5 ms·

A Clever Way to Tell Which of Your Emails Are Being Tracked

44 points by Libertatea 12y ago

peacefool 12y ago
It's not a clever way, it's primitive, and does not monitor many advertising agencies (just 3 of them). The clever way would be to discover ALL advertisers AND prevent spying on our emails.
mike-cardwell 12y ago
This is where I usually jump in and mention a web app I wrote: https://emailprivacytester.com/ https://emailprivacytester.com/ Sends an email to you which checks to see how much stuff your email client is leaking. Turns out some email clients load remote content even before you click "Load Remote Images"
- ojilles 12y ago
  Wow that's a lot even on just iPhone Mail. This should get more attention!
  - mike-cardwell 12y ago
    I'm pretty sure the iPhone mail client loads images by default. And... I could be wrong, but IIRC it also doesn't even have a way of disabling this. I don't have one to hand to test with though.
    - pfortuny 12y ago
      Control panel (or whatever it is called) and in Mail, at the end: load remote images. Slide. IIRC it is disabled by default BUT I MAY BE WRONG. Sorry for screaming.
- aembleton 12y ago
  Thank-you. I didn't realise until I tried your tool that gmail is leaking out the fact that I'd opened an email. It runs through a proxy but it is still possible for it to uniquely identify that the email has been opened.
  - aembleton 12y ago
    Just noticed that under Settings > General > Images it is possible to turn off the loading of external images. That fixed it, no longer is it loading the images up.
    - metasean 12y ago
      I have a lot of privacy concerns about what Google itself does with my data, but I do like knowing that they help prevent others from surreptitiously gathering data.
- Majestic121 12y ago
  On Openmailbox, I have "Message queued. Attempting delivery" even after reading the mail, so I guess it's fine
- panarky 12y ago
  This is really cool, thank you! It shows that with Gmail, you don't need a browser extension to block pixel trackers. Gmail does that fine by default, just don't display images in the message.
  - gcr 12y ago
    Really? Gmail easily failed this test with flying colors when I tried it: the second I opened the test email, gmail fetched the 1px tracking image, revealing my User-Agent (but not my IP address, granted) to the server. How did you configure your gmail settings to pass the test? I don't think I changed the default.
    - mike-cardwell 12y ago
      As far as I remember, GMail's proxying solution also hides your User-Agent. It sends a fake one in its place which is the same for everyone.
      - gcr 12y ago
        The email privacy test correctly inferred the user agent of the browser I opened their email from when I opened it in gmail.
- RexRollman 12y ago
  Nice work Mike.
- TheLoneWolfling 12y ago
  My university email server seems to silently filter out the emails. Wonderful.
  - mike-cardwell 12y ago
    Yeah, this happens. That's why it says the following on the front page: "The email sent by this system contains numerous unusual tricks which will probably offend some spam filters. If possible, you may want to whitelist emails from sender addresses matching *@emailprivacytester.com before continuing." If you don't have that level of control, I'm not sure what you can do about it.
    - TheLoneWolfling 12y ago
      I tried that. But either the provider doesn't support wildcards or it is filtering it anyways.
- notfoss 12y ago
  Great app! For me Thunderbird didn't trigger any test. K-9 Mail triggered the Meta refresh test (but asked me to choose the browser, perhaps because I have multiple browsers installed).
benihana 12y ago
Let me save you the trouble of even using the tool: Yep, every email sent from a company to you for marketing purposes has a beacon and link tracking. If you're alarmed by this, you should also know that every website you visit can track your IP, your OS and version, and your browser and version.
- binxbolling 12y ago
  I think the real value is in seeing who's tracking that you wouldn't expect. Yes, most know that marketers are tracking the hell out of us, but there may be use cases that many are not aware of.
ryandvm 12y ago
Uh... clever? I had to scroll back up and double-check the date to make sure this article wasn't 10 years old. Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking?
- javajosh 12y ago
  Also, didn't Gmail start caching images on google servers such that tracking can't happen even if you display images? (Of course, google could track you but they already run the client so no big loss there.)
  - petercooper 12y ago
