Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy implications of email tracking [pdf]

senglehardt.com

Post reply on HN
Print view View original

31–40 of 74 posts

Re: Privacy implications of email tracking [pdf]

#31

Post by gk1 »

rypskar wrote: post #10

It is a bit fun how some think they can track if I open emails from them or not. I have several times got email with something like "we see you are not reading the emails you get from us, so we will remove you from our list". I did read the emails using Thunderbird, so was only their tracking that didn't work. But this is maybe what we get when most read emails in web apps from companies that want to track everything…

1) Removing inactive subscribers is a good thing. You stop bothering those who've stopped caring (but haven't bothered to unsubscribe) and pay less for your CRM/email software (if it charges by number of contacts).

2) Marketers should not rely on opens alone to determine who is inactive. Also look at clicks, and site activity from the past 6 months.

Re: Privacy implications of email tracking [pdf]

#32

Post by Dotnaught »

skrebbel wrote: post #25

Folks, every email client and service has an option to not auto-download images. Plenty have it on by default (MS Outlook, notably). All of them ought to (IMO), but it's better than nothing. I warmly recommend you turn it on. There is no need to switch to text-only email clients just because of tracking.

Last time I checked, Google's Inbox by Gmail did not include a way to disable image loading, which is why I won't use it.

Re: Privacy implications of email tracking [pdf]

#33

Post by beagle3 »

skrebbel wrote: post #25

Folks, every email client and service has an option to not auto-download images. Plenty have it on by default (MS Outlook, notably). All of them ought to (IMO), but it's better than nothing. I warmly recommend you turn it on. There is no need to switch to text-only email clients just because of tracking.

The gmail app on the iPhone does not

Re: Privacy implications of email tracking [pdf]

#34

Post by makecheck »

We still have a serious problem with mail client behavior. There is so much that clients could still do to add basic security, even though E-mail protocols are terrible.

For instance, why do we not see in every client a big warning at the top saying something like: “NOTE: YOU HAVE NEVER RECEIVED E-MAIL FROM THIS INTERNET LOCATION BEFORE.”? Heck, such messages should even be auto-quarantined to specific folders. It would go a long way to protect people from constantly opening spam.

And, why by default do they insist on making everything look “simple” and “clean” at the expense of helping users to do even the most basic validation? They show senders as short names like “Facebook” when CLEARLY the message is coming from facebook.spammer.com or whatever when you do even the slightest digging into the original message.

Why are “rules” so complex, since damn near everybody needs them for basic sanity? There ought to be a button in every message saying something like “Mark Every Future Message From This Sender as Junk”, and similar short-cuts.

Re: Privacy implications of email tracking [pdf]

#35

Post by gruez »

mike-cardwell wrote: post #20
Sephr wrote: post #12

Doesn't Google immediately download any external images/assets in an email and cache them to prevent exactly this?

It's my understanding that they only download the assets when you first read the message. So it protects your IP address, but it doesn't protect the fact that you read the message. [edit] Yes, I have just confirmed this by using emailprivacytester.com

So what you should do is have some sort of script running 24/7 that "reads" your emails the moment it's received.

Re: Privacy implications of email tracking [pdf]

#36

Post by englehardt »

Hello, I'm one of the authors of this work.

The code and data for the study is available here: https://github.com/citp/email_tracking (measurement platform here: https://github.com/citp/OpenWPM).

We also just released a blog post that highlights the main results (and is a quicker read): https://freedom-to-tinker.com/2017/09/28/i-never-signed-up-f...

Re: Privacy implications of email tracking [pdf]

#37

Post by code_duck »

makecheck wrote: post #34

We still have a serious problem with mail client behavior. There is so much that clients could still do to add basic security, even though E-mail protocols are terrible. For instance, why do we not see in every client a big warning at the top saying something like: “NOTE: YOU HAVE NEVER RECEIVED E-MAIL FROM THIS INTERNET LOCATION BEFORE.”? Heck, such messages should even be auto-quarantined to specific folders. It wo…

The 'simplicity' is the same as Microsoft hiding things like file extensions, ostensibly to help less experienced users. It ended up making users have even less of an concept of file types, and made it easier for evildoers to disguise executables as photos and such.

Re: Privacy implications of email tracking [pdf]

#39

Post by englehardt »

omnifischer wrote: post #2

For those reading https://news.ycombinator.com/item?id=15354114 OSX mail client does not help.

We found that Apple Mail clients typically load remote resources by default, unless the message is spam. That content can't set or retrieve cookies, which is an improvement over other standalone clients.

I'd still recommend disabling remote content by default since the tracking identifiers (the hash of your email address, etc) are present in the image URL. That's enough to continue to track the read and serve targeted content. See: https://web.archive.org/web/20170922213846/https://support.l...

Re: Privacy implications of email tracking [pdf]

#40

Post by naner »

beagle3 wrote: post #33
skrebbel wrote: post #25

Folks, every email client and service has an option to not auto-download images. Plenty have it on by default (MS Outlook, notably). All of them ought to (IMO), but it's better than nothing. I warmly recommend you turn it on. There is no need to switch to text-only email clients just because of tracking.

The gmail app on the iPhone does not

Even if it did block them in the app, we have no way of knowing if tracking pixels links are followed by Google when it scans/sorts you mail server-side.
Post reply on HN