A Clever Way to Tell Which of Your Emails Are Being Tracked | Hacker News Reader

A Clever Way to Tell Which of Your Emails Are Being Tracked

wired.com

44 pointsLibertatea68 comments

Uh... clever? I had to scroll back up and double-check the date to make sure this article wasn't 10 years old.

Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking?

Also, didn't Gmail start caching images on google servers such that tracking can't happen even if you display images? (Of course, google could track you but they already run the client so no big loss there.)

They started caching images, but since open tracking pixel URLs are unique (after all, that's how they track an individual recipient) and Google only caches the image if you open the mail, essentially you still get tracking. You just don't get to count how many times the email is opened or the length it's opened (a common trick is to leave the connection open to see how long the client keeps the request open).

Do you evidence for your claim that google only caches the image if you open the mail? That seems to defeat the entire purpose of the feature.

Yes, that I don't have 100% Gmail open rates reported in Mailchimp. Indeed, open rates barely changed at all (they went up just slightly since I guess everyone now has images enabled by default).

> Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking?

While that is true, people say "yes" because things don't display properly. Often elements like emoticons and whatnot are also remote images!

"Display remote images? Yes/No" is an all or nothing proposition, in other words.

The e-mail client, rather, should determine which images will display in a visible way and reject all others even if the users says Yes. It should not fetch images whose tags don't specify a width or height, or that specify one less than 16x16 pixels, and those that are positioned such that they will be clipped, or clipped by something else, so that even if filled with fetched content, they will not be visible. Basically: calculate the set of image tags that refer to images which will be obviously visible to the user. Prompt for those, and do not fetch the rest regardless of the answer.

At least recent versions of Thunderbird do allow domain-by-domain loading.

Of course, the standard user has no idea what that means, how to judge where the email comes from, or what any of the options mean beyond "see the pretty pictures", but, hey, one step at a time.

Gmail controls this permission per sender. Nobody savvy enough to read Wired would use a mail system that was broken in the described way.

When I checked last, there are some popular email apps that don't provide an option to disable automatic attachment downloading - like Dropbox's Mailbox and Google's Inbox.

Doesn't google pre-download all images before hand and serve the user a cached copy?

Google apparently still leaks the initial opened and time data.

For those who care, the Gmail app still has the option to not load images. It's why I still use it over Dropbox Mailbox, Google Inbox, and Microsoft Outlook (Acompli).

This is where I usually jump in and mention a web app I wrote:

https://emailprivacytester.com/

Sends an email to you which checks to see how much stuff your email client is leaking. Turns out some email clients load remote content even before you click "Load Remote Images"

Wow that's a lot even on just iPhone Mail. This should get more attention!

I'm pretty sure the iPhone mail client loads images by default. And... I could be wrong, but IIRC it also doesn't even have a way of disabling this. I don't have one to hand to test with though.

Control panel (or whatever it is called) and in Mail, at the end: load remote images. Slide.

IIRC it is disabled by default BUT I MAY BE WRONG.

Sorry for screaming.

Thank-you. I didn't realise until I tried your tool that gmail is leaking out the fact that I'd opened an email. It runs through a proxy but it is still possible for it to uniquely identify that the email has been opened.

Just noticed that under Settings > General > Images it is possible to turn off the loading of external images. That fixed it, no longer is it loading the images up.

I have a lot of privacy concerns about what Google itself does with my data, but I do like knowing that they help prevent others from surreptitiously gathering data.

On Openmailbox, I have "Message queued. Attempting delivery" even after reading the mail, so I guess it's fine

This is really cool, thank you!

It shows that with Gmail, you don't need a browser extension to block pixel trackers.

Gmail does that fine by default, just don't display images in the message.

Really? Gmail easily failed this test with flying colors when I tried it: the second I opened the test email, gmail fetched the 1px tracking image, revealing my User-Agent (but not my IP address, granted) to the server.

How did you configure your gmail settings to pass the test? I don't think I changed the default.

As far as I remember, GMail's proxying solution also hides your User-Agent. It sends a fake one in its place which is the same for everyone.

The email privacy test correctly inferred the user agent of the browser I opened their email from when I opened it in gmail.

Nice work Mike.

My university email server seems to silently filter out the emails. Wonderful.

Yeah, this happens. That's why it says the following on the front page:

"The email sent by this system contains numerous unusual tricks which will probably offend some spam filters. If possible, you may want to whitelist emails from sender addresses matching *@emailprivacytester.com before continuing."

If you don't have that level of control, I'm not sure what you can do about it.

I tried that.

But either the provider doesn't support wildcards or it is filtering it anyways.

Great app!

For me Thunderbird didn't trigger any test. K-9 Mail triggered the Meta refresh test (but asked me to choose the browser, perhaps because I have multiple browsers installed).