    They started caching images, but since open tracking pixel URLs are unique (after all, that's how they track an individual recipient) and Google only caches the image if you open the mail, essentially you still get tracking. You just don't get to count how many times the email is opened or the length it's opened (a common trick is to leave the connection open to see how long the client keeps the request open).
    - judk 12y ago
      Do you evidence for your claim that google only caches the image if you open the mail? That seems to defeat the entire purpose of the feature.
      - petercooper 12y ago
        Yes, that I don't have 100% Gmail open rates reported in Mailchimp. Indeed, open rates barely changed at all (they went up just slightly since I guess everyone now has images enabled by default).
- kazinator 12y ago
  > Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking? While that is true, people say "yes" because things don't display properly. Often elements like emoticons and whatnot are also remote images! "Display remote images? Yes/No" is an all or nothing proposition, in other words. The e-mail client, rather, should determine which images will display in a visible way and reject all others even if the users says Yes. It should not fetch images whose tags don't specify a width or height, or that specify one less than 16x16 pixels, and those that are positioned such that they will be clipped, or clipped by something else, so that even if filled with fetched content, they will not be visible. Basically: calculate the set of image tags that refer to images which will be obviously visible to the user. Prompt for those, and do not fetch the rest regardless of the answer.
ArekDymalski 12y ago
"Ugly" "sneaky" "disturbing" "unsettling". The article's author made quite an effort to present a a long-established (and relatively harmless) practice as a horrible thing. What is funny in the era of really disturbing practices in invading our privacy.
- mike-cardwell 12y ago
  If companies sent letters, which when opened, silently and without your knowledge sent a signal home to tell them that the letter delivered to your house had just been opened, would that be "harmless"? Personally, I would consider it, ugly, sneaky, disturbing and unsettling. But then it's ok on the Internet because this sort of tracking is easy on the Internet right?
  - ArekDymalski 12y ago
    Let's stretch the analogy a bit further. If the company representative is talking to me face to face and watching my reactions (Do I hear? Do I understand?) is that unsettling? Do people cover their faces when they are in a shop/bank? No, it's a natural part of the communication. Email is just a form of communication. I believe, ut's not that harmless that someone received the confirmation that his message was opened. Of course things get a bit complicated when someone gets too much information, but simple opening emails/clicking links is something we should accept. When we are walking down the street hundreds of people see us, see what we do. Most people do not have a problem with that. I really can't understand what is so different in case of online activity, despite the fact that we are familiar with other people seeing us in real world and the Interent is still a mentally new territory for us. And this distinction between the off- and online privacy is something what actually can inhibit the development of online society imho.
    - mike-cardwell 12y ago
      This is all down to what the user expects. When the user is having a face to face conversation with somebody, they expect and accept that person will be able to look at them and note their facial expressions and what they're saying. When somebody is sat at home opening a letter or an email, they don't expect the sender to know that they're doing it. Yes, many geeks understand that the sender will be able to see that they're doing it, but the average non-geek does not understand this.
daddykotex 12y ago
Isn't Gmail serving image from it's own proxies acting as a protection against this kind of snooping? In my understanding, opening the image loads the image from Google servers so it never hits the tracking website... Am I right?
- teej 12y ago
  This only prevents device and IP information from being broadcasted. The main information the email sender still gets is if the email was opened at all.
- mike-cardwell 12y ago
  It still leaks whether or not you viewed the email and what time, even if it doesn't leak the IP you came from. Also of note: Fastmail also uses proxies in this fashion too now.
  - pyre 12y ago
    > what time Not necessarily. Does Google cache the image when receiving the email, or when you view it?
    - mike-cardwell 12y ago
      Google only fetches the image when you first view it. At least it did when I tested it when they first started doing it.
      - talkingquickly 12y ago
        That still seems to be the behaviour, so it still works for open tracking just not the additional meta data. Fantastic tool you've created by the way!
