Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Images Now Showing in Gmail

gmailblog.blogspot.com

Post reply on HN
Print view View original

91–100 of 141 posts

Re: Images Now Showing in Gmail

#91

Post by [deleted] »

yajoe wrote: post #49
keithwinstein wrote: post #29

[Update 2: I just tested with a newly-created Gmail account and the feature did not seem to have been rolled out to the new account yet.] [Update: I'm not sure when this feature will actually be rolled out. I think my test below automatically displayed the image because my own email address appears to be implicitly a whitelisted sender (even though "images from this sender are always displayed" doesn't appear for it)…

It's also weird that they didn't explain the how behind this line: > Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers. In most cases, the unique identifiers are embedded in the URLs themselves, so simply serving through a proxy is ineffective. Should I blindly trust that you, Google, did the right thing? Edit: looks…

[deleted]

Re: Images Now Showing in Gmail

#92

Post by skloubkov »

Seems like a privacy hole.

Mailer can setup url that is composed of random words and is unique per email.

Ex: www.tracker.com/weather-dog-city-nice.jpg could identify you + timestamp of request and bam, you have record of: valid email, address isn't blocked and that user reads emails from recipient. No proxy in a world would be able to make this request anonymous.

No idea what advantage of this is apart from google eventually offering an alternative to gmail (think of comment system being replaced on youtube)

Re: Images Now Showing in Gmail

#93

Post by PavlovsCat »

alooPotato wrote: post #82

This proxying actually rolled out on December 3rd to most gmail.com users. We, Streak, happenned to launch an email tracking feature on the same day ( http://www.streak.com/email-tracking-in-gmail ). Here's what we've learned: - the proxying of requests only happens when a user is viewing the mail inside Gmail (i.e. gmail does not actually affect the message body, its just proxying at render time) - gmail only caches…

> all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email

You just have an email address. Once that image is downloaded, you know it's active the sky basically falls down.

Re: Images Now Showing in Gmail

#94

Post by Aldo_MX »

dingaling wrote: post #63
seanalltogether wrote: post #46

Earlier quoted context omitted.

I don't understand how a proxy will protect me from an image loaded as http://marketer.com/4b3403665fea6.jpg where that hash is used to link to my email address

Now it will seem to the sender that 100% of e-mails sent to Gmail recipients have been opened, rendering actual measurement impossible. A unique ID is useless if all unique IDs are requested all the time. I'm sure they built-in rate-limiting to prevent DDOSing the sender's image server...

Or possibly they could use heuristics to detect a newsletter and deliver the first fetched image to every recipient of the same newsletter.

Re: Images Now Showing in Gmail

#95

Post by mtrimpe »

mratzloff wrote: post #78
mtrimpe wrote: post #68

Earlier quoted context omitted.

They'll probably retrieve and cache every image as soon as the email is received which would effectively render open statistics meaningless for GMail addresses.

They don't, and it doesn't. See the post by @danielnr.

They don't yet. I wouldn't be surprised if they do the same as with 'not provided' where they slowly make the data less reliable until they finally just turn it off altogether.

Re: Images Now Showing in Gmail

#96

Post by lallysingh »

thedufer wrote: post #87
alooPotato wrote: post #82

This proxying actually rolled out on December 3rd to most gmail.com users. We, Streak, happenned to launch an email tracking feature on the same day ( http://www.streak.com/email-tracking-in-gmail ). Here's what we've learned: - the proxying of requests only happens when a user is viewing the mail inside Gmail (i.e. gmail does not actually affect the message body, its just proxying at render time) - gmail only caches…

> obviously you can encode some ID into the image URL itself but all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email - so again, no PII gets disclosed All that lets you do is...confirm that the email address exists. Until this change, that was a very difficult thing to do; now, its equivalent to getting a message…

gmail already bounces email to nonexistant addresses.

Re: Images Now Showing in Gmail

#97

Post by michaelmior »

Too wrote: post #50
danielnr wrote: post #33

Earlier quoted context omitted.

I just ran the same test and can confirm the results. Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts. I don't use any Google services outside of small tests like this, but it still makes me concerned for how this will affect the privacy of people I know.

Interesting. The fact that they don't even address this aspect of the change in the blog post makes you wonder if this is a deliberate or incompetent move. This should be obvious for anyone who works with email and easy enough to describe in layman terms the blog post. Who is the target group for the blog?

I assume the target of the blog is Gmail power users moreso than email markers. I highly doubt that the Gmail team didn't think this through before launching. As far the reason for not explaining how this works, who knows?

Re: Images Now Showing in Gmail

#99

Post by arsenerei »

shabble wrote: post #48
arsenerei wrote: post #35

Earlier quoted context omitted.

Honest question: Does this differ from them storing the email which already contains the pictures?

Yes. Whilst you can embed images as MIME attachments (or data:// uri trickery and the like), the vast majority are tags referencing external http:// uris. A message with remote image references is not a complete document, and won't render correctly unless those references can be followed. Google are instead fetching and caching those remote references, then serving them indirectly to you. As comparison, Firefox has a…

Fair point, I wasn't considering external links, only embedded images. Thanks.

Re: Images Now Showing in Gmail

#100

Post by dragonwriter »

danielnr wrote: post #33
keithwinstein wrote: post #29

[Update 2: I just tested with a newly-created Gmail account and the feature did not seem to have been rolled out to the new account yet.] [Update: I'm not sure when this feature will actually be rolled out. I think my test below automatically displayed the image because my own email address appears to be implicitly a whitelisted sender (even though "images from this sender are always displayed" doesn't appear for it)…

I just ran the same test and can confirm the results. Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts. I don't use any Google services outside of small tests like this, but it still makes me concerned for how this will affect the privacy of people I know.

> Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts.

If you didn't have the "ask before displaying external content" option set before this change, you were "opted-in" to read receipts already -- its just that, due to protections designed to stop other malicious use of images, you were incidentally protected against images as the vector for silent read receipts.

With this change, you are better protected against the malicious uses of images the default-not-to-display option was designed to protect against, but exposed to external images as a vector for read receipts if you hadn't chosen to display external content only after confirmation. If you did choose that previously, then you also got the new "ask before displaying external images" chosen by default -- so if you were protected from senders injecting read receipts before, you still are now. If you weren't before, you aren't now, but then that's not really a change.

Post reply on HN