Folks, every email client and service has an option to not auto-download images. Plenty have it on by default (MS Outlook, notably). All of them ought to (IMO), but it's better than nothing. I warmly recommend you turn it on. There is no need to switch to text-only email clients just because of tracking.
Last time I checked, Google's Inbox by Gmail did not include a way to disable image loading, which is why I won't use it.
Privacy implications of email tracking [pdf]
51–60 of 74 posts
Re: Privacy implications of email tracking [pdf]
#52Earlier quoted context omitted.
That doesn't work for all clients. It usually will, but I have seen some make HEAD requests for inline images to try read the expected download size to display this to the user - if this happens then the server obviously gets the full URL including tracking codes so has a fair idea the mail hit a valid mailbox.
Similarly, Gmail screws up its UX (as usual). If you ever make the mistake of clicking "Always display images from ", there is no turning back for that sender, as far as I can see at least. No "block images from this sender" button, no list in settings of all approved email senders that you can change your mind about, nothing. The only option at that point is using the PixelBlock extension: https://chrome.google.com/…
Re: Privacy implications of email tracking [pdf]
#53I simply stopped reading HTML emails and read everything in plain text. Works fine for most of the emails I receive, the ones that don't are almost always marketing emails anyway. I do realise clicking tracking links still works but they are way more visible in plain text mode and it's not that hard to copy & paste the relevant part of the link. Too bad most email clients have removed plain text rendering these days.…
> Too bad most email clients have removed plain text rendering these days. I also haven't found a good mobile plain text email client yet. eul [1] only has plain text rendering. It only supports Gmail right now, but a full-fledged email client is coming soon. A mobile app will be released in early 2018. [1] https://eul.im
Re: Privacy implications of email tracking [pdf]
#54Folks, every email client and service has an option to not auto-download images. Plenty have it on by default (MS Outlook, notably). All of them ought to (IMO), but it's better than nothing. I warmly recommend you turn it on. There is no need to switch to text-only email clients just because of tracking.
Last time I checked, Google's Inbox by Gmail did not include a way to disable image loading, which is why I won't use it.
Re: Privacy implications of email tracking [pdf]
#55Hello, I'm one of the authors of this work. The code and data for the study is available here: https://github.com/citp/email_tracking (measurement platform here: https://github.com/citp/OpenWPM ). We also just released a blog post that highlights the main results (and is a quicker read): https://freedom-to-tinker.com/2017/09/28/i-never-signed-up-f...
Re: Privacy implications of email tracking [pdf]
#56We still have a serious problem with mail client behavior. There is so much that clients could still do to add basic security, even though E-mail protocols are terrible. For instance, why do we not see in every client a big warning at the top saying something like: “NOTE: YOU HAVE NEVER RECEIVED E-MAIL FROM THIS INTERNET LOCATION BEFORE.”? Heck, such messages should even be auto-quarantined to specific folders. It wo…
> For instance, why do we not see in every client a big warning at the top saying something like: “NOTE: YOU HAVE NEVER RECEIVED E-MAIL FROM THIS INTERNET LOCATION BEFORE.”? Because that is way too dangerous a policy. Recently, I moved, and in creating online accounts for online bill pay, I got confirmation emails from each of my utilities. Saying that they're spam just because you've never received email from them w…
It's not saying that they are spam. It's just saying that you never received a message from them. That account confirmation email you are expecting will be obviously marked, but that phishing email claiming to be from your bank will be marked too. You look at the mark and decide what to do.
Email clients probably don't do it because it is not as useful as it sounds. Impersonating email senders is not hard, so phishers will just do it.
> If the email address isn't priorly known, it shows the email address instead of the display name.
The only email client that I have ever seen doing that is the roundcube instance I configured on my VPS. I use several clients, nearly all of them either hide the sender address or decrease its relevance enough so that nobody sees them.
I'm in complete agreement with your comment about spam filtering. The only thing is that somehow, it feels like it worked better at the earlier 00's. Nowadays the training for your account will be dissolved in a huge set of unreleated data, so that anything specific for the spam you are receiving will never be reflected on the filter. That is both for marking things as spam and as not spam.
Re: Privacy implications of email tracking [pdf]
#57Earlier quoted context omitted.
Last time I checked, Google's Inbox by Gmail did not include a way to disable image loading, which is why I won't use it.
All Gmail (and presumably Inbox) images are transcoded/downloaded via Google's image proxies. https://support.google.com/mail/answer/145919?co=GENIE.Platf...
Re: Privacy implications of email tracking [pdf]
#58It is a bit fun how some think they can track if I open emails from them or not. I have several times got email with something like "we see you are not reading the emails you get from us, so we will remove you from our list". I did read the emails using Thunderbird, so was only their tracking that didn't work. But this is maybe what we get when most read emails in web apps from companies that want to track everything…
Gmail actually takes steps to protect privacy when loading images. Apple's mail apps are the ones that load images indiscriminately. Pretty sure that's for UX reasons not ads.
Re: Privacy implications of email tracking [pdf]
#59Earlier quoted context omitted.
Similarly, Gmail screws up its UX (as usual). If you ever make the mistake of clicking "Always display images from ", there is no turning back for that sender, as far as I can see at least. No "block images from this sender" button, no list in settings of all approved email senders that you can change your mind about, nothing. The only option at that point is using the PixelBlock extension: https://chrome.google.com/…
Apparently you can, but it's a bit hidden: https://webapps.stackexchange.com/a/103470
Still, would be nice if there was an overview in the settings page, and a possibility to wipe the entire whitelist at once