    - deleted 12y ago
      [deleted]
    - ppadron 12y ago
de_Selby 12y ago
I just installed he extension and it seemed to give a few false alarms. One email chain with just a few acquaintances mailing back and forth was flagged.
corbet 12y ago
Weird. HTML message viewing in claws-mail refuses outright to load external images without an explicit request from the user. I have no idea why anybody would want or implement behavior different than that...?
- ptaffs 12y ago
  you do, it's because the big companies who write e-mail clients that the bulk of the population use, the same companies also are involved with advertising. There's no big money behind building a good quality privacy enabling e-mail client, or browser.
rlpb 12y ago
Any email client that permits this to happen automatically is user hostile. I really hope that Gmail doesn't do this by default. But I use mutt, so I'm not worried. If I really have to read an HTML-only email, I have mutt configured to pass the HTML to links for rendering, but in a way that links runs confined and without access to the Internet (or anything else) in order to do so[1]. It's been a few years now, and I don't feel I've really missed anything by going back to a text-mode email client. By being able to optionally render HTML as text, I can still read the occasional HTML-only email that I need to (for example: order confirmations). The rest of the time, plain text works just fine. [1] http://www.justgohome.co.uk/blog/2014/02/mailcap-html-apparmor.html http://www.justgohome.co.uk/blog/2014/02/mailcap-html-apparm...
- _lce0 12y ago
  Gmail isn't doing this by default but Inbox does it -- that's was prevented me from switching. I guess they "new take on mail" by google is not designed for end-users privacy.
  - aareet 12y ago
    Google actually uses an image proxy to thwart tracking based on images.[1] http://googlesystem.blogspot.ca/2013/12/google-uses-proxy-to-load-gmail-images.html http://googlesystem.blogspot.ca/2013/12/google-uses-proxy-to...
    - wtbob 12y ago
      Which won't work if it's a unique image (since it won't be in the proxy). And if it is a tracking image, it'll probably be unique.
      - ArchReaper 12y ago
        AFAIK they do this for all images. Not just commonly embedded images.
      - rlpb 12y ago
omgitstom 12y ago
I've always had these assumptions: If you open an html email, you are being tracked. If you click on a link in an email, you are being tracked (plain text / html) Is there any email clients someone can recommend that force plain text in multipart emails? Or convert html emails to be viewed as plain text if the email isn't multipart?
- mnw21cam 12y ago
  Alpine will do this for you. It doesn't suck too badly.
- pbhjpbhj 12y ago
  mutt? kmail used to be hugely anti html in emails so they may have more options than most for avoiding it. In thunderbird, which is my current MUA, you can choose View > Message Body As ... > Plaintext and it will display everything it can in plaintext. There's also Simplified HTML and Original HTML as options. >convert html emails to be viewed as plain text if the email isn't multipart? // Not sure if that's what thunderbird is doing but it appears to be (if I send a HTML-only email to myself the thunderbird will display it as plaintext).
deleted 12y ago
[deleted]
throwawayaway 12y ago
as much as i'd like another "don't be evil" "debate" gmail shouldn't work like that. http://gmailblog.blogspot.ie/2013/12/images-now-showing.html http://gmailblog.blogspot.ie/2013/12/images-now-showing.html correct me if I'm wrong, but the tagging support page is for "creative pages" with doubleclick, not emails: https://support.google.com/dfp_premium/answer/1347585?hl=en https://support.google.com/dfp_premium/answer/1347585?hl=en EDIT: ok well, turns out i'm wrong and here's how to turn off automatic image loading http://now.avg.com/disable-gmail-automatic-image-load/ http://now.avg.com/disable-gmail-automatic-image-load/
unusximmortalis 12y ago
the simplest (and also spartan) way to protect yourself is to set your email reader to not show pictures. so you read your emails without pictures and then you explicitly allow pictures for those emails you trust (from family, friends, etc.) "every action IS a reaction"
mrottenkolber 12y ago
> Specifically, they know when you’ve opened an email sent by one of their clients, where you are, what sort of device you’re on, and whether you’ve clicked a link, all without your awareness or consent. No they don't, I don't do HTML mail.
makmanalp 12y ago
It's "Yesware" - sloppy. This has been done for years and years such that it's pretty much common practice with any service that sends email now. And any half-decent mail client asks you before loading external resources. I guess it'd be nice if they specified why it matters.

