Hacker News Reader

Comment by skimmas | Hacker News Reader

I believe gmail caches all the images so that leaves out a huge amount of the world maiboxes.

I have tested an image generated with this script in both Gmail and outlook clients and it works just fine. Else I wouldn't post it over here of course :)

You're right. Google changed the way they did images a while back to prevent email image marketers who used to track when the user opened an email using a 1pixel transparent image downloads.

They changed about two years ago to run all images sent to a gmail address through their servers (and presumably store them). It specifically didn't effect marketing though. I was working in email marketing at the time and there was some temporary gnashing of teeth but this was not much more than a blip.

https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

"1x1 transparent pixel" is called a "tracking pixel".

Gmail still allows marketers to track when a user opens an email (even better than before, since it no longer asks users whether they want to load images). However, they proxy the request so that the tracking pixel host no longer gets the user's IP address or third party cookies.

Where can I read more about this? Doesn't this help spammers? I thought I was safe if I disable auto-loading of images!

Then don't open spam? I don't think a spam email has made it to my inbox in almost 5 years. Google's proxy protects your private data and only informs the sender that the email has been opened. I would hardly call that "unsafe"

You're safe either way, but if you have autoloading disabled they still can't track that you've read until you load the images.

The change is that clicking to load images is no longer the default [0]

Do you get enough spam on your Gmail for this to be a worry point? Genuinely curious; I get roughly zero.

[0]http://www.wired.com/2013/12/turn-gmail-auto-image-loading-o...

> You're safe either way

Eh? Before they used track-me.example.com/IDHERE and got blocked, now they use IDHERE.track-me.example.com and don't get blocked.

Move the unique ID to DNS and Google will let it through.

I assumed by safe you meant something else.

Yes if you load images they can track that you have opened the email.

I fail to see how that is 'unsafe' though. It's expected functionality.

It's expected that they can track you, when before they blocked the images to prevent that?

From my testing, it seems like Gmail will cache via its proxy, but that cache respects the cache headers, so you can instruct Gmail how often to refresh the data.

(That, and you can cache-bust on a per user basis using a unique identifier in the query string.)

Few month ago I tested this, and it's seems they do not cache. Instead they are just using proxy to enable anonymous download of the image. But you never it any cache from google directly.

They do cache at least sometimes, and they must for it to work.

If I send you an image URL http://example.com/fH27cAw, and they URL is requested, you must have opened my email (unless something is requesting them regardless).

I actually wrote a little tool to help test this: https://github.com/kale/image-cache-logger

You'll see that it in fact does get cached by Gmail, but only for a limited time.

It does work in gmail. Jetstar, an Australian air travel company, uses this technique (IIRC) and it works fine in gmail.

And regardless, I cannot support a project that I know will primarily be used to annoy the shit out of me in my own inbox.

Dont dismiss something just because the current usecase doesnt suit you.

Actually, I implemented this very thing in C# on top of weather radar imagery back in 2006 (to be able to overlay real-time weather on a 3rd party mapping widget), so I've given the entire concept full consideration already.

Reply on news.ycombinator.com