Any email client that permits this to happen automatically is user hostile. I really hope that Gmail doesn't do this by default.

But I use mutt, so I'm not worried. If I really have to read an HTML-only email, I have mutt configured to pass the HTML to links for rendering, but in a way that links runs confined and without access to the Internet (or anything else) in order to do so[1].

It's been a few years now, and I don't feel I've really missed anything by going back to a text-mode email client. By being able to optionally render HTML as text, I can still read the occasional HTML-only email that I need to (for example: order confirmations). The rest of the time, plain text works just fine.

[1] http://www.justgohome.co.uk/blog/2014/02/mailcap-html-apparm...

Gmail isn't doing this by default but Inbox does it -- that's was prevented me from switching.

I guess they "new take on mail" by google is not designed for end-users privacy.

Google actually uses an image proxy to thwart tracking based on images.[1]

http://googlesystem.blogspot.ca/2013/12/google-uses-proxy-to...

Which won't work if it's a unique image (since it won't be in the proxy). And if it is a tracking image, it'll probably be unique.

AFAIK they do this for all images. Not just commonly embedded images.

If it's a unique image, then presumably Google reads it and pre-caches the image on receipt. So all you'll get from 1 pixel image is confirmation of email delivery, which is something you get with SMTP anyway.

Of course if Google wait to cache the image when you actually read it, then this isn't true. But I'm prepared to give them more credit than that.

> So all you'll get from 1 pixel image is confirmation of email delivery, which is something you get with SMTP anyway.

You'll get a read-receipt, which SMTP doesn't offer.

Except it doesn't thwart tracking the actual open. Just the IP of the end user, etc: http://techcrunch.com/2013/12/12/gmail-open-rates/

Are you sure Mutt's not doing this?

I read my mail with Emacs, but according to https://emailprivacytester.com/ , when I click on a message, Emacs parses the HTML and inserts images into the buffer. This is default behavior with the `notmuch` mail reader

EDIT: Chat with dkg on the #notmuch IRC channel shows there's a patch to fix this that isn't in a release quite yet.

My point: Be careful, even if you're using a "dumb" mail client! :)

A typical Mutt configuration relies on the entry for text/html in ~/.mailcap. It's quite common to use lynx for rendering, as in the following:

    text/html; lynx -dump %s; nametemplate=%s.html; copiousoutput

Since lynx doesn't load images, that would be safe from this kind of tracking. But another configuration using a different renderer might allow it.

Furthermore, it is also possible to prefer the plaintext version of an email if there's a choice. From my ~/.muttrc:

    alternative_order text/plain text text/html

I can't remember ever being put out by not being able to read messages that fetch images from the web. Even if I have to open a URL, I do it in Firefox, where I run RequestPolicy.

Are you sure lynx doesn't fetch any external resources? Some text-mode browsers (I forget if elinks or w3m does this) fetches external CSS by default so they can attempt to render fonts on the the 16-color terminal. :)

The "right" way of doing this (calling lynx in a network-restricted cgroup/chroot/container) sounds like a pain.

Lynx doesn't support images, CSS or script. It does support cookies and redirects (by default it prompts for both). Basically, it renders the bare HTML of the page you open, without fetching external resources. If you find it behaves differently, make sure your lynx command isn't actually symlinked to links (or another text browser with graphical/enhanced capabilities).

I'm sure. Mutt gives me direct control over how it processes MIME attachments with particular content types. I'm using this to make sure that text/html only gets parsed by a confined converter. See my link for details.

Just gonna hijack this thread to mention that if you use Gnus (the other Emacs mail client) to read your email you can use the variable "gnus-blocked-images" to block any images that match a URL.

Doing

    (setq gnus-blocked-images ".*")

will block all the images in the emails.

I tested it using "https://emailprivacytester.com" and the it picked up only the DNS prefetch link/anchor which I assume are due to my ISP and not Gnus.

Isn't Gmail serving image from it's own proxies acting as a protection against this kind of snooping?

In my understanding, opening the image loads the image from Google servers so it never hits the tracking website...

Am I right?

This only prevents device and IP information from being broadcasted. The main information the email sender still gets is if the email was opened at all.

It still leaks whether or not you viewed the email and what time, even if it doesn't leak the IP you came from.

Also of note: Fastmail also uses proxies in this fashion too now.

> what time

Not necessarily. Does Google cache the image when receiving the email, or when you view it?

Google only fetches the image when you first view it. At least it did when I tested it when they first started doing it.

That still seems to be the behaviour, so it still works for open tracking just not the additional meta data. Fantastic tool you've created by the way!

I haven't tested it yet, but it seems you can setup your tracking image to return a "Cache-Control: no-cache, max-age=0" header and it will always be reloaded when the email is opened.

http://blog.movableink.com/real-time-content-and-re-open-tra...

