9 ms·
Images Now Showing in Gmail
- enraged_camel 13y agoIs there a way to turn it off? I'm on a limited data plan on my iPhone and I don't want images to load by default.
- arsenerei 13y agoIt's in the article. > Of course, those who prefer to authorize image display on a per message basis can choose the option “Ask before displaying external images” under the General tab in Settings. That option will also be the default for users who previously selected “Ask before displaying external content”.
- draz 13y agoHow does this affect invisible pixels (for analytics)?
- badbrain 13y agoBadly: http://blog.movableink.com/gmails-recent-image-handling-changes-the-impact-and-resolution http://blog.movableink.com/gmails-recent-image-handling-chan...
- roryhughes 13y agoWould the image not still load only once the receiver opens it?
- Anonymous98236 13y agoTo clarify, it's bad for marketing people, but good for users desiring privacy.
- GrinningFool 13y agoTo an extent - it seems that google indirectly confirms that emails are received (even though additional data is lost).
- Anonymous98236 13y agoI believe they still have an "Ask before displaying external images" setting.
- GrinningFool 13y agoYes, but it is unclear whether their servers will load them regardless of whether or not they're sent to my browser.
- eterm 13y agoBut surely ALL emails to @gmail.com are received.
- valgaze 13y agoA outfit like Yesware provides rough location data w/ their pixels. FWIW, they're partially funded by Google Ventures- perhaps there is some type of technical compromise that doesn't break geographic tracking completely: http://www.yesware.com/blog/2012/07/18/how-does-yesware-tracking-work/ http://www.yesware.com/blog/2012/07/18/how-does-yesware-trac...
- deleted 13y ago[deleted]
- cantfindmypass 13y agoHow can this possibly do anything but enable tracking? They can just embed hmac(secret, your_email).png.
- twoodfin 13y agoTracking is currently only useful insofar as receiving a URL request for the image indicates that someone opened the email, as well as providing whatever metadata is available via the request, through geo-locating the request IP or what-have-you. This change makes all of that impossible: Google will (presumably) always request your image URL, whether the user opens the email or not, and the request will come from Google, with their metadata, not your target.
- pbreit 13y agoIt doesn't sound that bad. First, apparently only affecting 2-5% of mail. Secondly, everything works the same except for the absence of useragent and cache control headers (which aren't that helpful anyhow for analytics, especially when you're still getting those on 90%+ of your messages).
- natch 13y agoIt devalues other tracking solutions, and makes Google's own paid analytics services more compelling. So users will still be tracked, but the trackers are more likely to have to share some of the money and data with Google.
- mcintyre1994 13y agoGoogle offer paid email analytics? Out of interest do they have a free version like they do for websites too? All I can find online are things like [0] showing how to use web analytics to track emails etc. [0] https://plus.google.com/+DanielWaisberg/posts/XDrRoh3GoVP https://plus.google.com/+DanielWaisberg/posts/XDrRoh3GoVP
- steven2012 13y agoI hate to be "that guy", but does this mean Google is storing every one of our pics on their proxy servers? For how long do they store them, and what is their data retention policy? Also, remembering that Google has no obligation to protect non-American users, does that give the NSA access to them, to run things like facial recognition, etc?
- Segmentation 13y agoAssuming worst-case NSA scenario, even if the images weren't hosted by Google, the NSA would just pull the external images anyway for facial recognition/what not.
- winslow 13y agoThat was my initial reaction to. I suppose it has its pros and cons just like anything else. However, with recent Google (among other companies) and NSA dealings I'm looking at this with my cynical eyes as another data retention policy.
- runn1ng 13y agoUmmmm.... they already store all your e-mail. What difference does storing images make?
- deleted 13y ago[deleted]
- shabble 13y agoBecause if you stop serving up the remote reference before it gets requested by a particular client, it won't be there. If it's archived {immediately,on first request} permanently thereafter, there's now another copy outwith your control. Edit: moreover, the images are requested locally by the user's browser. Google doesn't get a look at them at any point[1]. Whereas now, they get a permanent copy for free, because they're doing you such a favour! [1] Directly, anyway. I guess they could use js to get the requests and headers and submit them back to the mothership, but on slow connections that could be pretty obvious.
