Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spy pixels in emails 'have become endemic'

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 341 posts

Re: Spy pixels in emails 'have become endemic'

#21

Post by musicale »

wahern wrote: post #9
pfundstein wrote: post #4

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message. Apple's macOS Mail.app client displays external images by default, as does their iOS app.

I'm somewhat disappointed that Apple doesn't offer better default privacy for Mail.

Perhaps they can't figure out a good solution to differentiate between benign images and tracking images; it does seem like it would be nearly impossible to do so, but I wouldn't mind a) blocking external images by default, b) per-sender/recipient settings, and c) clearly displaying "invisible" images and warning about them.

Perhaps someone has some better ideas on how to fight this scourge?

I tend to think that the only practical solution is to block them entirely, but then malicious senders will send URLs that say "click here to view message."

Maybe HTML email wasn't such a great idea.

Re: Spy pixels in emails 'have become endemic'

#22

Post by bayindirh »

noja wrote: post #14
xnx wrote: post #8

Earlier quoted context omitted.

Gmail does. This is great for privacy because it destroys the usefulness of the tracking pixel to the marketer.

How? https://jioegijogeijesgioegeg.tracking.example.com/niowefioe.png?sdgsdbuegiu=rojpopwmrmwk has four places to store unique information. Does Gooogle's proxy remove all of them?

Download via a proxy and cache the image when you receive the e-mail.

It's processed in the queue and opened. Was it the user? Did it hit Inbox? Where did it got opened? When it's opened? How many times it opened?

All these information's reliability got out of the window with a single optimization. You can't know how this mail was processed and it's fate. So, your tracking pixel and URL returned something useless to you.

Re: Spy pixels in emails 'have become endemic'

#25

Post by jhatax »

wahern wrote: post #9
pfundstein wrote: post #4

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message. Apple's macOS Mail.app client displays external images by default, as does their iOS app.

macOS Mail.app -> Preferences -> Viewing -> Uncheck "Load remote content in messages"

Privacy defaults come down to usability vs. privacy; Apple making this so easy to toggle is fine by me as I care about privacy and tracking.

Now, it would be great if every macOS application walked you through privacy settings right after installation in the same way that I am offered a tour of the new features. Since there is no such "privacy tour", the community has discussed ways in which macOS can be hardened [1], [2].

1. https://github.com/drduh/macOS-Security-and-Privacy-Guide

2. https://news.ycombinator.com/item?id=18099835

Re: Spy pixels in emails 'have become endemic'

#26

Post by im3w1l »

gorgoiler wrote: post #12
pfundstein wrote: post #4

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

iOS mail, alas. I just found it turned on. I forgot to disable it again after my annual OPSEC-cosplay device-wipe.

I've seen this expression here a few times and I don't mean to single you out, but arghhh!

The cos in cosplay stands for costume. Roleplay! Unless you are putting on a literal white hat I suppose, that would be cool.

Re: Spy pixels in emails 'have become endemic'

#28

Post by minsc__and__boo »

Mulpze15 wrote: post #18
alaties wrote: post #11

Earlier quoted context omitted.

Eh... Not really... It's pretty easy to generate a unique image url per customer and use that to determine whether a customer opened the mail or not and it's about the same cost as a traditional tracking pixel, complexity-wise.

Does Gmail download by default, whether you open the email or not?

Gmail caches by default.

The catch is that Gmail caches all the same images from the same servers, so email marketers get around it by serving tracking pixels with obscure, unique URLs per individual.

Geotargeting fails because it loads on GMail servers.

Re: Spy pixels in emails 'have become endemic'

#29

Post by Griffinsauce »

im3w1l wrote: post #26
gorgoiler wrote: post #12

Earlier quoted context omitted.

iOS mail, alas. I just found it turned on. I forgot to disable it again after my annual OPSEC-cosplay device-wipe.

I've seen this expression here a few times and I don't mean to single you out, but arghhh! The cos in cosplay stands for costume. Roleplay! Unless you are putting on a literal white hat I suppose, that would be cool.

It's figurative? The point is that they're pretending to be something they're not.

Re: Spy pixels in emails 'have become endemic'

#30

Post by retSava »

wahern wrote: post #9
pfundstein wrote: post #4

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message. Apple's macOS Mail.app client displays external images by default, as does their iOS app.

Maybe the proxy removes metadata such as useragent, but often the pic urls contain uniquely identifiable information, eg a number that is unique to that email that received the email. That way you still leak that it is opened, how often, etc (unless they cache, I don't know).
Post reply on HN