4 ms·

> Now, an open question is if Google will make that request when the email is actually opened, which would allow marketers to determine if and when the email wa

by buro9 13y ago

> Now, an open question is if Google will make that request when the email is actually opened, which would allow marketers to determine if and when the email was read by the user, or if Google will make the request as soon as the email is received. The latter would enhance users' privacy at the cost of bandwidth for Google, but early tests indicate that they don't actually do that, waiting for the user to click the email to make the request. I've just tested this. The image was retrieved when I viewed the email in Gmail. The tracking info basically comes back as "anonymous" and viewed from an unknown location. The image was retrieved twice even though I only viewed the email once. Currently I'd say that seeing the image being viewed is still valuable. I'm sure Google could move to proactively fetching the images in future destroying even that value. The image is cached (via browser headers), but isn't aggressively cached (via reverse proxy). Fresh views on different browsers or a later session would still result in a request for the image back to the source server... registering the view again. My personal view on all of this is that this is a bit Microsoft... you know, convenience and features over security and privacy. For me, this "feature" leaks data about what I view to 3rd parties where today I block all images and do not leak that info.

curveship 13y ago
Wait, do I understand you correctly that Google fetched the image even before you requested that images be displayed in the email? That seems like a boon to marketers, not a bane.
- buro9 13y ago
  A dialog popped up when I logged into email, and before I'd seen this thread. That dialog was much along the lines of "We'll now show you images in your email automatically." with a big "OK" button. I don't recall whether there was a less prominent "No, thanks" as I was only logging on to reply to one question really quickly. I suspect this is a UX anti-pattern. I've gone back into my settings and changed it back to "Don't display images".
  - 3JPLW 13y ago
    The alternative to "OK" is "Settings," with a link that just dumps you into the main settings view… leaving you to find the Images section to change it back. Quite an opt-in.
    - waps 13y ago
      Otoh, this makes it harder for email marketers and generally other people to see if I'm reading their mail. +1
      - jtheory 13y ago
        If you go to the trouble to figure out how to disable the "auto-load images" setting, then they're just as blocked as before. If you accept the new default, it's far easier for them to track you, because Google will kindly be loading their tracking images on your behalf when you open the email, every time.
      - maxmcd 13y ago
        "Want to see if your users are opening their emails? Pay to display your message in gmail's promotions tab."
        forgotmycreds 13y ago
        Now google has the data, and they almost defaulted the option for everyone. That gives them a big boost in data receives which they could use for marketing "(hey guys you remember you got × amount of image loads, we made your images get loaded by × more users now if you want the data we got it right here for the right price.)"
  - dragonwriter 13y ago
    According to the announcement, if you've already selected the option to ask before displaying external content, when this feature rolls out to your account it will also default to set the new setting to ask before displaying external images.
- mvanveen 13y ago
  The way I read the comment, I think you are correct about it being a boon and not a bane. However, it is because the request was timed at the same time as the message read, not the other way around. It seems the commenter functionally tested an external URL being requested by Gmail, and found that the request was coincident with when the commenter opened the email. This essentially "leaks" that you've opened the email as the image URL could be unique to your email message.
  - benihana 13y ago
    This is correct. This makes unique open counts much more reliable as it guarantees that the tracking image will be fetched. Before this change, one could never be certain how many people actually opened their email in gmail because some percentage of recipients would block images which naturally blocks loading the tracking image. Typically the tracking image is unique to each individual email sent.
- eric_the_read 13y ago
  But if Google always fetches the images, then there's no way for the marketers to know if the email was actually opened or not.
  - jtheory 13y ago
    Apparently Google does not always fetch the images. But even if they did, this is still more information leakage than the old default (don't load images). Spammers who email via botnets and the like, with false return addresses, doesn't get bouncebacks to clean their lists. But if you (or Google, on your behalf) give them a hand by reliably loading their tracking image, that flags your email as a valid one. If you weren't actually reading the email, that's still a false positive I don't think you'd benefit by giving.
    - hrjet 13y ago
      An alternative could be to let the user decide if Gmail should prefetch images from a sender or not. Email from familiar senders would have images prefetched (thus avoiding leaks of user data). And DDOSing concerns would be reduced because those emails would not be from a familiar source.
      - ithkuil 13y ago
        There is no advantage of prefetching images from familiar senders. It's not about faster image loading. The ideal thing would be to just prefetch all the images sent to existing and non existing accounts. This way there is absolutely no way for a spammer to tell whether an email is existing or not.
        hrjet 13y ago
        > There is no advantage of prefetching images from familiar senders. The advantages I had in mind were: 1. No leak of user IP address, cookies, etc 2. No leak of timing information (when user opened the email). It will however leak that the email address is valid, which might be a fine compromise with a selected subset of senders.
- BrokenEnso 13y ago
  Sounds like a great way to verify an email address to me. Send an email with a tracking image and if you get a hit, presuming they pre-fetch, you know it's a valid email.
myko 13y ago
> For me, this "feature" leaks data about what I view to 3rd parties where today I block all images and do not leak that info. But that option to not see images is still there, and if you've defaulted it to off you still wont see images. Unless I misread the blog post.
ithkuil 13y ago
> Convenience and features over security and privacy I don't understand. It probably has to do with the Zeitgeist. The images were originally blocked because of security and privacy concerns. Rendering of images is potentially insecure because of bugs in the browsers. By proxying the images, Google as an webmail provider, screens you from your browser bugs. Solved. Rendering of images is a privacy concern because of tracking. By fetching the images from another place, the attacker cannot know your location, your OS, language setting, etc... Solved. Rendering the image allow checking when and if the email is ever opened, which can be useful in marketing^Wspam primarily because they can understand whether an email is active/exists or not. Not Solved. The latter however is a general problem. There are many other ways to know whether an email account exists or not. Many mail servers respond with bounce emails anyway. They won't bounce on detected spam, but that's not the point; this feature is an additional barrier for image tracking for content that has passed through the spam filter already.

