4 ms·

Oh, but gmail also reveals to tracking services (i.e. virtual deliverability manager from aws ses) that you opened an email even when you disabled loading image

Oh, but gmail also reveals to tracking services (i.e. virtual deliverability manager from aws ses) that you opened an email even when you disabled loading images.

gruez 1y ago
Source?
- mystifyingpoi 1y ago
  Yeah, I wonder too. Just checked the docs, they use tracking pixels. So blocking images should block it 100%?
- kosolam 1y ago
  I tested it myself. You are welcome to do the same.
  - gruez 1y ago
    What platform (web, android, ios) did you test on, and how did you test? I used emailprivacytester.com on a few email services and gmail wasn't susceptible to any of the attacks.
    - kosolam 1y ago
      I tested it by sending an email using ses and virtual deliverability manager to my gmail account which is configured to not load images automatically. Then I observed how the open is registered in the virtual deliverability manager’s dashboard.
Barbing 1y ago
Do you know if I’m safe using Apple Mail with the relevant privacy features enabled? (w/Gmail account) Edit: one marketing site describes a new category of Apple Opens (vs. Human Opens), so sounds like the feature’s effective
Hnrobert42 1y ago
I thought Google loaded all content from all external sources upon your seat, so the sender doesn't know whether you opened it or not.
- DaiPlusPlus 1y ago
  That still tells the sender it’s a valid email address though?
  - cxr 1y ago
    > I've noticed that moving the goalposts is extremely prevalent on HN, which makes for pretty frustrating conversations (or just reading). And then sometimes it's a tag team[…] <https://news.ycombinator.com/item?id=23117242 https://news.ycombinator.com/item?id=23117242>
    - ASalazarMX 1y ago
      Politicians are masters of this tactic of deflection. The nastier, the better they are at it. Calling it out is the best one can do without getting trapped in a cycle of low-effort premises and high-effort responses. Although, as usual in HN, the premises come from different accounts, so both are valid. And it probably reveals valid addresses when the image URL is unique for each email.
    - freedomben 1y ago
      Definitely happens a lot on HN, but I think that's just the nature of a mix of different opinions. Better IMHO to just treat them as individual arguments and reply accordingly
    - DaiPlusPlus 1y ago
      > moving the goalposts I'm really not (honestly!) trying to invalidate anyone's point or win any argument - my post is more of a question-in-disguise: the GP post I was replying to concerns message-read tracking; whereas my post invokes the entirely separate matter of external actors being able to determine the validity or existence of a gmail address. I'm not moving the goalposts; you guys are talking about the NFL game's goalposts; I'm talking about the FIFA world cup game goalposts.
johnklos 1y ago
No reasonable person would ever think that Google preserves their privacy. Perhaps Google preserves it enough so they can sell whatever information they're hiding, but that's about it.
Brian_K_White 1y ago
Obviously if you're reading gmail on the web or in the official phone app, then of course every click is observable. But you can read gmail in thunderbird or any other email client, and in that case gmail still doesn't know anything more than that your client performed a sync, which it might be doing periodically at all times and so isn't meaningful.
dathery 1y ago
This is not true, SES uses tracking pixels which are blocked if you disable external images: https://docs.aws.amazon.com/ses/latest/dg/faqs-metrics.html#faqs-metrics-opens https://docs.aws.amazon.com/ses/latest/dg/faqs-metrics.html#...
theteapot 1y ago
Erm, last I checked GMail literally reads all your emails to profile you.

Oh, but gmail also reveals to tracking services (i.e. virtual deliverability manager from aws ses) that you opened an email even when you disabled loading images.

gruez 1y ago

Source?

mystifyingpoi 1y ago
Yeah, I wonder too. Just checked the docs, they use tracking pixels. So blocking images should block it 100%?
kosolam 1y ago
I tested it myself. You are welcome to do the same.
- gruez 1y ago
  What platform (web, android, ios) did you test on, and how did you test? I used emailprivacytester.com on a few email services and gmail wasn't susceptible to any of the attacks.
  - kosolam 1y ago
    I tested it by sending an email using ses and virtual deliverability manager to my gmail account which is configured to not load images automatically. Then I observed how the open is registered in the virtual deliverability manager’s dashboard.

Barbing 1y ago

Do you know if I’m safe using Apple Mail with the relevant privacy features enabled? (w/Gmail account) Edit: one marketing site describes a new category of Apple Opens (vs. Human Opens), so sounds like the feature’s effective

Hnrobert42 1y ago

I thought Google loaded all content from all external sources upon your seat, so the sender doesn't know whether you opened it or not.

DaiPlusPlus 1y ago
That still tells the sender it’s a valid email address though?
- cxr 1y ago
  > I've noticed that moving the goalposts is extremely prevalent on HN, which makes for pretty frustrating conversations (or just reading). And then sometimes it's a tag team[…] <https://news.ycombinator.com/item?id=23117242 https://news.ycombinator.com/item?id=23117242>
  - ASalazarMX 1y ago
    Politicians are masters of this tactic of deflection. The nastier, the better they are at it. Calling it out is the best one can do without getting trapped in a cycle of low-effort premises and high-effort responses. Although, as usual in HN, the premises come from different accounts, so both are valid. And it probably reveals valid addresses when the image URL is unique for each email.
  - freedomben 1y ago
    Definitely happens a lot on HN, but I think that's just the nature of a mix of different opinions. Better IMHO to just treat them as individual arguments and reply accordingly
  - DaiPlusPlus 1y ago
    > moving the goalposts I'm really not (honestly!) trying to invalidate anyone's point or win any argument - my post is more of a question-in-disguise: the GP post I was replying to concerns message-read tracking; whereas my post invokes the entirely separate matter of external actors being able to determine the validity or existence of a gmail address. I'm not moving the goalposts; you guys are talking about the NFL game's goalposts; I'm talking about the FIFA world cup game goalposts.

johnklos 1y ago

No reasonable person would ever think that Google preserves their privacy. Perhaps Google preserves it enough so they can sell whatever information they're hiding, but that's about it.

Brian_K_White 1y ago

Obviously if you're reading gmail on the web or in the official phone app, then of course every click is observable. But you can read gmail in thunderbird or any other email client, and in that case gmail still doesn't know anything more than that your client performed a sync, which it might be doing periodically at all times and so isn't meaningful.

dathery 1y ago

This is not true, SES uses tracking pixels which are blocked if you disable external images: https://docs.aws.amazon.com/ses/latest/dg/faqs-metrics.html#faqs-metrics-opens https://docs.aws.amazon.com/ses/latest/dg/faqs-metrics.html#...

theteapot 1y ago

Erm, last I checked GMail literally reads all your emails to profile you.