does this have on using e-mails as evidence in court cases, for example? Or is there a technical detail that necessarily gives this away?
- dataflow 4y ago
  > doesn't this open up the ability alter e-mail history at will? Yes. It should invalidate the DKIM signature though, which mainstream servers add to each email now. So it's possible to prove the contents of that email haven't been tampered with... assuming you have a record of the sending domain's public DKIM key. I imagine your email provider would have logs indicating you modified an email too, but I have no evidence of this, nor how eagerly they would dig up such logs for a court if they have any. I have no idea how people deal with this in practice in court. (What if the domain's DKIM key has changed? Is there an authoritative source of old DKIM keys for most domains?)
  - jaza 4y ago
    I highly suspect that, in the vast majority of legal proceedings (all but the most high-budget high-stakes ones), all involved simple assume that all the (PDF exports of / hard-copy print-outs of) emails in the case files are genuine. I doubt that the possibility of email tampering even occurs to them. And, in the minority of cases where it really matters, and where they really suspect foul play, them I'd assume that they rely on numerous bits of technical evidence (proxy copies, CC'ed copies, file system forensics), plus on one person's testimony vs another's, because as you say, DKIM's usefulness is limited.
    - sacrosancty 4y ago
      Isn't that the part of the trial where a lawyer asks a witness or defendant or whoever "Did you on the date X write an email saying "blah"? And the person says yes. That avoids assumptions since no-body challenges it.
fevangelou 4y ago
The business model of Unattach seems problematic though. Folks with storage issues are the ones who will not want to pay to increase storage for their Google account (not judging) but they would pay for a service to delete attachments?
- quickthrower2 4y ago
  Yes. While this service is cheaper than the upgrade, it is in a narrow space if they are competing on price. And with the files unattached you now have a convenience issue.
- ramraj07 4y ago
  Yeah who has 10 bucks a year but doesn’t have 25?
  - wonderbore 4y ago
    You missed the world of file hosting services connected to the world of piracy. Plus it’s more likely that one would pay $10, clean up the inbox and move on, compared to $25 yearly forever.
    - midoridensha 4y ago
      >You missed the world of file hosting services connected to the world of piracy. Honestly, I think this is just very different markets. With piracy (esp. of movies), you simply get a better product than if you don't use piracy: you can get stuff outside your market, you can get subtitles you don't get with your normal streaming service, you don't need to subscribe to 12 different services at once, you don't have to worry about not being able to watch a movie because your internet connection is down, you don't have to watch a bunch of ads, etc. Piracy isn't just about saving money.
      - teddyh 4y ago
        Also, no analytics are performed on you to analyze what you are watching, when, for how long, etc.
Waterluvian 4y ago
I always thought emails were immutable. I need to still believe that’s true. Also I might be wrong but one major issue I’m having is the lack of deduplication. I sent a video once and then we talked about it for a few hundred emails and all of a sudden I had used up gigabytes of my google cloud storage.
- theamk 4y ago
  They are, but nothing prevents you from deleting old email and creating a new one with all the same attributes, but without attachments. And that's exactly what happens, according to the quote from the page: > we can see the message “1 deleted message in this conversation. View message or delete forever.” at the bottom. By default, Unattach puts the original email (the one with attachments) into Gmail’s Bin.
derekzhouzhen 4y ago
I have a script to auto-delete all attachments in emails more than one month old. I think it is the only sane way to keep emails around for long-term: There is no point to keep something unsearchable and greatly bloat up your mailbox.
umvi 4y ago
This app works great. Used it to reduce my and my wife's email from 90%+ capacity back down to 20% which should be good for at least 5 years.
- strnisa 4y ago
  Thank you for the kind words. I'm glad you found my web app useful.
Ladyady 4y ago
Nice app. I'm forever running out of Google One storage and didn't realise this was possible. On your blog, as it's obvious you're the creator of the tool, I think it would go over better if you said something like: 'Fortunately, I've created a web app called Unattach that solves this use case.' Also, please consider left aligning your text as dyslexic people struggle with justified copy.
- strnisa 4y ago
  > Nice app. I'm forever running out of Google One storage and didn't realise this was possible. Thanks! If you give it a try, I'd be interested to hear your feedback. > 'Fortunately, I've created a web app called Unattach that solves this use case.' I actually had this exact phrasing in the draft version of the blog post, but was advised by some against using it, because "it's standard practice not to include attribution on these types of blog posts." I've now added it back. > Also, please consider left aligning your text as dyslexic people struggle with justified copy. Ah, I wasn't aware of this. Just changed the whole blog post to left aligned.
bartvk 4y ago
I didn't see anyone mentioning it, but the default Mail.app on macOS can do this as well. Menu bar -> Message -> Remove Attachments.
encryptluks2 4y ago
The verification badge appears to be misleading. As far as I'm aware having a public OAuth App isn't an official verification by Google and I'm surprised you haven't run into legal issues yet.
- strnisa 4y ago
  Please see my answer to this above (https://news.ycombinator.com/item?id=32467052 https://news.ycombinator.com/item?id=32467052).
  - encryptluks2 4y ago
    I saw it, but that still would not give you permission to create a badge stating your app is verified by Google. Do what you want but don't be surprised if you end up with legal repercussions at some point.
mooes 4y ago
This is something that a decent email client should do for you automatically. I hate to say this but Outlook actually works best for me for keeping my email account to a sensible size. I use a simple VB script that I trigger with a keyboard shortcut which strips all attachments from a mail but adds the filenames of the attachments stripped at the top of the mail ("Attachment(s) removed: <file1>, <file2>, ..."). Very useful to keeping track of what was actually sent. The other things that Outlook does really well is converting pesky HTML mails to plain text. I don't mean to just display them as plain text, but actually convert them to plain text, scrubbing all that superfluous HTML nonsense. Just open a mail, edit, format as plain text, save. I would love to find another (FLOSS) client that can do this as easily/efficiently. I keep all old mails (that are not spam or otherwise superfluous) in a folder in my account (not Gmail, but the same principle) and can always quickly refer back to them. 100,000s of mails over 18 years barely make a dent in my allowance -- just about a GB out of 10 GB. At that rate, I won't run out of space with this workflow before I kick the bucket.

