Hacker News Reader

Comment by microcolonel | Hacker News Reader

I guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless.

I always assumed that disabling 1x1px images would be first on the list of mitigations against this technique. I was under the impression that email clients, in addition to an option to block images in general (usually on by default for an address or origin), generally prevented the loading of remote images. Embedding images directly into emails is fine, isn't it?

View on HN

Depending on the platform used to send the email, it's trivial to change that pixel to any other image, ie a brand logo in the template.

On the whole, disabling images entirely is the only real defence against email tracking.

Or I guess the mail server could just always precache all images at the time of receipt. Then nothing new happens when the mail is read. I think somebody here is describing GMail's approach that way.

Then email servers would have to download billions of images of which 99% the corresponding email won't even be opened

gmail's cache hides a users location but you can still tell when they've opened an email, and you can still get a ton of information if they click a tracked link within the email as well.

You can't tell if an image is a 1x1 pixel until you load it from the server. At that point, the pixel has already done its job.

Most email clients these days don't block images by default unless it ends up in the spam mailbox.

They never embed images directly into emails either.

At least Thunderbird and Outlook on Mac block images by default and you can whitelist people from your address book.

The easiest way is to disable them by default which is why Thunderbird defaults to not loading from senders not yet whitelisted, which thankfully most HTML email has the text on the email, it's those darn emails that have all the text in an image that I get suspicious of and delete (usually spam / probably malware). It would be nice to see plugins to block them for sure. I use Thunderbird for work, keep forgetting to use it for regular email. At least even webmail email services block pictures by default now, probably to prevent browser exploitation, never know when someone finds some rogue PNG exploit.

Reply on news.ycombinator.com