"Not blindly loading elements works just fine
Posted Oct 12, 2017 17:18 UTC (Thu) by david.a.wheeler (subscriber, #72896) [Link]
> All of them. The way this generally works is that there's a unique, invisible, element in the email, like a 1x1 pixel image. When that image is requested, the server marks that the email has been read. Since most email clients blindly load all HTML elements this works. Even for the more careful clients that don't load elements from remote servers by default and ask the user to click a "load full message" (k-9 mail on android does this), most HTML mail is unreadable without those remote assets because the layout is completely broken.
I don't load elements from remote servers by default, and practically never have problems with desirable email. In my experience, email that's broken without remote loading is practically always spam.
> This is even harder for mail client's that have to rely on a third-party rendering engine for HTML mail, since they don't necessarily have the hooks into the renderer to tell it not to load remote content.
At least some third parties DO support this functionality."
I use a non-major, non-modern "web browser" that does not load elements from remote servers, and I practically never have problems with desirable content.
The "blind loading" problem extends to web browsers in addition to email.
In fact, email clients took the idea of tracking from web browsers and applied it to HTML email.
It may be possible to disable autoloading of images such as 1x1 pixels but unfortunately the "major" aka "modern" browsers do not allow users to disable all blind loading, e.g., malicious .js files.
For example, the recent Equifax incident involved blind loading of an undesirable .js file.
This "blind loading" is the foundation of tracking and web ads, not just spam.
It seems the more the more "major" a browser is considered, the more people refer to it as "modern", the better the browser works for tracking. Strange coincidence I guess.