Hacker News Reader

Comment by pfundstein | Hacker News Reader

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

View on HN

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message.

Apple's macOS Mail.app client displays external images by default, as does their iOS app.

on iOS: turn that off with Settings > Mail > Load remote images

recently i am seeing certain images still loaded, whereas in the past none loaded. i haven’t investigated what is different about these images yet, though. anyone else observe similar?

You can embed the image inside the actual multi-part message, and it will be shown without accessing network. It is usually used for logos, signatures and the such and, afaik, can't be used for tracking mail opening.

Could be images with image data included in the email, that don't need to load remotely.

I'm somewhat disappointed that Apple doesn't offer better default privacy for Mail.

Perhaps they can't figure out a good solution to differentiate between benign images and tracking images; it does seem like it would be nearly impossible to do so, but I wouldn't mind a) blocking external images by default, b) per-sender/recipient settings, and c) clearly displaying "invisible" images and warning about them.

Perhaps someone has some better ideas on how to fight this scourge?

I tend to think that the only practical solution is to block them entirely, but then malicious senders will send URLs that say "click here to view message."

Maybe HTML email wasn't such a great idea.

I think images stored as attachment aren't really a problem. If you really need to have images and care about the privacy of your users, just do that.

The problem is that it's easy to serve a company logo at example.com/images/${unique_tracking_id}.png that also logs the tracking ID.

How do you tell a unique tracking ID from PR-IMG20190312-023045-logo-MARKETING-COPY(5).png?

Yes, HTML e-mail is dumb. But even instant messaging assumes the ability to load/preview images from the web at this point, so probably no real options at this point.

macOS Mail.app -> Preferences -> Viewing -> Uncheck "Load remote content in messages"

Privacy defaults come down to usability vs. privacy; Apple making this so easy to toggle is fine by me as I care about privacy and tracking.

Now, it would be great if every macOS application walked you through privacy settings right after installation in the same way that I am offered a tour of the new features. Since there is no such "privacy tour", the community has discussed ways in which macOS can be hardened [1], [2].

1. https://github.com/drduh/macOS-Security-and-Privacy-Guide

2. https://news.ycombinator.com/item?id=18099835

Maybe the proxy removes metadata such as useragent, but often the pic urls contain uniquely identifiable information, eg a number that is unique to that email that received the email. That way you still leak that it is opened, how often, etc (unless they cache, I don't know).

Isnt the proxy downloading and caching the image before the user opens the email? If so doesnt that prevent tracking if/when the user actually opens the email?

It may have changed since then, but Fillipo Valsorda wrote up some details about this, and how to validate how the proxy works - https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

It does not. That's how it should work, but it does not work that way. It downloads them on demand if and when the user views an email. So it protectes the users IP address from the spammer/marketter, but not the fact that the message was viewed nor when it was viewed.

The amount of email that is sent and not opened would probably destroy the origins - might be ok. But it would waste a huge, huge amount of bandwidth and CPU to download them which would open up an attack vector (DoS) on any email service that did this. Images can be legitimately very big...

I'm not convinced that this would be as big a problem as you're suggesting. If somebody is sending thousands of emails with html containing embedded images, the receiving system of those emails only needs to download each of those images once, and cache them.

Unless they're using different URLs for each image for tracking purposes. Which would become pointless if the images were downloaded immediately.

They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large.

It would even work for people using normal IMAP clients if they attached the images to the email directly and switched out the href in the img tags to point at the attachment instead.

This whole thing could be a user setting which can be toggled. Defaulting to the most privacy friendly option.

> They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large.

Or only allow inline images.

Unless I'm mistaken, Gmail's setting "Ask before displaying external images." should address this issue.

It does indeed, however it really ought be enabled by default rather than having to hunt it down in the settings, something most users won't do.

Stop using free email services?

Here's the one I use : https://protonmail.com/blog/how-big-tech-tracks-users/

You can disable, showing images.

And then you get button to show images if you need it.

I prefer to use gmail this way, since most of the images are usually tacky signatures, or legal disclaimers or something else I don't need.

And if there are pictures you need there is show images button.

Last I checked some years back, in GMail an e-mail with a "footer.jpg?user@gmail.com" img tag will only load that URL when the user views the e-mail.

It's optional in gmail. I've had it disabled for years.

Are you sure that the iOS mail app loads these images by default?

Yes it does. It's one of the first things I disable when setting up a new phone.

You can disable the displaying in GMail.

Settings > Images > Ask before displaying external images

There is a plugin for macOS Mail.app that tries to emulate Hey's tracker blocking.[1] I just installed it and it seems to be working. Also translated all 3 strings to Russian while I'm at it.

[1] https://github.com/apparition47/MailTrackerBlocker

Not only that, but the way the article came about seems to be a bit strange. Apparently the BBC asked Hey to some analysis on their emails, and have written what appears to be a publicity piece for them on the result.

Did you know that Hey allows you to block tracking pixels for the low price of $99/year? Now you do!

Not the kind of thing I'd expect to see from the publicly funded BBC.

The BBC has form on this. They periodically publish news articles reporting that a person's life was saved by the app What3Words, without mentioning the existence of similar proprietary and open systems.

