Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook uses bgsound to see if you have opened an email

plus.google.com

Post reply on HN
Print view View original

11–20 of 99 posts

Re: Facebook uses bgsound to see if you have opened an email

#11

Post by huggyface »

theootz wrote: post #8

This is pretty standard practice really... many e-mails will have a "tracking pixel" or similar. Facebook has this in their e-mails too: https://www.facebook.com/email_open_log_pic.php?mid= =blah" style="border:0;width:1px;height:1px;" />

Yes, but about 100% of email clients now don't load images -- whether webbugs or actual content -- because of that. This BGSOUND tactic certainly isn't standard practice, despite being an extension of a prior technique, extended specifically to get around the existing filter.

Re: Facebook uses bgsound to see if you have opened an email

#12

Post by stingraycharles »

huggyface wrote: post #11
theootz wrote: post #8

This is pretty standard practice really... many e-mails will have a "tracking pixel" or similar. Facebook has this in their e-mails too: https://www.facebook.com/email_open_log_pic.php?mid= =blah" style="border:0;width:1px;height:1px;" />

Yes, but about 100% of email clients now don't load images -- whether webbugs or actual content -- because of that. This BGSOUND tactic certainly isn't standard practice, despite being an extension of a prior technique, extended specifically to get around the existing filter.

What filter is this getting around at actually? Since the article / post says it only works for email clients that have "show images" enabled, I'm wondering what the added value of using this technique is?

Re: Facebook uses bgsound to see if you have opened an email

#13

Post by huggyface »

stingraycharles wrote: post #12
huggyface wrote: post #11

Earlier quoted context omitted.

Yes, but about 100% of email clients now don't load images -- whether webbugs or actual content -- because of that. This BGSOUND tactic certainly isn't standard practice, despite being an extension of a prior technique, extended specifically to get around the existing filter.

What filter is this getting around at actually? Since the article / post says it only works for email clients that have "show images" enabled, I'm wondering what the added value of using this technique is?

Since the article / post says it only works for email clients that have "show images" enabled?

It does? Someone mentions that they had loaded the image bug, leading to someone else making the show image comment. BGSOUND would not be filtered by that.

Re: Facebook uses bgsound to see if you have opened an email

#17

Post by jeffreyg »

djacobs wrote: post #7

Plaintext e-mail is awesome, not just because it's readable, but because it's not vulnerable to these sorts of attacks. Incidentally, it's unfortunate that Sparrow doesn't have a 'force plain text' option. Even though I've checked 'prefer plain text', all Facebook e-mails are delivered in HTML. This might be a reason to switch back to Mail.app.

Doesn't gmail stop these attacks without needing to force plaintext only by simply disabling images by default?

Re: Facebook uses bgsound to see if you have opened an email

#18

Post by vvnraman »

http://www.sendgrid.com/ which provides email services to a lot of clients perhaps uses this by default. I don't think people in this business look at it as an attack. Websites use various techniques to track people's activities, and this is just another one of them.

Re: Facebook uses bgsound to see if you have opened an email

#19

Post by kysol »

redcircle wrote: post #14

Can you read the post without signing into a Google account? I click through via my iPhone, and get prompted for a Google account. Isn't this a post about getting tracked on the web?

It's public, I'm pretty sure I got there before logging into Google this morning.
Post reply on HN