Hacker News Reader

Comment by andyjohnson0 | Hacker News Reader

See [1] for a description of how the tracking works - scroll down to "So how does that tracking work?". It appears to use embedded links to message-specific 0-by-0 pixel remote images.

[1] http://www.ghacks.net/2014/02/22/can-streak-really-track-gma...

View on HN

"Whenever a user opens the email without proper protection" is the caveat here.

Someone posted a site they'd built recently that would send you an email with all the nasty tracking tricks in them, and let you see which your client fell for. I was sad to see gmail choked on most of it.

Well, I am very happy to see that OS X's Mail.app with remote content disabled does not trigger a single one of them.

No need to feel sad. People who use Gmail likely aren't concerned about privacy anyway.

I just tested gmail with emailprivacytester and it didn't fall for any of them (and only fell for the image tags when I clicked a button to allow images in the e-mail to be displayed) so they may have beefed things up in response to that site

Make sure to check that the IP addresses are yours. Gmail loads images to their own servers and then serves them to your Gmail UI from there, so trackers shouldn't get your actual IP.

I wrote a blog post about this for iOS apps: https://dannysu.com/2015/12/11/best-ios-email-apps-for-priva...

If you're on mobile, basically majority of the apps out there suck at this.

You need to turn image loading off by default and then Gmail, built-in Mail, and FastMail are the only ones that pass.

If anyone can identify the site peteretep mentions, eternal gratitude: I want to test it.

https://emailprivacytester.com/ by https://news.ycombinator.com/user?id=mike-cardwell

Didn't google started to host copies of images referenced in gmail a while back though? This should make this method useless for a lot of email addresses.

Reply on news.ycombinator.com