5 ms·

I just ran the same test and can confirm the results. Google will only load your image if you open the email, which means Google has just opted-in all users to

I just ran the same test and can confirm the results. Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts. I don't use any Google services outside of small tests like this, but it still makes me concerned for how this will affect the privacy of people I know.

finnh 13y ago
"Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. On the flip side, those same solutions can no longer set a persistent cookie with the image, so persistent tracking based on the initial email open will stop working.
- nkoren 13y ago
  > "Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. Has it? If Google's proxy is caching images, then "email open" tracking might have broken entirely. All the sender would see is that their email has been opened once by the proxy -- for all gmail addresses put together.
  - danielnr 13y ago
    http://example.com/trackingimage.php?email={yourusername}@gmail.com http://example.com/trackingimage.php?email={yourusername}@gm... Or, if they snip the GET variable for whatever reason (I don't see them doing this): http://example.com/gmail/{yourusername}/trackingimage.php http://example.com/gmail/{yourusername}/trackingimage.php Or even: http://example.com/{emailidfromadatabase}/trackingimage.php http://example.com/{emailidfromadatabase}/trackingimage.php This tactic is already in use by most mass email companies.
    - dugmartin 13y ago
      I'd imagine that they are going to de-dup the images they proxy which means email marketers need to generate unique images per mail and that means no more 1-pixel tracking images. A solution would be 1-pixel high tracking lines - a 1 x 128 pixel wide image that encoded 0 and 1 as two RGB colors adjacent to the mail's background color in the visual spectrum so the difference isn't noticeable would encode a sha-1 hash placed in the url. http://example.com/tracking-line/{hash}.png
  - Wilya 13y ago
    Mass-email senders probably would put a unique identifier in the image url (different for all users), so Google will open each image, because it can't know before loading them that it's the same image.
    - mtrimpe 13y ago
      Or they could retrieve every image sent to a gmail address immediately, regardless of whether you viewed it or not. That would essentially render open statistics meaningless and would let Google cripple another industry after the promotions tab and 'not provided.' I really hope they don't because it's such valuable information when creating email copy...
      - Wilya 13y ago
        I agree they could do it, but people upthread are suggesting that Google doesn't do that, and only loads the image when you open the message.
        Gepser 13y ago
        they could track if an email was opened twice first one = Google second one = user
        ktsmith 13y ago
        I would imagine that google caches the images so there would be one request instead of two.
        Gepser 13y ago
        you are right, I didn't think on that
    - deleted 13y ago
      [deleted]
- dragonwriter 13y ago
  > "Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. No, it didn't. If you had chosen the option to ask before displaying external content -- which existed and applied to non-image content and, without which selection, email-open tracking by external non-image content was already reliable -- then the new setting to ask before displaying external images is selected for you by default. If you hadn't selected that option before, you weren't protected from "email open" tracking.
  - deleted 13y ago
    [deleted]
Too 13y ago
Interesting. The fact that they don't even address this aspect of the change in the blog post makes you wonder if this is a deliberate or incompetent move. This should be obvious for anyone who works with email and easy enough to describe in layman terms the blog post. Who is the target group for the blog?
- michaelmior 13y ago
  I assume the target of the blog is Gmail power users moreso than email markers. I highly doubt that the Gmail team didn't think this through before launching. As far the reason for not explaining how this works, who knows?
dragonwriter 13y ago
> Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts. If you didn't have the "ask before displaying external content" option set before this change, you were "opted-in" to read receipts already -- its just that, due to protections designed to stop other malicious use of images, you were incidentally protected against images as the vector for silent read receipts. With this change, you are better protected against the malicious uses of images the default-not-to-display option was designed to protect against, but exposed to external images as a vector for read receipts if you hadn't chosen to display external content only after confirmation. If you did choose that previously, then you also got the new "ask before displaying external images" chosen by default -- so if you were protected from senders injecting read receipts before, you still are now. If you weren't before, you aren't now, but then that's not really a change.

finnh 13y ago

"Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. On the flip side, those same solutions can no longer set a persistent cookie with the image, so persistent tracking based on the initial email open will stop working.

nkoren 13y ago
> "Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. Has it? If Google's proxy is caching images, then "email open" tracking might have broken entirely. All the sender would see is that their email has been opened once by the proxy -- for all gmail addresses put together.
- danielnr 13y ago
  http://example.com/trackingimage.php?email={yourusername}@gmail.com http://example.com/trackingimage.php?email={yourusername}@gm... Or, if they snip the GET variable for whatever reason (I don't see them doing this): http://example.com/gmail/{yourusername}/trackingimage.php http://example.com/gmail/{yourusername}/trackingimage.php Or even: http://example.com/{emailidfromadatabase}/trackingimage.php http://example.com/{emailidfromadatabase}/trackingimage.php This tactic is already in use by most mass email companies.
  - dugmartin 13y ago
    I'd imagine that they are going to de-dup the images they proxy which means email marketers need to generate unique images per mail and that means no more 1-pixel tracking images. A solution would be 1-pixel high tracking lines - a 1 x 128 pixel wide image that encoded 0 and 1 as two RGB colors adjacent to the mail's background color in the visual spectrum so the difference isn't noticeable would encode a sha-1 hash placed in the url. http://example.com/tracking-line/{hash}.png
- Wilya 13y ago
  Mass-email senders probably would put a unique identifier in the image url (different for all users), so Google will open each image, because it can't know before loading them that it's the same image.
  - mtrimpe 13y ago
    Or they could retrieve every image sent to a gmail address immediately, regardless of whether you viewed it or not. That would essentially render open statistics meaningless and would let Google cripple another industry after the promotions tab and 'not provided.' I really hope they don't because it's such valuable information when creating email copy...
    - Wilya 13y ago
      I agree they could do it, but people upthread are suggesting that Google doesn't do that, and only loads the image when you open the message.
      - Gepser 13y ago
        they could track if an email was opened twice first one = Google second one = user
        ktsmith 13y ago
        I would imagine that google caches the images so there would be one request instead of two.
        Gepser 13y ago
        you are right, I didn't think on that
  - deleted 13y ago
    [deleted]
dragonwriter 13y ago
> "Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors. No, it didn't. If you had chosen the option to ask before displaying external content -- which existed and applied to non-image content and, without which selection, email-open tracking by external non-image content was already reliable -- then the new setting to ask before displaying external images is selected for you by default. If you hadn't selected that option before, you weren't protected from "email open" tracking.
- deleted 13y ago
  [deleted]

Too 13y ago

Interesting. The fact that they don't even address this aspect of the change in the blog post makes you wonder if this is a deliberate or incompetent move. This should be obvious for anyone who works with email and easy enough to describe in layman terms the blog post. Who is the target group for the blog?

michaelmior 13y ago
I assume the target of the blog is Gmail power users moreso than email markers. I highly doubt that the Gmail team didn't think this through before launching. As far the reason for not explaining how this works, who knows?

dragonwriter 13y ago

> Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts. If you didn't have the "ask before displaying external content" option set before this change, you were "opted-in" to read receipts already -- its just that, due to protections designed to stop other malicious use of images, you were incidentally protected against images as the vector for silent read receipts. With this change, you are better protected against the malicious uses of images the default-not-to-display option was designed to protect against, but exposed to external images as a vector for read receipts if you hadn't chosen to display external content only after confirmation. If you did choose that previously, then you also got the new "ask before displaying external images" chosen by default -- so if you were protected from senders injecting read receipts before, you still are now. If you weren't before, you aren't now, but then that's not really a change.