137 points by strnisa 4y ago

What do they mean by this word "has been verified by Google"? Say If I have the app that involve third-party and verifying badge provided by the same third-party is life changing.

encryptluks2 4y ago
It is ridiculous. They have a publicly verified OAuth API app on Google. This doesn't mean much as I have many. It isn't any serious security audit.
scottydelta 4y ago
It's a marketing shenanigan.
strnisa 4y ago
Disclaimer: I’m the author of the web app. The web app needs write permissions to the user’s Gmail account. In such cases, Google requires the author to explain how the permissions are used, submit a video showing this, and ideally to have a reference from someone working at Google.

1659447091 4y ago

This reminded me of a google apps script hack/solution on stack overflow [1] Havent used it in awhile so not sure if anything changed [1] https://stackoverflow.com/questions/46434390/remove-an-attachment-of-a-gmail-email-with-google-apps-script/46591868 https://stackoverflow.com/questions/46434390/remove-an-attac...

strnisa 4y ago
Yes, Gmail API does not support this out of the box. However, you can download the raw email, update it locally, upload the modified copy, and then delete the original. This is how the web app (Unattach) described in the blog post does it. Disclaimer: I am the author.
- teruakohatu 4y ago
  Any chance of an client side app?
  - strnisa 4y ago
    It is a client-side app that runs inside the browser. Or do you mean something else?

nousermane 4y ago

Mutt can do that. Open an email, "v", select attachment to delete, "d". Done. Works with gmail, too - assuming you've jumped through the necessary hoops to enable full read-write IMAP access to your account. Edit: Hoops are: - Gmail Settings > Enable IMAP - Gmail Settings > Auto-Expunge: off - Gmail Settings > When a message is marked as deleted and expunged from the last visible IMAP folder: Immediately delete the message forever - Gmail Settings > Folder size limits: Do not limit - Account Settings > Secutiry > Signing in > App password > (create one)

strnisa 4y ago
Does it work for all types of attachments (e.g. inline) and can be done across many emails at once? Can it add information about what was removed?
- nousermane 4y ago
  Yes, for any attachment/mime-section ("inline" is just a flag of "Content-Disposition" header in corresponding mime section). No, across many emails, at least not without writing some macros. Sort-of, labeling deleted attachment. You can attach a label to whole email, or edit raw, to edit/replace an attachment with placeholder/label text. A bit fiddly, but doable with some vim-fu.
  - strnisa 4y ago
    I've just tried doing this with Mutt. It's quite awkward, but (after fidling with the interface) it did create a new email with an empty attachment, i.e. the attachment is still there, but it has zero bytes. Also, the original email remained within Gmail. So, it seems that Mutt doesn't work well with Gmail for this use case. (Disclaimer: I am the author of the web app Unattach.)
    - nousermane 4y ago
      > Also, the original email remained within Gmail. That's a "feature" of gmail's IMAP server that is easy to confuse for a client bug - see pugio's comment about having exact same problem when using Thunderbird. Gmail knows nothing about folders (where given email is in exactly one of those), instead using "labels" (which an email can have zero or more of). Problematic "feature" here is that their IMAP interface exposes labels as folders. So, if client asks server to delete message from given folder, instead gmail removes label with that name (then adds "Archive" label, to confuse thing just that little bit more) Luckily, there is an obscure "When a message is marked as deleted and expunged from the last visible IMAP folder" option to rectify this intentional defect.

