Hacker News Reader

Comment by jasode | Hacker News Reader

>Next step (please): block all 1x1 sized images.

If you're not aware, the HTTP protocol specification[1] doesn't have a technical way of knowing ahead of time if it's a 1x1 tracking pixel.

So the remaining realistic options are:

(1) block ALL <img> tags downloads which then blocks any 1x1 tracking pixels

(2) allow <img> tags but block some (and maybe most but not all) 1x1 pixels via a blacklist of url domains (e.g. doubleclick.net) ... and/or heuristics based on the "style" attribute

The (1) already happens in many email clients that render HTML.

The (2) is happening with the ongoing cat & mouse game with AdBlock, EasyList, etc

[1] https://www.google.com/search?q=http+protocol+request+get+sy...

View on HN

Or Firefox could crowdsource the building of a bloom filter of the URLs for images that are 1x1. Or you could learn 1x1 tracking locally since the set of pages you visit will probably be similar if you just want some more general protection.

The bigger problem is that anything like this and the providers go up in size 1px at a time until it’s harder to distinguish from real content (at first transparent, then positioned off-screen, then overlays hiding it, then visible in a part of the page that doesn’t get as many views, dual-purposed with images/ads already on-screen, etc).

A better way is if Firefox just bundled an ad blocker and pushed ad blocking technology forward (eg more hooks to do expensive processing natively to save on power like Safari does). The challenge though is that something like 100% of their funding comes from an ad company.

Bloom filter wouldn't work. The bloom filter will tell you that a particular URL is "possibly" in the list. What do you do then? Reject it because it might be a tracking image?

[edit] Also, this ignores being able to:

  <iframe src="any-old-tracking-url"></iframe>
  <script src="any-old-tracking-url">
  <link rel="stylesheet" type="text/css" href="any-old-tracking-url">
  <img src="100px-width-tracking-image">

etc

Google pays mozilla in order to avoid a monopoly lawsuit. Just because it is good for mozilla, it doesn’t put any sort of incentive for them to follow.

What we probably need is a client-side neural net within the browser to notice that certain high information-content IMG URLs (i.e. those with random-looking garbage in the URL) from certain domains tend to result in very low information-content imagery. And that's the signature of a likely tracker.

How about this:

- The browser does not load any images by default. <img> tags are replaced by gray rectangles

- User must click on the placeholder rectangle to load the image

- User can add image URLs to a whitelist so they load by default

I can't tell if you're being serious. Is "no images without clicks" something you think most people who use the web would prefer?

Of course not, it would have to be an opt-in feature. I'm sure some people who are worried about 1x1 tracking might use it though.

In the same way that a lot of people browse the web with noscript

I remember loving that feature in Opera.

Of course, that was during dial-up days, so it was a huge quality of life feature.

Enable resources from the origin domain by default, and any Reasonable(tm) web page should have no problem with this.

Ublock Origin does this.

uBlock does not know the size until the file is requested. At that point it is too late, you have accessed the tracking file. That feature in uBlock is meant for people trying to save bandwidth/CPU. uBlock is great though, I would never browse the web without it.

What does file size have to do with anything?

Edit: I forgot the grandparent mentioned them. Ublock Origin implements the parent's proposal,so I mentioned it.

Focussing on file size is a mistake because you can just make the tracking image display something decorative or whatever. I was referring to a solution for not loading third party resources without manual approval, which would need to be more general than just blocking single pixels to be robust (although hueristics might be good enough for some cases)

You can get most of that with uBlock Origin right now! "Block large media elements" and set the limit ridiculously low. You now have to click to view images. Control this via settings and filter lists.

(1) happens in relatively few email clients. Every major client loads images by default except Thunderbird and it is not common.

...and Outlook

Nope, Outlook definitely loads images unless you or your administrator changed the setting.

This is simply not true. Out of the box Outlook install does not display images for senders not marked safe, nor does Outlook Web App.

>Outlook definitely loads images unless you or your administrator changed the setting.

I just installed a fresh copy of Office 2019 in a vm and Outlook's default setting doesn't load images. This block-downloading-images-default behavior matches what I read here: https://support.microsoft.com/en-us/office/block-or-unblock-...

Hm, I stand corrected

And except gmail's web interface, which is one of the biggest email clients these days.

Gmail's web interface does load images by default.

Technically it loads all images through a Google proxy[0] which in theory prevents third parties from using images for tracking. The third parties only get a 'hit' when Google pulls the image into their cache, which is not when you open the mail.

Google can still track you, but if you really care about that then you're probably not using Gmail anyway.

[0]: https://gmail.googleblog.com/2013/12/images-now-showing.html

Gmail won't load remote images when you open the mail. It will load images from Google servers that have been cached.

it doesn't pre-cache them, Google requests them in real-time when you view them

It does not load them from 3rd parties. It cached them and loads them from Google's servers. Open your network tab and see

https://arstechnica.com/information-technology/2013/12/gmail...

This protects your IP address and user agent string from being read by the sender, but otherwise doesn't change anything

Gmail made changes years ago to proxy images to prevent leaking info like this.

https://gmail.googleblog.com/2013/12/images-now-showing.html

This helps in that you don't connect directly to the image so it doesn't leak your IP and other info that would be available from the connection.

Marketing emails still send unique URLs for each recipient so they can associate your email address with opening any images and links. Google's proxy doesn't remedy this.

Won't the image proxy make it look like all emails to Gmail addresses are always opened, essentially making the tracking useless?

As far as I know, Gmail doesn't load the images until the first time the user opens the message, so it unfortunately doesn't make the tracking as useless as you could hope.

Apple Mail on iOS doesn’t.

I don't think it does. Perhaps you changed the default. Or if you're on a managed device, perhaps your administrator did.

Fairmail on Android blocks trackers.

I always wondered why mail providers don't load all images automatically the moment the mail is received and present a cached image to the users. Wouldn't that make tracking useless?

Reply on news.ycombinator.com