Hacker News Reader

Comment by eli | Hacker News Reader

Gonna have a pretty high false negative rate though, right? Virtually all modern email programs and webmail systems block images by default (unless the sender has been marked as "safe" or sometimes if they've been added to your address book).

You might as well steal some of the (very clever) tricks used here: http://litmus.com/email-analytics to track whether the messages was forwarded and the time spent reading. They don't work all the time, but it's a pretty neat piece of code.

View on HN

Just from looking at the litmus site I can't tell what "very clever" tricks they use, and I don't want to spend money signing up to find out. Thinking off the top of my head, perhaps they could be requesting a CSS stylesheet or an CSS3 font from their server to track reads without using an image. But that is all I can think of right now.

Could you tell me more about the "clever tricks" they use Eli?

Edit: I just thought of another trick: using the background-image or list-style-image CSS property to request an image from your own server. I found a chart that shows CSS support in major email services. Gmail looks like it would be the hardest to implement tracking in. In many other email clients it would be trivially easy:

http://www.campaignmonitor.com/downloads/documents-tools/Cam...

They generate a unique image for each email and track when the image has been accessed.

As others have mentioned, many email clients automatically block image downloads by default. So this way of tracking, at first glance, seems pretty limited.

Right. I was trying to think of clever tricks to get around image blocking. Some techniques, such as list-style-image look like they can get around most email services.

I'm not actually sure they did much better than a regular image for tracking opens though I believe they also did a background-image. The clever bit was using some CSS with a background image to track the message being forwarded (outlook adds some predictable CSS class names to the message when it reformats it for forwarding) and the use of an image resource that never actually loads, but does a sleep/redirect loop so it can track how long the message has been open (assuming images aren't blocked in the first place). Also another CSS directive to see when the message is being printed. At least, that's what I remember when I disassembled the code some months ago. If I can dig it up when I'm back in the office, I'll post it.

Though I think you have a much better chance of getting people to load images in a newsletter or marketing message where that's the norm versus a personal message where it might seem weird or unnecessary.

the use of an image resource that never actually loads, but does a sleep/redirect loop so it can track how long the message has been open

Hmm, very interesting. So they essentially make their server side script sleep for a few seconds, but not long enough that the client gives up waiting, then they send the client a redirect to the same script again. When the client stops requesting the fake image then it is safe to assume that the email is no longer being read.

That is a great idea, very innovative. I wondered how they were measuring how long the email was read.

You'd think that wouldn't you. I found ways to track this stuff even when remote images are disabled in Thunderbird, Apple Mail, Android Mail, Mail on iOS, Outlook, tonnes of webmail apps:

https://secure.grepular.com/Apple_Mail_Privacy_Hole

https://secure.grepular.com/iOS4_iPhone_Email_Privacy_Leak

https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunder...

I created a web application which crafts an email with lots of tests and sends it your address. When you open it, it tries to "call back" to my server and the web page shows you the results. If you see anything on there before hitting "Load Images" your client has a problem. You can access the app here:

https://secure.grepular.com/email_privacy_tester/

FWIW, my yahoo mail account with default settings passes that just fine.

Hey look, mutt and Gnus don't leak my personal information. What a surprise.

Thunderbird 3.1.4 doesn't trigger anything. All yellow stars.

Thunderbird 3.1.0 used to trigger the dns prefetch test, but yeah it's fine now.

gmail didn't trigger any.

That's a great and valid concern. We have studies that show that there is a high volume of people who enable images and thus we would get accurate readings there.

Open-tracking is just one of the features we have, and not central to our entire product. Response-tracking is something that we anticipate more people want to use, and is guaranteed to work in our implementation.

Thanks for the ideas! Stay tuned for our new features that we have planned. We named ourselves EmailOracle for a reason :)

If possible could you tell us what the "high volume of people who enable images" is exactly? Is it 50%, 75%?

I am curious because part of my startup-in-progress will eventually include tracking of email notification reading using images, or other tricks.

I think if you're "certified" with ReturnPath, certain webmail companies (Hotmail, one other?) will autoload images in your email.

Wow. That's really interesting. Where did you learn that?

Phone call with ReturnPath :)

Reply on news.ycombinator.com