by buro9 13y ago

curveship 13y ago

Wait, do I understand you correctly that Google fetched the image even before you requested that images be displayed in the email? That seems like a boon to marketers, not a bane.

buro9 13y ago
A dialog popped up when I logged into email, and before I'd seen this thread. That dialog was much along the lines of "We'll now show you images in your email automatically." with a big "OK" button. I don't recall whether there was a less prominent "No, thanks" as I was only logging on to reply to one question really quickly. I suspect this is a UX anti-pattern. I've gone back into my settings and changed it back to "Don't display images".
- 3JPLW 13y ago
  The alternative to "OK" is "Settings," with a link that just dumps you into the main settings view… leaving you to find the Images section to change it back. Quite an opt-in.
  - waps 13y ago
    Otoh, this makes it harder for email marketers and generally other people to see if I'm reading their mail. +1
    - jtheory 13y ago
      If you go to the trouble to figure out how to disable the "auto-load images" setting, then they're just as blocked as before. If you accept the new default, it's far easier for them to track you, because Google will kindly be loading their tracking images on your behalf when you open the email, every time.
    - maxmcd 13y ago
      "Want to see if your users are opening their emails? Pay to display your message in gmail's promotions tab."
      - forgotmycreds 13y ago
        Now google has the data, and they almost defaulted the option for everyone. That gives them a big boost in data receives which they could use for marketing "(hey guys you remember you got × amount of image loads, we made your images get loaded by × more users now if you want the data we got it right here for the right price.)"
- dragonwriter 13y ago
  According to the announcement, if you've already selected the option to ask before displaying external content, when this feature rolls out to your account it will also default to set the new setting to ask before displaying external images.
mvanveen 13y ago
The way I read the comment, I think you are correct about it being a boon and not a bane. However, it is because the request was timed at the same time as the message read, not the other way around. It seems the commenter functionally tested an external URL being requested by Gmail, and found that the request was coincident with when the commenter opened the email. This essentially "leaks" that you've opened the email as the image URL could be unique to your email message.
- benihana 13y ago
  This is correct. This makes unique open counts much more reliable as it guarantees that the tracking image will be fetched. Before this change, one could never be certain how many people actually opened their email in gmail because some percentage of recipients would block images which naturally blocks loading the tracking image. Typically the tracking image is unique to each individual email sent.
eric_the_read 13y ago
But if Google always fetches the images, then there's no way for the marketers to know if the email was actually opened or not.
- jtheory 13y ago
  Apparently Google does not always fetch the images. But even if they did, this is still more information leakage than the old default (don't load images). Spammers who email via botnets and the like, with false return addresses, doesn't get bouncebacks to clean their lists. But if you (or Google, on your behalf) give them a hand by reliably loading their tracking image, that flags your email as a valid one. If you weren't actually reading the email, that's still a false positive I don't think you'd benefit by giving.
  - hrjet 13y ago
    An alternative could be to let the user decide if Gmail should prefetch images from a sender or not. Email from familiar senders would have images prefetched (thus avoiding leaks of user data). And DDOSing concerns would be reduced because those emails would not be from a familiar source.
    - ithkuil 13y ago
      There is no advantage of prefetching images from familiar senders. It's not about faster image loading. The ideal thing would be to just prefetch all the images sent to existing and non existing accounts. This way there is absolutely no way for a spammer to tell whether an email is existing or not.
      - hrjet 13y ago
        > There is no advantage of prefetching images from familiar senders. The advantages I had in mind were: 1. No leak of user IP address, cookies, etc 2. No leak of timing information (when user opened the email). It will however leak that the email address is valid, which might be a fine compromise with a selected subset of senders.
BrokenEnso 13y ago
Sounds like a great way to verify an email address to me. Send an email with a tracking image and if you get a hit, presuming they pre-fetch, you know it's a valid email.

myko 13y ago

> For me, this "feature" leaks data about what I view to 3rd parties where today I block all images and do not leak that info. But that option to not see images is still there, and if you've defaulted it to off you still wont see images. Unless I misread the blog post.

ithkuil 13y ago

> Convenience and features over security and privacy I don't understand. It probably has to do with the Zeitgeist. The images were originally blocked because of security and privacy concerns. Rendering of images is potentially insecure because of bugs in the browsers. By proxying the images, Google as an webmail provider, screens you from your browser bugs. Solved. Rendering of images is a privacy concern because of tracking. By fetching the images from another place, the attacker cannot know your location, your OS, language setting, etc... Solved. Rendering the image allow checking when and if the email is ever opened, which can be useful in marketing^Wspam primarily because they can understand whether an email is active/exists or not. Not Solved. The latter however is a general problem. There are many other ways to know whether an email account exists or not. Many mail servers respond with bounce emails anyway. They won't bounce on detected spam, but that's not the point; this feature is an additional barrier for image tracking for content that has passed through the spam filter already.