5 ms·
I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and ca
by smelendez 8mo ago
I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so.
Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
- mmh0000 8mo agoSome of the big providers already do this, notably Apple and Gmail: https://www.litmus.com/blog/gmail-prefetching-images https://www.litmus.com/blog/gmail-prefetching-images
- deleted 8mo ago[deleted]
- londons_explore 8mo agoGmails prefetch is terrible for privacy because it honors http cache headers, which means tracking companies simply use a "no-cache, must-revalidate" header to defeat it.
- hedora 8mo agoThat sounds like a feature, not a bug, given where Google’s revenue comes from.
- direwolf20 8mo agoGoogle's revenue comes from Google's ads, not other people's ads, and they already know when you open your emails. They should block remote loading, to ensure their ad platform works better than other people's.
- RobotToaster 8mo agoWhich is completely stupid since images in an email should never change.
- iamacyborg 8mo agoWhy shouldn't they? There's plenty of scenarios where you might want to swap images after a period of time has elapsed, or to fix a mistake.
- londons_explore 8mo agoThe ability to swap images but not text seems arbitrary. You could imagine a system more like the notification tray on iOS/Android where at any time a notification can appear, be edited, timeout, or be deleted. Your email inbox could be like that. The email saying "Your parcel has been dispatched" could be edited to say "Your parcel has been delivered". When you refund something you've bought, the original purchase receipt could be crossed out or hidden. When you get invited to a wedding but then the wedding is cancelled, the original invite could be deleted, etc.
- afavour 8mo agoIt's counter to the principle of what e-mail is. It's supposed to be static. Just because you can doesn't mean you should.
- iamacyborg 8mo ago> It's supposed to be static. Says who? It's not in the original RFC as far as I'm aware.
- SahAssar 8mo agoI'm pretty sure the original RFC (RFC 821) does not include remote resources and it was written far before HTML or HTTP was invented. It was text delivered over SMTP.
- Tagbert 8mo agospecifically to prevent this kind of tracking
- hvb2 8mo ago
- Saris 8mo agoI think this is what icloud does. Seems like an easy way to make tracking useless if every client did it.
- mzi 8mo agoI worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malicious. I was quite annoyed when I was called to do the mandatory training as "I" had clicked a link (on an email I hadn't seen) and more so when told I had no other recourse than to sit through it. I resigned shortly afterwards.
- smelendez 8mo agoDid everyone get flagged then thanks to Barracuda? You’d think they’d realize there’s a problem if there’s a 100% fail rate. Edit: also, to be fair, you basically told them you had opted out of the test, so it’s not completely ridiculous for them to ask you to do the training instead.
- hedora 8mo agoThere’d be a bigger problem for the security training folks if there was a 100% pass rate.
- fx1994 8mo agoto be fair someone started using computers and has x worthelss security certificates but yes he will teach me how to use computer/Internet...okidoki... I just move to trash all their tests as it's just spam.
- kbenson 8mo agoThe test is whether you can successfully identify phishing attempts bu approximating what they look like in the wild. Bypassing the test entirely means there's no data on whether you're susceptible to this, and just because someone knows there's a header and how to bypass something doesn't mean they aren't also the kind of person to be distracted and click on stuff they shouldn't. This method of test passing wasn't okay when Volkswagen did it, and it's not appropriate for employees at a company that asks them to take the test, for the exact same reason.
- BobbyTables2 8mo agoThat still provides “human” vs “bot” feedback to the sender. An automated system processing emails isn’t going to be fetching images or rendering attached SVGs.
- gigel82 8mo agoThat is still signal that the email address is valid. I'd prefer something like the server immediately sending a SMTP 550 5.1.1 (unknown recipient error), for anything that's immediately recognized as spam (or marked as spam in the past by the user). That gives no signal at all and might even persuade some scammers to remove your email address from their list.
- hedora 8mo agoIf you don’t follow spam links, then it lets the spammer probe your spam filter, and try stuff until you follow links. A better approach is to follow all links always (even to non-existent recipients) if you must play this game. That reminds me: I should make sure all my mail clients are still set to plain text rendering.
- dmitrygr 8mo agoI hereby remind you of a bet you lost: https://news.ycombinator.com/item?id=39186555 https://news.ycombinator.com/item?id=39186555 :) my contact info is in my profile to arrange settlement
- deleted 8mo ago[deleted]
- kijin 8mo agoThat's not enough. As the article explains, SVGs can reference external resources. So you also need to prefetch those external resources, recursively, if you want to be thorough.
- RobotToaster 8mo agoTo add to this, those external resources aren't limited to images, they can be basically anything, foreignObject allows video. I'm also wondering if you could (ab)use SMIL mouse events to bypass this approach.
- easygenes 8mo agoI knew the people who were setting this up for Yahoo like 10 years ago. Lots of major providers do it now.
- geocar 8mo agoI think the problem is what is an image? I made an attempt to enumerate them[1], and whilst I catch this issue with feImage over a decade ago by simply observing that xlink:href attributes can appear anywhere, Roundcube also misses srcset="" and probably other ways, so if the server "prefetched every image" it knew about using the Roundcube algorithm the one in srcset would still act as a beacon. I feel like the bigger issue is the W3 (nee Google). The new HTML Sanitizer[2] interface does nothing, but some VP is somewhere patting themselves on the back for this. We don't need an object-oriented way to edit HTML, we need the database of changes we want to make. What I would like to see is the ability to put a <pre-cache href="url"><![CDATA[...]]></pre-cache> that would allow the document to replace requests for url with the embedded data, support what we can, then just turn off networking for things we can't. If networking is enabled, just ignore the pre-cache tags. No mixing means no XSS. Networking disabled means "failures" in the sanitizer is that the page just doesn't "look" right, instead of a leak. Until then, the HTML4-era solution was a whitelist (instead of trying to blacklist/block things) is best. That's also easier in a lot of ways, but harder to maintain since gmail, outlook, etc are a moving target in _their_ whitelists... [1]: https://github.com/geocar/firewall.js https://github.com/geocar/firewall.js [2]: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...
- TazeTSchnitzel 8mo agoWhy on earth does the HTML sanitiser allow blacklisting?! That can't ever be safe to use, the set of HTML elements can always change.
- geocar 8mo agoI mean, at least they eventually came to their senses, but it does not inspire confidence! https://developer.chrome.com/blog/sanitizer-api-deprecation/ https://developer.chrome.com/blog/sanitizer-api-deprecation/
- Ndymium 8mo agoThat's the old sanitizer API. That was already removed and what you linked earlier is the new sanitizer API.