- mjbraun 13y agoI'm curious if this will help spammers. AFAIK, loading a tracking pixel helps validate an email address as active (since, by design, bounce messages probably wouldn't make it back to the spammer), even if the recipient didn't otherwise respond to the message. AFAIK, "Validated" email address lists are worth more than unchecked lists and if Google is preloading images for valid accounts, then that seems to make validation even easier for spammers.
- spb 13y agoHowever, if they make requests (that they don't necessarily have to keep) for images for all accounts (preloading on receive and not read), it does the opposite, which is a good thing.
- mjbraun 13y agoThe problem is, if the filename/URL is unique to the user like "spammersite.tld/images/50093825343.jpg" and 50093825343" is tied to my unique email, then on Gmail's download and caching of the image, they've validated my email. If another email has 023503850485.jpg, gmail wouldn't know that the underlying file is the same unless it loads it. I don't even have to have checked my mail for this to happen.
- Anonymous98236 13y agoThere's still an "Ask before displaying external images" setting, and based on the description in the article, it looks like images are only requested when the email is opened, not when it is delivered to the inbox. But, this new system looks to be enabled by default, so more people will have images enabled, which means the web bugs will mostly get through now.
- Ricapar 13y agoI kinda like this. More often than not, I never click the "Display Images" link because I know doing so will essentially feed information back to the people who sent the email (the fact that I opened it, my geoIP location, browser, etc). I've been fine with a slightly degraded and less pretty email experience in order to give me some extra privacy and keep my information out of marketer's systems. With this I guess I can see emails with all the images and other goodies without that worry. Works for me. On the other hand... There's a good chance Google is caching all this now. But seeing as they're running the mail system I don't feel like it's too major of an intrusion beyond what they already have.
- lukeschlather 13y agoThis just means they'll be paying Google for that info instead of being able to gather it themselves.
- rasengan 13y agoThis is a step in the right direction. However, please understand that it doesn't really make a difference in forms of real privacy Googlers! The e-mail spam/list creators are a different kind of adversary than, for example, web trackers. They will do something like this: http www theirimageserver com/images/img53.jpg?to=you@email.com (Obviously they will obfuscate and use some kind of hash instead of cleartext e-mail to disguise their tracking ways). Regardless of whether some.google.ip loads it, or your.home.ip loads it, it won't change the fact that you@email.com loaded it and your email is very active, not just active in that it didn't bounce, but active in that you actually read it. Once again, it's a step in the right direction though, and I'm looking forward to seeing greater innovations from Google in the privacy space, because I'm confident that there are Googlers who understand that privacy is not a feature nor a PR thing... it's the difference between the preservation of humanity and society versus not.
- jackcarter 13y agoIs it possible that Google also loads images in emails sent to invalid @gmail.com addresses?
- deleted 13y ago[deleted]
- spb 13y agoActually, if they do it on delivery, it ruins the signal (since there is no longer any distinguishing factor between active accounts and inactive accounts), so the latter protects privacy more effectively.
- eterm 13y agoYou've got that backward. If google fires off a request when you open the email, the companies can track whether you opened the email. If google fires off a request when they get the email, the company has no way to track if you opened their email. If google fires off requests to all emails they receive to @gmail.com then the marketers won't even know if it's active @gmail.com account, they'll just know that *@gmail.com is received, which isn't information, it's an easy assumption.
- spindritf 13y agoSo if you send a different picture to each recipient, you can track if they open your message? Or does Google pull all images, whether you view the message or not?
- mherdeg 13y agoIs Google loading these images when a user opens mail? (Have they just automatically opted users in to "read receipts"?) Or are these images pre-cached when mail is delivered (so that the fact that an image was loaded is just proof of delivery, which you should be able to get anyway?)
- oh_sigh 13y agoSince images usually contain tracking information, I wonder how this helps? Maybe the proxy automatically gets and stores the image as soon as the email is received? So in this manner, they will not be able to tell if/when a user actually clicks on a link?
