5 ms·

This is where I usually jump in and mention a web app I wrote: https://emailprivacytester.com/ https://emailprivacytester.com/ Sends an email to you which che

This is where I usually jump in and mention a web app I wrote: https://emailprivacytester.com/ https://emailprivacytester.com/ Sends an email to you which checks to see how much stuff your email client is leaking. Turns out some email clients load remote content even before you click "Load Remote Images"

ojilles 12y ago
Wow that's a lot even on just iPhone Mail. This should get more attention!
- mike-cardwell 12y ago
  I'm pretty sure the iPhone mail client loads images by default. And... I could be wrong, but IIRC it also doesn't even have a way of disabling this. I don't have one to hand to test with though.
  - pfortuny 12y ago
    Control panel (or whatever it is called) and in Mail, at the end: load remote images. Slide. IIRC it is disabled by default BUT I MAY BE WRONG. Sorry for screaming.
aembleton 12y ago
Thank-you. I didn't realise until I tried your tool that gmail is leaking out the fact that I'd opened an email. It runs through a proxy but it is still possible for it to uniquely identify that the email has been opened.
- aembleton 12y ago
  Just noticed that under Settings > General > Images it is possible to turn off the loading of external images. That fixed it, no longer is it loading the images up.
  - metasean 12y ago
    I have a lot of privacy concerns about what Google itself does with my data, but I do like knowing that they help prevent others from surreptitiously gathering data.
Majestic121 12y ago
On Openmailbox, I have "Message queued. Attempting delivery" even after reading the mail, so I guess it's fine
panarky 12y ago
This is really cool, thank you! It shows that with Gmail, you don't need a browser extension to block pixel trackers. Gmail does that fine by default, just don't display images in the message.
- gcr 12y ago
  Really? Gmail easily failed this test with flying colors when I tried it: the second I opened the test email, gmail fetched the 1px tracking image, revealing my User-Agent (but not my IP address, granted) to the server. How did you configure your gmail settings to pass the test? I don't think I changed the default.
  - mike-cardwell 12y ago
    As far as I remember, GMail's proxying solution also hides your User-Agent. It sends a fake one in its place which is the same for everyone.
    - gcr 12y ago
      The email privacy test correctly inferred the user agent of the browser I opened their email from when I opened it in gmail.
RexRollman 12y ago
Nice work Mike.
TheLoneWolfling 12y ago
My university email server seems to silently filter out the emails. Wonderful.
- mike-cardwell 12y ago
  Yeah, this happens. That's why it says the following on the front page: "The email sent by this system contains numerous unusual tricks which will probably offend some spam filters. If possible, you may want to whitelist emails from sender addresses matching *@emailprivacytester.com before continuing." If you don't have that level of control, I'm not sure what you can do about it.
  - TheLoneWolfling 12y ago
    I tried that. But either the provider doesn't support wildcards or it is filtering it anyways.
notfoss 12y ago
Great app! For me Thunderbird didn't trigger any test. K-9 Mail triggered the Meta refresh test (but asked me to choose the browser, perhaps because I have multiple browsers installed).

ojilles 12y ago

Wow that's a lot even on just iPhone Mail. This should get more attention!

mike-cardwell 12y ago
I'm pretty sure the iPhone mail client loads images by default. And... I could be wrong, but IIRC it also doesn't even have a way of disabling this. I don't have one to hand to test with though.
- pfortuny 12y ago
  Control panel (or whatever it is called) and in Mail, at the end: load remote images. Slide. IIRC it is disabled by default BUT I MAY BE WRONG. Sorry for screaming.

aembleton 12y ago

Thank-you. I didn't realise until I tried your tool that gmail is leaking out the fact that I'd opened an email. It runs through a proxy but it is still possible for it to uniquely identify that the email has been opened.

aembleton 12y ago
Just noticed that under Settings > General > Images it is possible to turn off the loading of external images. That fixed it, no longer is it loading the images up.
- metasean 12y ago
  I have a lot of privacy concerns about what Google itself does with my data, but I do like knowing that they help prevent others from surreptitiously gathering data.

Majestic121 12y ago

On Openmailbox, I have "Message queued. Attempting delivery" even after reading the mail, so I guess it's fine

panarky 12y ago

This is really cool, thank you! It shows that with Gmail, you don't need a browser extension to block pixel trackers. Gmail does that fine by default, just don't display images in the message.

gcr 12y ago
Really? Gmail easily failed this test with flying colors when I tried it: the second I opened the test email, gmail fetched the 1px tracking image, revealing my User-Agent (but not my IP address, granted) to the server. How did you configure your gmail settings to pass the test? I don't think I changed the default.
- mike-cardwell 12y ago
  As far as I remember, GMail's proxying solution also hides your User-Agent. It sends a fake one in its place which is the same for everyone.
  - gcr 12y ago
    The email privacy test correctly inferred the user agent of the browser I opened their email from when I opened it in gmail.

RexRollman 12y ago

Nice work Mike.

TheLoneWolfling 12y ago

My university email server seems to silently filter out the emails. Wonderful.

mike-cardwell 12y ago
Yeah, this happens. That's why it says the following on the front page: "The email sent by this system contains numerous unusual tricks which will probably offend some spam filters. If possible, you may want to whitelist emails from sender addresses matching *@emailprivacytester.com before continuing." If you don't have that level of control, I'm not sure what you can do about it.
- TheLoneWolfling 12y ago
  I tried that. But either the provider doesn't support wildcards or it is filtering it anyways.

notfoss 12y ago

Great app! For me Thunderbird didn't trigger any test. K-9 Mail triggered the Meta refresh test (but asked me to choose the browser, perhaps because I have multiple browsers installed).