44 points by Libertatea 12y ago

It's not a clever way, it's primitive, and does not monitor many advertising agencies (just 3 of them). The clever way would be to discover ALL advertisers AND prevent spying on our emails.

mike-cardwell 12y ago

This is where I usually jump in and mention a web app I wrote: https://emailprivacytester.com/ https://emailprivacytester.com/ Sends an email to you which checks to see how much stuff your email client is leaking. Turns out some email clients load remote content even before you click "Load Remote Images"

ojilles 12y ago
Wow that's a lot even on just iPhone Mail. This should get more attention!
- mike-cardwell 12y ago
  I'm pretty sure the iPhone mail client loads images by default. And... I could be wrong, but IIRC it also doesn't even have a way of disabling this. I don't have one to hand to test with though.
  - pfortuny 12y ago
    Control panel (or whatever it is called) and in Mail, at the end: load remote images. Slide. IIRC it is disabled by default BUT I MAY BE WRONG. Sorry for screaming.
aembleton 12y ago
Thank-you. I didn't realise until I tried your tool that gmail is leaking out the fact that I'd opened an email. It runs through a proxy but it is still possible for it to uniquely identify that the email has been opened.
- aembleton 12y ago
  Just noticed that under Settings > General > Images it is possible to turn off the loading of external images. That fixed it, no longer is it loading the images up.
  - metasean 12y ago
    I have a lot of privacy concerns about what Google itself does with my data, but I do like knowing that they help prevent others from surreptitiously gathering data.
Majestic121 12y ago
On Openmailbox, I have "Message queued. Attempting delivery" even after reading the mail, so I guess it's fine
panarky 12y ago
This is really cool, thank you! It shows that with Gmail, you don't need a browser extension to block pixel trackers. Gmail does that fine by default, just don't display images in the message.
- gcr 12y ago
  Really? Gmail easily failed this test with flying colors when I tried it: the second I opened the test email, gmail fetched the 1px tracking image, revealing my User-Agent (but not my IP address, granted) to the server. How did you configure your gmail settings to pass the test? I don't think I changed the default.
  - mike-cardwell 12y ago
    As far as I remember, GMail's proxying solution also hides your User-Agent. It sends a fake one in its place which is the same for everyone.
    - gcr 12y ago
      The email privacy test correctly inferred the user agent of the browser I opened their email from when I opened it in gmail.
RexRollman 12y ago
Nice work Mike.
TheLoneWolfling 12y ago
My university email server seems to silently filter out the emails. Wonderful.
- mike-cardwell 12y ago
  Yeah, this happens. That's why it says the following on the front page: "The email sent by this system contains numerous unusual tricks which will probably offend some spam filters. If possible, you may want to whitelist emails from sender addresses matching *@emailprivacytester.com before continuing." If you don't have that level of control, I'm not sure what you can do about it.
  - TheLoneWolfling 12y ago
    I tried that. But either the provider doesn't support wildcards or it is filtering it anyways.
notfoss 12y ago
Great app! For me Thunderbird didn't trigger any test. K-9 Mail triggered the Meta refresh test (but asked me to choose the browser, perhaps because I have multiple browsers installed).

benihana 12y ago

Let me save you the trouble of even using the tool: Yep, every email sent from a company to you for marketing purposes has a beacon and link tracking. If you're alarmed by this, you should also know that every website you visit can track your IP, your OS and version, and your browser and version.

binxbolling 12y ago
I think the real value is in seeing who's tracking that you wouldn't expect. Yes, most know that marketers are tracking the hell out of us, but there may be use cases that many are not aware of.

ryandvm 12y ago

Uh... clever? I had to scroll back up and double-check the date to make sure this article wasn't 10 years old. Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking?

