Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook uses bgsound to see if you have opened an email

plus.google.com

Post reply on HN
Print view View original

21–30 of 99 posts

Re: Facebook uses bgsound to see if you have opened an email

#21

Post by qeorge »

redcircle wrote: post #14

Can you read the post without signing into a Google account? I click through via my iPhone, and get prompted for a Google account. Isn't this a post about getting tracked on the web?

I can on my desktop, but I can't on my (Android) tablet.

On the tablet Google actually wants me to create a Google Profile before I can read the article.

I've never run into this before today. I wonder if its new.

Re: Facebook uses bgsound to see if you have opened an email

#22

Post by aezell »

These sorts of tracking pixels or tracking items are long-standing methods of analytics gathering in the email marketing and delivery space. This is not an attack of privacy. They also know every click you make in that email as well. And of course they track the number of times you do these things. They also track that traffic anonymously if you forward the email to a third party who interacts with it.

This is the same practice as any tracking done on a web page even going back to the pixels that AWStats used to use.

I work for an ESP and we've been doing something similar since 2003.

Re: Facebook uses bgsound to see if you have opened an email

#23

Post by alt_ »

qeorge wrote: post #21
redcircle wrote: post #14

Can you read the post without signing into a Google account? I click through via my iPhone, and get prompted for a Google account. Isn't this a post about getting tracked on the web?

I can on my desktop, but I can't on my (Android) tablet. On the tablet Google actually wants me to create a Google Profile before I can read the article. I've never run into this before today. I wonder if its new.

It's old. Google has god-awful mobile interfaces on most of their services that always either redirect you to something different or require you to log in and then redirect you to something different.

Sorry if I sound annoyed, but it's a pet peeve.

Re: Facebook uses bgsound to see if you have opened an email

#24

Post by nknight »

toddnessa wrote: post #10

My take on this is that it is fairly common to use some type of analytics to know if your targets are opening the mail that they get from you or not. This is a fact of which I am familiar with from my knowledge of email marketing. In reading this, I am not so sure this is a direct attempt to invade privacy. I just think Facebook is following practices is already common with email marketing. From a privacy or trust co…

An invasion of privacy does not cease to be an invasion of privacy just because a small group of deeply unethical people persist in it for years.

Re: Facebook uses bgsound to see if you have opened an email

#25

Post by mike-cardwell »

People don't expect that when they read an email, the sender knows when they read it and from what IP address.

If you're using a tracking image or any similar technology, then you are exploiting a weakness in the system to take information that you don't have permission to.

I recognise that it's standard industry practice, but it's categorically not ok. If you want to track users, ask for their permission. If you haven't done so, then you have no right.

Re: Facebook uses bgsound to see if you have opened an email

#26

Post by mike-cardwell »

I've personally found loads of bugs in most of the major email clients and numerous webmail clients that cause them to make outgoing requests which can be detected (even with remote images disabled). Most of these are closed now. I have an automated tester which sends an HTML email with a bunch of tests like this bgsound one to your address which displays information about any callbacks. You can access it here:

https://grepular.com/email_privacy_tester/

Re: Facebook uses bgsound to see if you have opened an email

#28

Post by mike-cardwell »

jeffreyg wrote: post #17
djacobs wrote: post #7

Plaintext e-mail is awesome, not just because it's readable, but because it's not vulnerable to these sorts of attacks. Incidentally, it's unfortunate that Sparrow doesn't have a 'force plain text' option. Even though I've checked 'prefer plain text', all Facebook e-mails are delivered in HTML. This might be a reason to switch back to Mail.app.

Doesn't gmail stop these attacks without needing to force plaintext only by simply disabling images by default?

Yes. There was a bug a few years back though where they would display attached SVG images. These images could actually contain javascript, which left it vulnerable to XSS.

Re: Facebook uses bgsound to see if you have opened an email

#29

Post by vilda »

redcircle wrote: post #14

Can you read the post without signing into a Google account? I click through via my iPhone, and get prompted for a Google account. Isn't this a post about getting tracked on the web?

Apparently, Google forces you to log in if you are using mobile devices - Android/iOS. Works on desktop without log in.

Re: Facebook uses bgsound to see if you have opened an email

#30

Post by magicalist »

alt_ wrote: post #23
qeorge wrote: post #21

Earlier quoted context omitted.

I can on my desktop, but I can't on my (Android) tablet. On the tablet Google actually wants me to create a Google Profile before I can read the article. I've never run into this before today. I wonder if its new.

It's old. Google has god-awful mobile interfaces on most of their services that always either redirect you to something different or require you to log in and then redirect you to something different. Sorry if I sound annoyed, but it's a pet peeve.

Yeah, that's dumb. If I select "request desktop site" in the Android browser I can see the post, otherwise I'm redirected to a sign in. You only get the redirect in Android Chrome, since it doesn't have a "request desktop site" option. Annoying.
Post reply on HN