Hacker News Reader

Comment by surround | Hacker News Reader

The thing I hate the most about email is that they allow loading images as a third party resource, instead of requiring them to be sent with the rest of the message data. This allows companies and spammers to track when you open an email.

(They also track every link you click on, but that's a separate issue.)

View on HN

> This allows companies and spammers to track when you open an email.

"Email" doesn't allow that. If your email client does, that's a flaw in the client but clients are replaceable.

I use mutt and no links are ever followed.

The "clients" are de-facto Gmail and Outlook. Those two aren't going away anytime soon.

well, good news! GMail proxies that img link. Also, Outlook by default doesn't load external images.

Others in this thread have mentioned the proxying happens right when you open the email, so doesn't really protect you.

Only if you define them as such. I am quite happy with Thunderbird, which also allows me to read my RSS feeds.

They're not going away but you can pick something else, unlike with any proprietary system where the client is not a choice.

That's why some clients won't load images by default, only by request

I was disappointed to see the Gmail app on the Pixel actually automatically loads images for emails in the spam folder, with no way to turn them off except to turn off image loading across the board.

Gmail already proxies images in emails to their own servers.

But they still only request them when the client views them and not beforehand, so the view tracking still works and even has the proper timestamp for that.

That still tells the spammer you opened the email. I also doubt they do so for third party email accounts, which can also be used in the gmail app.

I mean, don't open the messages in the spam folder?

Suprisingly legit emails sometimes still go to spam. I recently had an actual message from Google go into spam and I didn't put it there.

I don't know if I've used a client that doesn't let you turn this off.

The problem is that most clients are configured to allow it. So people send email that loads external resources. Now you need a degraded experience for privacy.

If most clients disabled remote resources then senders would include them in the message.

Well, you do not have to allow images.

I pretty much don't.

Now and then I may allow one, depending.

Images can be base64 encoded into emails

They can be, but they aren't required to be. An email that contains all the resources to display itself doesn't leak user information. An email that contains a 1x1 tracking pixel, loaded when the receiver opens the email, lets the sender know that it has been received. In view of email spam, this is an unacceptable breach of privacy.

Configure your client to never load any external links unless you specifically select one for viewing.

Doesn't Gmail still proxy images so that this kind of tracking doesn't work? Or do they have a way around this?

They do, but they still load images on-demand the first time you open an email.

So a spammer will know if and when you opened email; but they would not know your IP or user agent.

The former is usually the most important part, and it is not blocked at all.

Yeah that's a shame. I guess it would be too expensive for Google to load the images of every single email though it would kinda avoid this issue. But I can see why that isn't really a feasible option.

It's also avoidable by just setting your email client to not load images by default. Not sure if gmail offers this, but I think it does.

Yeah haven't check if it's an option in Gmail but I am sure it is. Emails that get sent to spam however will not show images by default.

General settings : "Ask before displaying external images"

> I guess it would be too expensive for Google to load the images of every single email though it would kinda avoid this issue

Would it really? I have no idea what the dollar cost of that would be. I can see not wanting to pay for a feature most people wouldn't use, but I certainly think Google could afford it.

The biggest question would be what percent of pictures are loaded now and at what cost?

I know I get a lot of emails that I don't open all the time but still occasionally open. I am sure there are a lot of people in a similar boat. It's definitely a bit of a hard problem. I can see it being worth it for Google to implement into business accounts Gmail's, but not as economical for doing it on personal accounts.

they could preload them only for people who have the "never show images by default" setting turned on

Apparently they can't track IP and Device info but still can track when and how many times someone open.

Last info found googling was from 2013 though: https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

For security it’s recommended to use plain text email only. Inlined images are nice, but most everything else in html mail is unneeded. Email is the number one threat vector for companies.

Reply on news.ycombinator.com