javajosh 12y ago
Also, didn't Gmail start caching images on google servers such that tracking can't happen even if you display images? (Of course, google could track you but they already run the client so no big loss there.)
- petercooper 12y ago
  They started caching images, but since open tracking pixel URLs are unique (after all, that's how they track an individual recipient) and Google only caches the image if you open the mail, essentially you still get tracking. You just don't get to count how many times the email is opened or the length it's opened (a common trick is to leave the connection open to see how long the client keeps the request open).
  - judk 12y ago
    Do you evidence for your claim that google only caches the image if you open the mail? That seems to defeat the entire purpose of the feature.
    - petercooper 12y ago
      Yes, that I don't have 100% Gmail open rates reported in Mailchimp. Indeed, open rates barely changed at all (they went up just slightly since I guess everyone now has images enabled by default).
kazinator 12y ago
> Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking? While that is true, people say "yes" because things don't display properly. Often elements like emoticons and whatnot are also remote images! "Display remote images? Yes/No" is an all or nothing proposition, in other words. The e-mail client, rather, should determine which images will display in a visible way and reject all others even if the users says Yes. It should not fetch images whose tags don't specify a width or height, or that specify one less than 16x16 pixels, and those that are positioned such that they will be clipped, or clipped by something else, so that even if filled with fetched content, they will not be visible. Basically: calculate the set of image tags that refer to images which will be obviously visible to the user. Prompt for those, and do not fetch the rest regardless of the answer.

ArekDymalski 12y ago

"Ugly" "sneaky" "disturbing" "unsettling". The article's author made quite an effort to present a a long-established (and relatively harmless) practice as a horrible thing. What is funny in the era of really disturbing practices in invading our privacy.

mike-cardwell 12y ago
If companies sent letters, which when opened, silently and without your knowledge sent a signal home to tell them that the letter delivered to your house had just been opened, would that be "harmless"? Personally, I would consider it, ugly, sneaky, disturbing and unsettling. But then it's ok on the Internet because this sort of tracking is easy on the Internet right?
- ArekDymalski 12y ago
  Let's stretch the analogy a bit further. If the company representative is talking to me face to face and watching my reactions (Do I hear? Do I understand?) is that unsettling? Do people cover their faces when they are in a shop/bank? No, it's a natural part of the communication. Email is just a form of communication. I believe, ut's not that harmless that someone received the confirmation that his message was opened. Of course things get a bit complicated when someone gets too much information, but simple opening emails/clicking links is something we should accept. When we are walking down the street hundreds of people see us, see what we do. Most people do not have a problem with that. I really can't understand what is so different in case of online activity, despite the fact that we are familiar with other people seeing us in real world and the Interent is still a mentally new territory for us. And this distinction between the off- and online privacy is something what actually can inhibit the development of online society imho.
  - mike-cardwell 12y ago
    This is all down to what the user expects. When the user is having a face to face conversation with somebody, they expect and accept that person will be able to look at them and note their facial expressions and what they're saying. When somebody is sat at home opening a letter or an email, they don't expect the sender to know that they're doing it. Yes, many geeks understand that the sender will be able to see that they're doing it, but the average non-geek does not understand this.

daddykotex 12y ago

Isn't Gmail serving image from it's own proxies acting as a protection against this kind of snooping? In my understanding, opening the image loads the image from Google servers so it never hits the tracking website... Am I right?

teej 12y ago
This only prevents device and IP information from being broadcasted. The main information the email sender still gets is if the email was opened at all.
mike-cardwell 12y ago
It still leaks whether or not you viewed the email and what time, even if it doesn't leak the IP you came from. Also of note: Fastmail also uses proxies in this fashion too now.
- pyre 12y ago
  > what time Not necessarily. Does Google cache the image when receiving the email, or when you view it?
  - mike-cardwell 12y ago
    Google only fetches the image when you first view it. At least it did when I tested it when they first started doing it.
    - talkingquickly 12y ago
      That still seems to be the behaviour, so it still works for open tracking just not the additional meta data. Fantastic tool you've created by the way!
  - deleted 12y ago
    [deleted]
  - ppadron 12y ago

de_Selby 12y ago

I just installed he extension and it seemed to give a few false alarms. One email chain with just a few acquaintances mailing back and forth was flagged.

