Hacker News Reader

Comment by spzb | Hacker News Reader

Doesn't Mail do this by default by not loading remote images?

Yeah, I'm mildly confused by what the sell point here is. I sort of assume that any loading of remote resources automatically represents tracking information for this use-case, every email can be trivially individualized to the receiver and in turn I don't see how it's feasible to prevent resource tracking. You either load remote resources, or you don't. I guess if techniques remain relatively unsophisticated for email and few people bother then individuals might slip under the radar, though partial blocking itself represents a signal. But unlike the web individual messaging remote resources seems like an arms race users would be destined to lose.

The only thing I could see really working would depending on a really big service that processed every received email immediately and proxied all remote resources without any user interaction. Plenty of challenges there too though, and harder to make it work with regular clients. Maybe dynamically rewriting the email to point to the proxied resources? Or automatically rendering/inlining them?

>Maybe dynamically rewriting the email to point to the proxied resources?

AFAIK gmail already does that. It prevents people from knowing your IP address, but they still know whether you opened the email or not, since it's lazy loaded. Preferably there's a email service that always loads the images and stores it, so you can view images without any spying.

It does, but I guess this is for people who like images most of the time, and just want to avoid the tracking without sacrificing ux. I'm guessing it's inspired by https://hey.com/spy-trackers/, which also has a similar feature that works on a blacklist basis (presumably).

I'm curious why they wouldn't also eager-load _other_ images.

As soon as an email is received (regardless of whether the recipient account exists or not), load the image from the remote host.

This also degrades the spying capabilities of third parties. If they track image loads to translate this to "email opened", they'll immediately get pure false positives from any email they sent to @hey.com -- even if the account doesn't exist.

Note that apple has a bug, and has had it for years and years.

If you have it turned off it won't load remote images...

EXCEPT: if you forward an email - it will load them all, all of them. This is especially troublesome if you want to forward a phishing email to IT.

(thank you little snitch. also I am not using the latest catalina apple mail)

You can bypass this by doing "forward as attachment", which you should be doing anyway, since it preserves the headers.

Thanks for posting this.

Your friendly email inspector who needs to explain this x times a day.

For anyone not using it, the great thing about Little Snitch is being able to set just the precise port numbers and remote hosts you want a given app to access while blocking everything else, rendering plug-ins like MailTrackerBlocker unnecessary. You can also set profiles for different networks, and even have them switch automatically: https://help.obdev.at/littlesnitch/adv-profiles .

Reply on news.ycombinator.com