See for example:

=> https://www.bbc.co.uk/news/uk-england-stoke-staffordshire-55... 2021-02-03 What3words: Stafford women rescued from flooded river after using app

=> https://www.bbc.co.uk/news/technology-49754820 2019-09-20 What3words: 'Life-saving app' divides opinion

=> https://www.bbc.co.uk/news/uk-england-49319760 2019-08-15 What3words: The app that can save your life

(Yes, that's the headline they used.)

=> https://www.bbc.co.uk/news/technology-47705912 2019-03-26 Three-unique-words 'map' used to rescue mother and child

=> https://www.bbc.co.uk/news/technology-40935774 2017-08-30 TEDGlobal: Three words that give people an address

=> https://www.bbc.co.uk/news/business-32444811 2015-04-29 Giving everyone in the world an address

They're even using the company's marketing materials for the images in the articles.

If I had the time or energy, I'd complain about all of the above.

Many third-party mobile email clients I've used in the past never gave you the option of disabling image loading, though some of them finally added the feature after many years (e.g. Outlook).

Gmail does. This is great for privacy because it destroys the usefulness of the tracking pixel to the marketer.

Eh... Not really... It's pretty easy to generate a unique image url per customer and use that to determine whether a customer opened the mail or not and it's about the same cost as a traditional tracking pixel, complexity-wise.

Indeed, the three email tracking services I'm familiar with (HubSpot, Yesware, and Outreach) all generate unique URLs per recipient. The only information you don't get for Gmail clients is location, but you get the most valuable info which is if/when/how many times the email is opened.

I remember reading that gmail caches these images, rendering the how-many-times useless.

GMail absolutely caches images. The cache is primarily for performant delivery of data over mobile networks though and reduced load of repeat same-day viewing, and less for privacy.

While their cache is large, it's not infinite. If what you're interested in is whether a customer engages with an email multiple times over a few days, you'll likely get the pixel hits to confirm it over that time period. Of course, as you imply, you wouldn't be able to collect how many times an hour a single customer has viewed an email sent to them.

I have tested this and the cache expires pretty quickly. From memory 10min -30. I thought that was fine because its around about one hit per session.

You get enough good information. The IP address would be even better however.

Does Gmail download by default, whether you open the email or not?

Gmail caches by default.

The catch is that Gmail caches all the same images from the same servers, so email marketers get around it by serving tracking pixels with obscure, unique URLs per individual.

Geotargeting fails because it loads on GMail servers.

Yes, I understand the caching part. If Gmail proactively loads/cache the unique pixel before users open the email, then the email reporting is garbage. If they wait for the person to open the email, it is very interesting (even if repeat are not tracked).

I was confused on this, but it looks like the email has to be opened once for Google to cache the image.

How?

     https://jioegijogeijesgioegeg.tracking.example.com/niowefioe.png?sdgsdbuegiu=rojpopwmrmwk

has four places to store unique information.

Does Gooogle's proxy remove all of them?

Download via a proxy and cache the image when you receive the e-mail.

It's processed in the queue and opened. Was it the user? Did it hit Inbox? Where did it got opened? When it's opened? How many times it opened?

All these information's reliability got out of the window with a single optimization. You can't know how this mail was processed and it's fate. So, your tracking pixel and URL returned something useless to you.

Aha so it's not just a proxy. It's a pre-fetching proxy. Understood you.

Edit: oh :(

That’s not how Gmail works and it doesn’t protect your privacy that way:

https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

That’s not how Gmail works and it doesn’t protect your privacy that way:

https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

I didn't intend to say or have claimed that Google works this way, but it can be done that way, if one is so inclined.

My mistake. It looks like google still waits for an initial email view to cache the image. Kind of wish they would load images for unviewed emails too.

Apple mail will load them if you forward an email, even if you have remote images turned off. (last I checked)

Can Little Snitch and similar software be used to stop images, pixels, from loading and from being sent on a reply or forward?

yes, but although little snitch has managed to survive on macos, on ios you have no thing to verify or protect you.

My email client doesn't even have the capability to display images or download anything...

(It's mutt.)

iOS mail, alas.

I just found it turned on. I forgot to disable it again after my annual OPSEC-cosplay device-wipe.

I've seen this expression here a few times and I don't mean to single you out, but arghhh!

The cos in cosplay stands for costume. Roleplay! Unless you are putting on a literal white hat I suppose, that would be cool.

It's figurative? The point is that they're pretending to be something they're not.

That would be larping. Not cosplaying. I disavow both.

And to elaborate on this

Larp = live action role playing. Where you act as your character, as opposed to table-top role playing, where you say what your character does.

I think at one point Gmail was wanting to do that then didn’t do that.

ALL of the top 10 email clients download external images by default.

My Thunderbird doesn't. Is it no longer in the top 10? (Was it ever in the top 10?)

Hard to say since the data I'm aware of on email client usage comes from... loading images.

But Apple Mail, iOS Mail, Gmail, and Outlook alone are probably 80% to 90% of recipients.

Reply on news.ycombinator.com