kevincox 4y ago

Thunderbird can also do this. You can select which attachments to remove. IDK if it supports in-place quality reduction though.

pugio 4y ago
I tried to use Thunderbird for this for a while, but there's a weird bug where it creates copies of emails that have the deleted attachments. You then have to delete those copies to fully delete everything. Switch to the featured app here and everything worked seamlessly. Definitely worth it, as this way I don't have to pay for Google storage and can clean out a bunch of pure junk from my emails.
- nousermane 4y ago
  > there's a weird bug where it creates copies of emails that have the deleted attachments. As saying goes, it's not a bug, it a feature. You can disable it by setting following gmail options: - Auto-Expunge: off - When a message is marked as deleted and expunged from the last visible IMAP folder: Immediately delete the message forever
strnisa 4y ago
Yes, you can remove attachments with Thunderbird, but it requires a lot of configuration and it is highly error-prone. Disclaimer: I'm the author of Unattach.
- psKama 4y ago
  A disclaimer about your relationship to unattach.app would be very welcome when you submit a comment about it or about their alternatives.
  - strnisa 4y ago
    Apologies, added a disclaimer now.
- ale42 4y ago

V__ 4y ago

> From a technical point of view, the app deletes the attachment by inserting a new email (the one without the attachment) into your Gmail, and then deleting the original email (the one with the attachments). I hope there is a big warning when using the app, because this makes these emails (maybe even the whole conversation chain?) wortheless should they be needed as some kind of legal evidence.

strnisa 4y ago
The app will soon support the ability to back up the whole original email (in .eml format) before any changes are made, should the originals be needed for whatever reason.
- gruez 4y ago
  Good luck explaining to a judge that the .eml backup you have on disk, with no chain of custody is just as good as the original.
  - KMnO4 4y ago
    I’ve actually never needed to present emails to a court. I assume the overwhelming majority of people could say the same.
  - angry_octet 4y ago
    If it keeps the original email then the DKIM signature from the sending domain will still be intact. As people have pointed out, it might be necessary to keep a copy of the public keys of all the senders in order to perform that validation. Frustratingly, Exchange breaks this possibility immediately, because it decomposes the email into components. It does preserve and validate some fancier signature schemes, but those are rarely used and have their own problems.
georgyo 4y ago
Does it though? IMAP is really kinda a object store, where the objects are emails. Modify emails stored remotely is already extremely trivial. DKIM and ARC make this a bit more secure, but they are the only way to validate an email is authentic. DKIM key rotation with providers like AWS SES and others, after a period of time it is impossible to validate old emails as authentic. For SES it takes only 9 months for that to happen.

gerdesj 4y ago

crazygringo 4y ago

I had no idea there was an API to modify the content of existing e-mails. Sorry if this is a dumb question, but doesn't this open up the ability alter e-mail history at will? And so alter e-mails you'd received and/or sent? Is there a record of this somewhere? What effect does this have on using e-mails as evidence in court cases, for example? Or is there a technical detail that necessarily gives this away?

dataflow 4y ago
> doesn't this open up the ability alter e-mail history at will? Yes. It should invalidate the DKIM signature though, which mainstream servers add to each email now. So it's possible to prove the contents of that email haven't been tampered with... assuming you have a record of the sending domain's public DKIM key. I imagine your email provider would have logs indicating you modified an email too, but I have no evidence of this, nor how eagerly they would dig up such logs for a court if they have any. I have no idea how people deal with this in practice in court. (What if the domain's DKIM key has changed? Is there an authoritative source of old DKIM keys for most domains?)
- jaza 4y ago
  I highly suspect that, in the vast majority of legal proceedings (all but the most high-budget high-stakes ones), all involved simple assume that all the (PDF exports of / hard-copy print-outs of) emails in the case files are genuine. I doubt that the possibility of email tampering even occurs to them. And, in the minority of cases where it really matters, and where they really suspect foul play, them I'd assume that they rely on numerous bits of technical evidence (proxy copies, CC'ed copies, file system forensics), plus on one person's testimony vs another's, because as you say, DKIM's usefulness is limited.
  - sacrosancty 4y ago
    Isn't that the part of the trial where a lawyer asks a witness or defendant or whoever "Did you on the date X write an email saying "blah"? And the person says yes. That avoids assumptions since no-body challenges it.

fevangelou 4y ago

The business model of Unattach seems problematic though. Folks with storage issues are the ones who will not want to pay to increase storage for their Google account (not judging) but they would pay for a service to delete attachments?

