Hacker News Reader

Comment by jaclaz | Hacker News Reader

>Emails demanding deletion of the memo contained “pixel trackers” that notified human resource managers when their messages had been read, recipients determined.

This seems like the worst part (not that the rest is not bad), anyone has an idea of what this "pixel trackers" are and how they actually work?

View on HN

Pixel trackers are invisible images which are the size of a single pixel hidden within a given email (Not visible in most mail clients). These images are sourced from a unique url (unique per email address) which when accessed are tracked by the web service as a view of a given email from a given individual. These are usually used in marketing emails to see how effective their campaigns are.

more info @ https://en.ryte.com/wiki/Tracking_Pixel

Pixel trackers are just small embedded images in the email that when they are fetched from a server, the server logs it. Pretty simple way to track whether or not someone has opened an email. It's my understanding that gmail however downloads all images and then serves them from Google servers to avoid this issue entirely.

Traditional email clients like Outlook/Thunderbird are susceptible to this kind of attack. That's why they often ask you before loading images.

https://smallbusiness.chron.com/set-email-tracking-pixel-493...

All Google does is proxy the images to hide your IP address. The images are proxied on-read so read receipts are still being leaked.

A Google employee has confirmed to me that they tested killing email read receipts but it was shelved as it broke too many partner integrations.

Variants of "pixel trackers" still work fine on Gmail despite this. To this day a lot of marketing, recruiters and others are tracking when you open their message on Gmail.

How are these variants working? Curious about how they are getting around google hitting all of them.

I assume Google doesn't request the image until the email is opened.

Even with images disabled?

No, disabling images breaks pixel tracking. One way to quickly sanity check a mail client's priorities is whether it gives you the option to disable images by default.

Some clients that don't allow you to disable by default: Polymail, Gmail on iOS, Inbox (Google) on IOS

If it's free, you're the product...

Ha I thought you were wrong, but it turns out that indeed, you can disable image loading in the Gmail Web interface, in the Android app, but not on iOS: https://support.google.com/mail/answer/145919?co=GENIE.Platf...

This is the reason why you never enable images in your email client.

Gmail sucks a bit because it always enables certain images in email and that means that google pixel trackers are really hard to block if you use google mail. If I were an employee, I’d switch to a non-google email client.

The privacy issue is problematic, but their functionality is also buggy. Untrained users will misinterpret them as they can get triggered by previews or other functions beyond just reading the message.

Do you mean desktop Gmail enables certain images, even if you disable images by default? That's news to me, can you give examples of some sites for whose emails this is true?

I mean gmail.com accessed via browser.

Just want to throw out that pixel trackers are EXTREMELY common - you probably have an insane amount in your inbox now and a lot of email software uses them by default. Not saying this is okay, just giving that context.

I turn off downloading images by default. They'll have to work harder to know if I read my email.

At one time gmail went ahead and fetched the images anyway, but didn't display them. The tracking still could record the "open event" although it didn't get a hit directly from the user's browser, rather through Google's image cache server.

I don't know if that's still the case.

> At one time gmail went ahead and fetched the images anyway, but didn't display them.

SMH. I read things like this and I really just hope the internet implodes one day.

The hypocrisy of Google embedding pixel trackers to monitor their own employees while forbidding external images in their gmail service to prevent companies trying to abuse users with pixel trackers is painfully blatant.

Do as I say, but my company is super special so we'll just do whatever we feel like.

Probably something like <img src="http://google.com/pixel.gif?mailid=23949129"> in a mail. When you download the image, Google knows you have read the mail.

> This seems like the worst part (not that the rest is not bad), anyone has an idea of what this "pixel trackers" are and how they actually work?

This is very old tech. "Invisible" image linked to a url. Pretty much every ad email has pixel trackers for data ( impressions, etc ). It's used heavily in marketing.

Not sure why google would use such primitive tech. There are better ways to verify that an message has been opened and read.

can you share some alternatives? My email client blocks images, but I would like to learn about other methods that are being used to improve privacy

It's a small transparent pixel loaded from a website (assuming the email client loads HTML). I'd make a unique image called mywebsite.com/jaclaz_read.png and when that image was loaded I'd know you read my email.

I see, never knew they were called "pixel trackers".

I am particularly "old style", I know, but I tend to use not whenever possible email clients that load the html, so an old habit turns out to be also (at least partially) "safer".

In large companies like this you rarely get a choice for which email client you are allowed to use, or a say in which software you are allowed to install.

Yep, I can understand that, but I thought that this was an elite, a subset of high rank developers that surely (or at least I would hope so) could have a bit more of leeway by the management and/or be capable of work around this kind of nonsense.

Of course in the US a lot of practices revolving around "controlling employees" are allowed and even considered "normal" whilst in Europe they are seriously frown upon.

That seems so odd. Doesn't Google's corporate email system have read receipts like Microsoft Outlook?

Worse than knowing they had been read is that fact that it can (and was probably intended to) detect who may have leaked the email if it made it to the outside, who is was leaked to, and how far it had spread.

You must be young.

    <img src=“https://internal.google.com/track” width=“1” height=“1” />

Reply on news.ycombinator.com