corbet 12y ago

Weird. HTML message viewing in claws-mail refuses outright to load external images without an explicit request from the user. I have no idea why anybody would want or implement behavior different than that...?

ptaffs 12y ago
you do, it's because the big companies who write e-mail clients that the bulk of the population use, the same companies also are involved with advertising. There's no big money behind building a good quality privacy enabling e-mail client, or browser.

rlpb 12y ago

Any email client that permits this to happen automatically is user hostile. I really hope that Gmail doesn't do this by default. But I use mutt, so I'm not worried. If I really have to read an HTML-only email, I have mutt configured to pass the HTML to links for rendering, but in a way that links runs confined and without access to the Internet (or anything else) in order to do so[1]. It's been a few years now, and I don't feel I've really missed anything by going back to a text-mode email client. By being able to optionally render HTML as text, I can still read the occasional HTML-only email that I need to (for example: order confirmations). The rest of the time, plain text works just fine. [1] http://www.justgohome.co.uk/blog/2014/02/mailcap-html-apparmor.html http://www.justgohome.co.uk/blog/2014/02/mailcap-html-apparm...

_lce0 12y ago
Gmail isn't doing this by default but Inbox does it -- that's was prevented me from switching. I guess they "new take on mail" by google is not designed for end-users privacy.
- aareet 12y ago
  Google actually uses an image proxy to thwart tracking based on images.[1] http://googlesystem.blogspot.ca/2013/12/google-uses-proxy-to-load-gmail-images.html http://googlesystem.blogspot.ca/2013/12/google-uses-proxy-to...
  - wtbob 12y ago
    Which won't work if it's a unique image (since it won't be in the proxy). And if it is a tracking image, it'll probably be unique.
    - ArchReaper 12y ago
      AFAIK they do this for all images. Not just commonly embedded images.
    - rlpb 12y ago

omgitstom 12y ago

I've always had these assumptions: If you open an html email, you are being tracked. If you click on a link in an email, you are being tracked (plain text / html) Is there any email clients someone can recommend that force plain text in multipart emails? Or convert html emails to be viewed as plain text if the email isn't multipart?

mnw21cam 12y ago
Alpine will do this for you. It doesn't suck too badly.
pbhjpbhj 12y ago
mutt? kmail used to be hugely anti html in emails so they may have more options than most for avoiding it. In thunderbird, which is my current MUA, you can choose View > Message Body As ... > Plaintext and it will display everything it can in plaintext. There's also Simplified HTML and Original HTML as options. >convert html emails to be viewed as plain text if the email isn't multipart? // Not sure if that's what thunderbird is doing but it appears to be (if I send a HTML-only email to myself the thunderbird will display it as plaintext).

deleted 12y ago

[deleted]

throwawayaway 12y ago

as much as i'd like another "don't be evil" "debate" gmail shouldn't work like that. http://gmailblog.blogspot.ie/2013/12/images-now-showing.html http://gmailblog.blogspot.ie/2013/12/images-now-showing.html correct me if I'm wrong, but the tagging support page is for "creative pages" with doubleclick, not emails: https://support.google.com/dfp_premium/answer/1347585?hl=en https://support.google.com/dfp_premium/answer/1347585?hl=en EDIT: ok well, turns out i'm wrong and here's how to turn off automatic image loading http://now.avg.com/disable-gmail-automatic-image-load/ http://now.avg.com/disable-gmail-automatic-image-load/

unusximmortalis 12y ago

the simplest (and also spartan) way to protect yourself is to set your email reader to not show pictures. so you read your emails without pictures and then you explicitly allow pictures for those emails you trust (from family, friends, etc.) "every action IS a reaction"

mrottenkolber 12y ago

> Specifically, they know when you’ve opened an email sent by one of their clients, where you are, what sort of device you’re on, and whether you’ve clicked a link, all without your awareness or consent. No they don't, I don't do HTML mail.

makmanalp 12y ago

It's "Yesware" - sloppy. This has been done for years and years such that it's pretty much common practice with any service that sends email now. And any half-decent mail client asks you before loading external resources. I guess it'd be nice if they specified why it matters.