It's not a clever way, it's primitive, and does not monitor many advertising agencies (just 3 of them).

The clever way would be to discover ALL advertisers AND prevent spying on our emails.

I've always had these assumptions:

If you open an html email, you are being tracked.

If you click on a link in an email, you are being tracked (plain text / html)

Is there any email clients someone can recommend that force plain text in multipart emails? Or convert html emails to be viewed as plain text if the email isn't multipart?

Alpine will do this for you. It doesn't suck too badly.

mutt?

kmail used to be hugely anti html in emails so they may have more options than most for avoiding it.

In thunderbird, which is my current MUA, you can choose View > Message Body As ... > Plaintext and it will display everything it can in plaintext. There's also Simplified HTML and Original HTML as options.

>convert html emails to be viewed as plain text if the email isn't multipart? //

Not sure if that's what thunderbird is doing but it appears to be (if I send a HTML-only email to myself the thunderbird will display it as plaintext).

I just installed he extension and it seemed to give a few false alarms. One email chain with just a few acquaintances mailing back and forth was flagged.

"Ugly" "sneaky" "disturbing" "unsettling". The article's author made quite an effort to present a a long-established (and relatively harmless) practice as a horrible thing. What is funny in the era of really disturbing practices in invading our privacy.

If companies sent letters, which when opened, silently and without your knowledge sent a signal home to tell them that the letter delivered to your house had just been opened, would that be "harmless"?

Personally, I would consider it, ugly, sneaky, disturbing and unsettling. But then it's ok on the Internet because this sort of tracking is easy on the Internet right?

Let's stretch the analogy a bit further. If the company representative is talking to me face to face and watching my reactions (Do I hear? Do I understand?) is that unsettling? Do people cover their faces when they are in a shop/bank? No, it's a natural part of the communication.

Email is just a form of communication. I believe, ut's not that harmless that someone received the confirmation that his message was opened. Of course things get a bit complicated when someone gets too much information, but simple opening emails/clicking links is something we should accept. When we are walking down the street hundreds of people see us, see what we do. Most people do not have a problem with that. I really can't understand what is so different in case of online activity, despite the fact that we are familiar with other people seeing us in real world and the Interent is still a mentally new territory for us. And this distinction between the off- and online privacy is something what actually can inhibit the development of online society imho.

This is all down to what the user expects. When the user is having a face to face conversation with somebody, they expect and accept that person will be able to look at them and note their facial expressions and what they're saying. When somebody is sat at home opening a letter or an email, they don't expect the sender to know that they're doing it. Yes, many geeks understand that the sender will be able to see that they're doing it, but the average non-geek does not understand this.

Yes, you're absolutely right. However, I believe that the proper direction is to change the people's expectations towards "I'm aware that typical consumer technology doesn't offer me anonymity, just like I can't expect to be anonymous/invisible on the street with typical behavior" instead of luring them into the illusion that the internet is some completely separate world.Off- and on-line will interweave more and more and society should adjust their expectations accordingly.

It's "Yesware" - sloppy. This has been done for years and years such that it's pretty much common practice with any service that sends email now. And any half-decent mail client asks you before loading external resources. I guess it'd be nice if they specified why it matters.

as much as i'd like another "don't be evil" "debate" gmail shouldn't work like that.

http://gmailblog.blogspot.ie/2013/12/images-now-showing.html

correct me if I'm wrong, but the tagging support page is for "creative pages" with doubleclick, not emails:

https://support.google.com/dfp_premium/answer/1347585?hl=en

EDIT: ok well, turns out i'm wrong and here's how to turn off automatic image loading

http://now.avg.com/disable-gmail-automatic-image-load/

> Specifically, they know when you’ve opened an email sent by one of their clients, where you are, what sort of device you’re on, and whether you’ve clicked a link, all without your awareness or consent.

No they don't, I don't do HTML mail.

Weird. HTML message viewing in claws-mail refuses outright to load external images without an explicit request from the user. I have no idea why anybody would want or implement behavior different than that...?

you do, it's because the big companies who write e-mail clients that the bulk of the population use, the same companies also are involved with advertising. There's no big money behind building a good quality privacy enabling e-mail client, or browser.

the simplest (and also spartan) way to protect yourself is to set your email reader to not show pictures. so you read your emails without pictures and then you explicitly allow pictures for those emails you trust (from family, friends, etc.)

"every action IS a reaction"

Let me save you the trouble of even using the tool:

Yep, every email sent from a company to you for marketing purposes has a beacon and link tracking.

If you're alarmed by this, you should also know that every website you visit can track your IP, your OS and version, and your browser and version.

I think the real value is in seeing who's tracking that you wouldn't expect. Yes, most know that marketers are tracking the hell out of us, but there may be use cases that many are not aware of.

Reply on news.ycombinator.com