- keithwinstein 13y ago[Update 2: I just tested with a newly-created Gmail account and the feature did not seem to have been rolled out to the new account yet.] [Update: I'm not sure when this feature will actually be rolled out. I think my test below automatically displayed the image because my own email address appears to be implicitly a whitelisted sender (even though "images from this sender are always displayed" doesn't appear for it). Whether Google will alter the behavior when they actually deploy this feature, I don't know.] [Original message:] I just tested and, yes, Gmail only loaded the referenced image when I clicked on the message to open it within Gmail. I can't be sure, because perhaps if I had waited an hour without opening the message, Gmail would have automatically loaded the image anyway. But in reply to mherdeg below, the evidence suggests that, yes, Gmail plans to opt everybody in to sending "read receipts" by default for HTML messages that reference images. I'm surprised by Google's statement that the previous behavior of prompting was "to protect you from unknown senders who might try to use images to compromise the security of your computer or mobile device." I realize this was a benefit, but I always thought the main purpose was for privacy --- not to betray to the email sender when I opened the email. My guess is that Google did not view this as a privacy setting, or they probably would not have forcibly changed everybody's setting. It's doubly strange that they did so without a notice inside Gmail that they did so -- just a blog post.
- danielnr 13y agoI just ran the same test and can confirm the results. Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts. I don't use any Google services outside of small tests like this, but it still makes me concerned for how this will affect the privacy of people I know.
- finnh 13y ago"Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. On the flip side, those same solutions can no longer set a persistent cookie with the image, so persistent tracking based on the initial email open will stop working.
- swedegeek 13y agoYea, it's hard to not think this is ultimately not a great move. It seems rather shortsighted from a Gmail user's perspective if Google can't address concerns over spammers being able to verify email addresses, or even just analytic trackers. It is also vastly less appealing to hear that Google plans to cache all images, which we know Big Brother is grabbing as well. And in the case where someone may want to actually see images for a marketing email (albeit, extremely rare for me), it actually hamstrings the source of the email from possibly providing customized images/content based on geolocation/browser/etc. that I could be interested in seeing. So, what's the upside vs. just having the option to display images as desired and NOT have Google cache them?
- maxerickson 13y agoAren't verified email addresses a relic of the past? Does anybody actually get anything other than nonsense spam anymore?
- swedegeek 13y agoThat feels a bit like the "I have nothing to hide argument." Should we just accept that probably spammers no longer send address verifying emails, and tacitly approve this change helping them out if they do? Ultimately, the default should be to let people decide for themselves to opt in to something like this. Forcing this with some pretty big head scratching holes in the benefits seems rather evil.
- maxerickson 13y agoLooking at the preference, it isn't auto loading images in 'suspicious' messages (the help text more or less says this). So trusted messages are now leaking read receipts.
- tehwebguy 13y agoProtect me from images? That is not why I used this feature. I used it so that images like /verifyRealEmail.php?email=$myaddress wouldn't work.
- macspoofing 13y agoIf the gmail proxy caches every image that is sent to a gmail address, then this bad for spammers, and good for everyone else. That's one less mechanism to verify valid (or active) email address.
- tehwebguy 13y agoI wonder if Google will access an image URL in an email sent to a nonexistent address
- macspoofing 13y agoThey almost have to, otherwise it would be much too easy to scrape gmail addresses (from Google itself!).
- natch 13y agoSeems it's being rolled out in a sloppy fashion. In my Gmail account, images in email have suddenly stopped working. There is still a "display images" button, and when I click it, the images do not load. When I attempt to open an image link from the email message in another tab, I get a 404 error on Google's proxy server, with a super long URL.
- antr 13y ago"Google’s own secure proxy servers" will that mean that people who track me opening their email with 1px images won't be able to track that? I hope this is the case...
- prezjordan 13y agoSure looks like it. I wonder how analytics companies feel about this. It's important to know how many people are opening your emails.
- antr 13y agoI guess the compromise is giving the user the option to choose: (i) I would like to be tracked, (ii) I don't want to be tracked. I genuinly dislike people who send me personal/work emails with tracking mechanisms...
- timdorr 13y agoThe request is still made (now via a proxy), so email opens can still be tracked. But other identifiable information (IP, user agent, etc) can't.
- pyalot2 13y agoAnd since images are now no longer proxied, that's the end to this "email DRM" sillyness. Good riddance.
- taggartbg 13y agoDoes this mean that every image will be saved onto Google's proxy server at the time that Google receives it, or at the time that the user opens it? I don't want to lose the ability to track email opens to gmail users through Mandrill/SendGrid/whatever...
- nfoz 13y agoI sure want you to lose that ability. It's crazy that email clients ever provided that vulnerability in the first place.
