Hacker News Reader

Comment by wahern | Hacker News Reader

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message.

Apple's macOS Mail.app client displays external images by default, as does their iOS app.

View on HN

I'm somewhat disappointed that Apple doesn't offer better default privacy for Mail.

Perhaps they can't figure out a good solution to differentiate between benign images and tracking images; it does seem like it would be nearly impossible to do so, but I wouldn't mind a) blocking external images by default, b) per-sender/recipient settings, and c) clearly displaying "invisible" images and warning about them.

Perhaps someone has some better ideas on how to fight this scourge?

I tend to think that the only practical solution is to block them entirely, but then malicious senders will send URLs that say "click here to view message."

Maybe HTML email wasn't such a great idea.

I think images stored as attachment aren't really a problem. If you really need to have images and care about the privacy of your users, just do that.

The problem is that it's easy to serve a company logo at example.com/images/${unique_tracking_id}.png that also logs the tracking ID.

How do you tell a unique tracking ID from PR-IMG20190312-023045-logo-MARKETING-COPY(5).png?

Yes, HTML e-mail is dumb. But even instant messaging assumes the ability to load/preview images from the web at this point, so probably no real options at this point.

Maybe the proxy removes metadata such as useragent, but often the pic urls contain uniquely identifiable information, eg a number that is unique to that email that received the email. That way you still leak that it is opened, how often, etc (unless they cache, I don't know).

Isnt the proxy downloading and caching the image before the user opens the email? If so doesnt that prevent tracking if/when the user actually opens the email?

It may have changed since then, but Fillipo Valsorda wrote up some details about this, and how to validate how the proxy works - https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

It does not. That's how it should work, but it does not work that way. It downloads them on demand if and when the user views an email. So it protectes the users IP address from the spammer/marketter, but not the fact that the message was viewed nor when it was viewed.

The amount of email that is sent and not opened would probably destroy the origins - might be ok. But it would waste a huge, huge amount of bandwidth and CPU to download them which would open up an attack vector (DoS) on any email service that did this. Images can be legitimately very big...

I'm not convinced that this would be as big a problem as you're suggesting. If somebody is sending thousands of emails with html containing embedded images, the receiving system of those emails only needs to download each of those images once, and cache them.

Unless they're using different URLs for each image for tracking purposes. Which would become pointless if the images were downloaded immediately.

They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large.

It would even work for people using normal IMAP clients if they attached the images to the email directly and switched out the href in the img tags to point at the attachment instead.

This whole thing could be a user setting which can be toggled. Defaulting to the most privacy friendly option.

> They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large.

Or only allow inline images.

macOS Mail.app -> Preferences -> Viewing -> Uncheck "Load remote content in messages"

Privacy defaults come down to usability vs. privacy; Apple making this so easy to toggle is fine by me as I care about privacy and tracking.

Now, it would be great if every macOS application walked you through privacy settings right after installation in the same way that I am offered a tour of the new features. Since there is no such "privacy tour", the community has discussed ways in which macOS can be hardened [1], [2].

1. https://github.com/drduh/macOS-Security-and-Privacy-Guide

2. https://news.ycombinator.com/item?id=18099835

Unless I'm mistaken, Gmail's setting "Ask before displaying external images." should address this issue.

It does indeed, however it really ought be enabled by default rather than having to hunt it down in the settings, something most users won't do.

You can disable, showing images.

And then you get button to show images if you need it.

I prefer to use gmail this way, since most of the images are usually tacky signatures, or legal disclaimers or something else I don't need.

And if there are pictures you need there is show images button.

Stop using free email services?

Here's the one I use : https://protonmail.com/blog/how-big-tech-tracks-users/

There is a plugin for macOS Mail.app that tries to emulate Hey's tracker blocking.[1] I just installed it and it seems to be working. Also translated all 3 strings to Russian while I'm at it.

[1] https://github.com/apparition47/MailTrackerBlocker

You can disable the displaying in GMail.

Settings > Images > Ask before displaying external images

Last I checked some years back, in GMail an e-mail with a "footer.jpg?user@gmail.com" img tag will only load that URL when the user views the e-mail.

Are you sure that the iOS mail app loads these images by default?

Yes it does. It's one of the first things I disable when setting up a new phone.

It's optional in gmail. I've had it disabled for years.

on iOS: turn that off with Settings > Mail > Load remote images

recently i am seeing certain images still loaded, whereas in the past none loaded. i haven’t investigated what is different about these images yet, though. anyone else observe similar?

You can embed the image inside the actual multi-part message, and it will be shown without accessing network. It is usually used for logos, signatures and the such and, afaik, can't be used for tracking mail opening.

Could be images with image data included in the email, that don't need to load remotely.

Reply on news.ycombinator.com