quickthrower2 4y ago
Yes. While this service is cheaper than the upgrade, it is in a narrow space if they are competing on price. And with the files unattached you now have a convenience issue.
ramraj07 4y ago
Yeah who has 10 bucks a year but doesn’t have 25?
- wonderbore 4y ago
  You missed the world of file hosting services connected to the world of piracy. Plus it’s more likely that one would pay $10, clean up the inbox and move on, compared to $25 yearly forever.
  - midoridensha 4y ago
    >You missed the world of file hosting services connected to the world of piracy. Honestly, I think this is just very different markets. With piracy (esp. of movies), you simply get a better product than if you don't use piracy: you can get stuff outside your market, you can get subtitles you don't get with your normal streaming service, you don't need to subscribe to 12 different services at once, you don't have to worry about not being able to watch a movie because your internet connection is down, you don't have to watch a bunch of ads, etc. Piracy isn't just about saving money.
    - teddyh 4y ago
      Also, no analytics are performed on you to analyze what you are watching, when, for how long, etc.

Waterluvian 4y ago

I always thought emails were immutable. I need to still believe that’s true. Also I might be wrong but one major issue I’m having is the lack of deduplication. I sent a video once and then we talked about it for a few hundred emails and all of a sudden I had used up gigabytes of my google cloud storage.

theamk 4y ago
They are, but nothing prevents you from deleting old email and creating a new one with all the same attributes, but without attachments. And that's exactly what happens, according to the quote from the page: > we can see the message “1 deleted message in this conversation. View message or delete forever.” at the bottom. By default, Unattach puts the original email (the one with attachments) into Gmail’s Bin.

derekzhouzhen 4y ago

I have a script to auto-delete all attachments in emails more than one month old. I think it is the only sane way to keep emails around for long-term: There is no point to keep something unsearchable and greatly bloat up your mailbox.

umvi 4y ago

This app works great. Used it to reduce my and my wife's email from 90%+ capacity back down to 20% which should be good for at least 5 years.

strnisa 4y ago
Thank you for the kind words. I'm glad you found my web app useful.

Ladyady 4y ago

Nice app. I'm forever running out of Google One storage and didn't realise this was possible. On your blog, as it's obvious you're the creator of the tool, I think it would go over better if you said something like: 'Fortunately, I've created a web app called Unattach that solves this use case.' Also, please consider left aligning your text as dyslexic people struggle with justified copy.

strnisa 4y ago
> Nice app. I'm forever running out of Google One storage and didn't realise this was possible. Thanks! If you give it a try, I'd be interested to hear your feedback. > 'Fortunately, I've created a web app called Unattach that solves this use case.' I actually had this exact phrasing in the draft version of the blog post, but was advised by some against using it, because "it's standard practice not to include attribution on these types of blog posts." I've now added it back. > Also, please consider left aligning your text as dyslexic people struggle with justified copy. Ah, I wasn't aware of this. Just changed the whole blog post to left aligned.

bartvk 4y ago

I didn't see anyone mentioning it, but the default Mail.app on macOS can do this as well. Menu bar -> Message -> Remove Attachments.

encryptluks2 4y ago

The verification badge appears to be misleading. As far as I'm aware having a public OAuth App isn't an official verification by Google and I'm surprised you haven't run into legal issues yet.

strnisa 4y ago
Please see my answer to this above (https://news.ycombinator.com/item?id=32467052 https://news.ycombinator.com/item?id=32467052).
- encryptluks2 4y ago
  I saw it, but that still would not give you permission to create a badge stating your app is verified by Google. Do what you want but don't be surprised if you end up with legal repercussions at some point.

mooes 4y ago

This is something that a decent email client should do for you automatically. I hate to say this but Outlook actually works best for me for keeping my email account to a sensible size. I use a simple VB script that I trigger with a keyboard shortcut which strips all attachments from a mail but adds the filenames of the attachments stripped at the top of the mail ("Attachment(s) removed: <file1>, <file2>, ..."). Very useful to keeping track of what was actually sent. The other things that Outlook does really well is converting pesky HTML mails to plain text. I don't mean to just display them as plain text, but actually convert them to plain text, scrubbing all that superfluous HTML nonsense. Just open a mail, edit, format as plain text, save. I would love to find another (FLOSS) client that can do this as easily/efficiently. I keep all old mails (that are not spam or otherwise superfluous) in a folder in my account (not Gmail, but the same principle) and can always quickly refer back to them. 100,000s of mails over 18 years barely make a dent in my allowance -- just about a GB out of 10 GB. At that rate, I won't run out of space with this workflow before I kick the bucket.