Facebook uses bgsound to see if you have opened an email • Hacker News Board

Re: Facebook uses bgsound to see if you have opened an email

#61

Post by mwexler » Mon, Mar 05, 2012, 1:31 AM UTC

cousin_it wrote: post #51

mwexler wrote: post #36

Earlier quoted context omitted.

You don't list a source, but I'll propose a different stat. A survey in 2010 implied that only 33% of folks kept images on... but that's a wide jump from 100%. http://www.clickz.com/clickz/column/1716214/disabled-images-... Your point is right, that emailers are trying to get around the image blocking... But it's not that everyone turns off their images; some folks still keep them on. The question then becomes: what'…

Can't you attach the images to the email, and reference them from the HTML? If that doesn't work, you can send a PDF or Word file. Putting img tags that link to your server doesn't sound like a very good way to get attractive emails anyway. What if your server goes down? What if the user disconnects from the internet before reading their inbox? What if the user rereads your message after several years and it's sudden…

The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes. It may shift the cost in a way you prefer, but it also slows down the send so users may not get their mails in a reasonable time, and may not appreciate the larger mails filling up their boxes.

There is also the issue with referencing the inline images, though I've been told that it's not such a big deal (I've never tried it myself).

As for the "going down", most reputable email vendors have pretty well done image servers, for this very reason. But yes, if the user disconnects, the images won't be available. But same with the web site that the email is linked to, so users couldn't necessarily click for more info either.

But commercial emails usually aren't designed to be saved and re-referenced like mails from friends. Instead, they expect to be read while online, and either reacted to quickly or discarded. I guess it's similar to the mindset with paper mail.

Too bad there isn't more effort on making better mails that don't rely on images but instead make better experiences... instead of better tracking tech.

Re: Facebook uses bgsound to see if you have opened an email

#62

Post by Drbble » Mon, Mar 05, 2012, 1:31 AM UTC

m0untain wrote: post #55

This is yet another reason to filter all messages from Facebook directly to the trash folder. The last thing I need is a constant stream of attention-sapping fb emails polluting my inbox.

You could also just tell Facebook to not email you.

Re: Facebook uses bgsound to see if you have opened an email

#63

Post by Drbble » Mon, Mar 05, 2012, 1:36 AM UTC

nknight wrote: post #24

toddnessa wrote: post #10

My take on this is that it is fairly common to use some type of analytics to know if your targets are opening the mail that they get from you or not. This is a fact of which I am familiar with from my knowledge of email marketing. In reading this, I am not so sure this is a direct attempt to invade privacy. I just think Facebook is following practices is already common with email marketing. From a privacy or trust co…

An invasion of privacy does not cease to be an invasion of privacy just because a small group of deeply unethical people persist in it for years.

To win this fight, you need to convince users (and not just the techies on HN) to care. You aren't going to convince site operators to hamstring themselves over an issue their users don't care about. (Even if you do, unless you win over ever single site, all you will do is kill the ethical operators and leave the unethical one standing, let like antibiotic resistant bacteria. Is that really what you want? )

Re: Facebook uses bgsound to see if you have opened an email

#64

Post by Drbble » Mon, Mar 05, 2012, 1:39 AM UTC

ktizo wrote: post #38

I have yet to work out why anyone should wish to turn on html in emails ever and I always thought that was the start of email being broken. Protocols existed before machines and should serve us as well as them.

HTML isn't what bugs you. Unauthorized loading of remote content is what bugs you. That's a misfeature of your (and most people's) mail reader.

Re: Facebook uses bgsound to see if you have opened an email

#65

Post by icebraining » Mon, Mar 05, 2012, 1:40 AM UTC

mwexler wrote: post #61

cousin_it wrote: post #51

Earlier quoted context omitted.

Can't you attach the images to the email, and reference them from the HTML? If that doesn't work, you can send a PDF or Word file. Putting img tags that link to your server doesn't sound like a very good way to get attractive emails anyway. What if your server goes down? What if the user disconnects from the internet before reading their inbox? What if the user rereads your message after several years and it's sudden…

The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes. It may shift the cost in a way you prefer, but it also slows down the send so users may not get their mails in a reasonable time, and may not appreciate the l…

The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes.

But wouldn't the sender have to serve the images over HTTP anyway? Unless you expect a big percentage of those emails to never be opened, but then I have to wonder if you should be sending them in the first place.

Re: Facebook uses bgsound to see if you have opened an email

#66

Post by icebraining » Mon, Mar 05, 2012, 1:43 AM UTC

tapp wrote: post #52

RexRollman wrote: post #50

Earlier quoted context omitted.

Just because the information is useful, that doesn't mean it is ethical to collect it.

Would those of you who object to this tactic also object to collecting website analytics (which in my experience many normal users, including members of my own family, do not understand either.) If not, why not? This isn't a rhetorical question; I'm sincerely curious. Thanks.

Personally, I think analytics is fine as long as you run them from the same domains as the website. Using e.g. Google Analytics allows them to track users across multiple sites, which is much more dangerous, in my opinion, and should be avoided.

I use Piwik on my own sites and will never share that data with anyone.

Re: Facebook uses bgsound to see if you have opened an email

#67

Post by duck » Mon, Mar 05, 2012, 1:44 AM UTC

I figured it they were doing this they would have made it so when you opened a notification via email it would mark it as read within the Facebook site, but it doesn't. That would be a nice feature and purpose for the tracker image.

Re: Facebook uses bgsound to see if you have opened an email

#68

Post by nknight » Mon, Mar 05, 2012, 1:46 AM UTC

Drbble wrote: post #63

nknight wrote: post #24

Earlier quoted context omitted.

An invasion of privacy does not cease to be an invasion of privacy just because a small group of deeply unethical people persist in it for years.

To win this fight, you need to convince users (and not just the techies on HN) to care. You aren't going to convince site operators to hamstring themselves over an issue their users don't care about. (Even if you do, unless you win over ever single site, all you will do is kill the ethical operators and leave the unethical one standing, let like antibiotic resistant bacteria. Is that really what you want? )

This isn't about websites, it's about email. Ethical operators do not insert tracking bugs into email, and they definitely don't do it in a way that tries to deliberately get around long-standing restrictions in virtually all email clients explicitly designed to impede this.

Re: Facebook uses bgsound to see if you have opened an email

#69

Post by zzz90210 » Mon, Mar 05, 2012, 2:10 AM UTC

mike-cardwell wrote: post #28

jeffreyg wrote: post #17

Earlier quoted context omitted.

Doesn't gmail stop these attacks without needing to force plaintext only by simply disabling images by default?

Yes. There was a bug a few years back though where they would display attached SVG images. These images could actually contain javascript, which left it vulnerable to XSS.

What about the bgsound attack?

Re: Facebook uses bgsound to see if you have opened an email

#70

Post by eli » Mon, Mar 05, 2012, 2:22 AM UTC

icebraining wrote: post #56

marquis wrote: post #48

Earlier quoted context omitted.

So did I, it picked up a Google IP address. Anyone know how to close this? I have images turned off.

It seems to be the MTA (probably the spam filter), since it happens to me even without any client open, so there's probably no way to close it by your end.

If it happens without any client open, then it isn't really a problem is it?