Hacker News Reader

Comment by revorad | Hacker News Reader

The catch is that images are not displayed by default. Why would an attacker click on show images? Only if the text of the email asked them to...

EDIT: I'm wrong as pointed out by others in the replies below.

View on HN

You can tell GMail to always display images from a particular sender.

Ah yes of course. Duh me

He works around this by reading the email himself first, clicking the option to always display images from the sending email address and then starring it so the email is always at the top of his inbox even though it has been read.

I suppose an attacker could bypass this method by turning off images in their browser though.

An IMAP client somewhere could poll the 'read' state of message 0x12345678 instead, alerting the owner when the message turns 'read'. However, that client would have to have access to the Gmail box...

Yep, but it couldn't collect the IP of the attacker.

You're assuming that the attacked hasn't hidden his IP (i.e. Tor) or is in a country that will actually give a crap (i.e. not Russia/China).

But would an attacker read a message marked as unread? A careful attacker would know that this alerts the owner of the mailbox, as he can't remember opening the message.

His canary is a mail that has already been opened, so the attacker assumes he can look at it harmlessly.

You can mark messages un-read again in the gmail UI.

Thanks, I missed that point.

Reply on news.ycombinator.com