- roshodgekiss 13y agoMany ESPs already have a workaround in place for ensuring that open % stats are not affected. Here's Campaign Monitor's take on the issue: http://www.campaignmonitor.com/blog/post/4118/how-gmails-image-display-changes-will-affect-your-reports http://www.campaignmonitor.com/blog/post/4118/how-gmails-ima... Also, a postmaster's version: http://emailexpert.org/gmail-tracking-changes-the-fix-what-you-need-to-know/ http://emailexpert.org/gmail-tracking-changes-the-fix-what-y... Disclosure that I'm from Campaign Monitor and wrote that first post. As you can imagine, we've been getting a fair few enquiries about image tracking and opens today...!
- gabriel34 13y agoI believe if you want my location and a confirmation I've read your email you should ask me, not shadily collect information
- alooPotato 13y agoThis proxying actually rolled out on December 3rd to most gmail.com users. We, Streak, happenned to launch an email tracking feature on the same day (http://www.streak.com/email-tracking-in-gmail http://www.streak.com/email-tracking-in-gmail). Here's what we've learned: - the proxying of requests only happens when a user is viewing the mail inside Gmail (i.e. gmail does not actually affect the message body, its just proxying at render time) - gmail only caches in the image for a few minutes. So for email marketers, if your recipient views the email then views it again a few hours later, the marketer will see two requests for the image - there is basically no personally identifiable information in the request that Google's proxy sends to the server hosting the image. So from that perspective this is actually a boost in privacy than the previous state of the world. None of the headers, cache controls, cookies, ip addresses, referrers or user agents are passed to the original image server - obviously you can encode some ID into the image URL itself but all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email - so again, no PII gets disclosed - it is true that marketers will see a more accurate count of opens (because displaying images is on by default) - there seems to be several ways to get gmail's proxy to NOT cache the image and simply proxy the request every time the user opens the emails
- thedufer 13y ago> obviously you can encode some ID into the image URL itself but all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email - so again, no PII gets disclosed All that lets you do is...confirm that the email address exists. Until this change, that was a very difficult thing to do; now, its equivalent to getting a message through a spam filter. This is going to help spammers _a lot_.
- lallysingh 13y agogmail already bounces email to nonexistant addresses.
- 13y ago
- dsaber 13y agoI think that's a great feature. Loading images manually is always annoying and isn't a great user experience. Novice user's don't always understand why it's risky and they probably opt to display the images anyways. However, one interesting question is how can third-party analytics will workaround this? Is there a way? Given that gmail holds a large market share of email users, this is really going to negatively affect the usefulness of such services.
- skloubkov 13y agoSeems like a privacy hole. Mailer can setup url that is composed of random words and is unique per email. Ex: www.tracker.com/weather-dog-city-nice.jpg could identify you + timestamp of request and bam, you have record of: valid email, address isn't blocked and that user reads emails from recipient. No proxy in a world would be able to make this request anonymous. No idea what advantage of this is apart from google eventually offering an alternative to gmail (think of comment system being replaced on youtube)
- Pirate-of-SV 13y agoSo it's going to break https://emailprivacytester.com/ https://emailprivacytester.com/ by default?
- Aldo_MX 13y agoThis is relevant for email marketers: In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed and you’ll be asked whether you want to see the images. https://support.google.com/mail/answer/145919 https://support.google.com/mail/answer/145919
- pdknsk 13y agoI wonder if Google will eventually PageSpeed the images and advertise it as a feature. "Mails load faster with Google Mail!".
- mike-cardwell 13y agoJust tried this out with https://emailprivacytester.com/ https://emailprivacytester.com/ - The proxy request only happened when I viewed the email. It came from 66.249.88.50 (google-proxy-66-249-88-50.google.com) and had the User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 (via ggpht.com) I viewed the email using Firefox 26 on Debian.
- duaneb 13y agoJust because it's through a proxy doesn't mean identifying information can't be embedded in the URL.... This is used as a "customer read email" callback.
- deleted 13y ago[deleted]
- forgotAgain 13y agoIn some cases, senders may be able to know whether an individual has opened a message with unique image links. From https://support.google.com/mail/answer/145919?p=display_images&rd=1 https://support.google.com/mail/answer/145919?p=display_imag...