Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail blows up e-mail marketing by caching all images on Google servers

arstechnica.com

Post reply on HN
Print view View original

51–60 of 322 posts

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#51

Post by plorg »

slg wrote: post #34
trevyn wrote: post #28

Earlier quoted context omitted.

> Google has no way to know that all of those point to the same image. Try again. :)

Yeah, I am not sure where the original claim is coming from. It isn't that hard for Google to simply follow the links and compare the files as part of the caching process. So unless marketers start customizing the images in addition to the links, there isn't any reason why Google can't cache the images together. And even if marketers do start customizing images, hasn't Google gotten pretty good at comparing very simi…

Ok, but then Google's still making a request to, here, a user-specific URL. The spammer may not know where you are, but they now know that your address exists.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#52

Post by rhizome »

drzaiusapelord wrote: post #16

So instead of my work mailing lists having accurate stats via ye olde tracking pixel, now only google does, which they will sell to their own chosen marketers and clients paying google's rate. This isn't the privacy and common-sense win you think it is.

Not too different from them removing actual referrer URLs from Google Analytics.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#53

Post by MichaelGG »

nitrogen wrote: post #26
Ellipsis753 wrote: post #14

Earlier quoted context omitted.

I think it caches them the moment the email is sent?

That is only possible if the URL is identical. If senders use unique URLs per recipient, Google could guess at which images are identical based on surrounding e-mail content, patterns in URL components, and/or statistical sampling of some of the URLs, but a 100% accurate deduplication would either require identical URLs or a lot of bandwidth to read 100% of URLs.

Well Google already crawls a ton of URLs so it's hard to imagine bandwidth being a major issue, right?

Even the same URL can return a different image. That wouldn't be super useful for tracking, but they can only truly dedupe if they read every response.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#54

Post by trevyn »

slg wrote: post #34
trevyn wrote: post #28

Earlier quoted context omitted.

> Google has no way to know that all of those point to the same image. Try again. :)

Yeah, I am not sure where the original claim is coming from. It isn't that hard for Google to simply follow the links and compare the files as part of the caching process. So unless marketers start customizing the images in addition to the links, there isn't any reason why Google can't cache the images together. And even if marketers do start customizing images, hasn't Google gotten pretty good at comparing very simi…

Of course, if Google instantly downloaded every single image reference in every email accepted by their MX, there is no longer any useful information in that fact.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#55

Post by MrClean »

codeflo wrote: post #12

> E-mail marketers will no longer be able to get any information from images—they will see a single request from Google, which will then be used to send the image out to all Gmail users. Unless you click on a link, marketers will have no idea the e-mail has been seen. Absurdly wrong, marketers already use a unique image URL for each email recipient, and Google has no way to know that all of those point to the same im…

Consider this @codeflo:

1. Google may cache all images in all emails sent to gmail.com instantly and regardless of the existence of the address. This would remove the possibility for marketers to check user timestamp, remove user data from request and hide user email existence.

2. Google does _not_ need to save each image from each unique URL separately, all they need to do is fetch each image and check against an already existing (mega)array of images they've fetched. This greatly reduces storage needed, but doesn't do much for the bandwidth requirement, but they won't care about bandwidth in all their Googleness.

3. The single most important aspect of this change has been omitted in the article, and in your comment: This change completely eliminates the risk of CSRF attacks by spammers and the likes. CSRF attacks are still number 8 on OWASPs list of top 10 attacks.

My three cents ;)

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#56

Post by ben0x539 »

slg wrote: post #34
trevyn wrote: post #28

Earlier quoted context omitted.

> Google has no way to know that all of those point to the same image. Try again. :)

Yeah, I am not sure where the original claim is coming from. It isn't that hard for Google to simply follow the links and compare the files as part of the caching process. So unless marketers start customizing the images in addition to the links, there isn't any reason why Google can't cache the images together. And even if marketers do start customizing images, hasn't Google gotten pretty good at comparing very simi…

I don't understand how that helps. If I send an email to user_x@gmail.com with an embedded image at http://example.com/my_spam_images/image_for_user_x.jpg and google makes a request to that, I know the mail has been delivered and the user in question exists and is seeing my ads, because a request for image_for_user_x.jpg showed up in my logs.

Now, when user_y also receives my spam and I get a request for image_for_user_y.jpg and I just serve the same file, Google is probably gonna deduplicate them on their cache or cdn or w/e, but only after they've sent me the request and confirmed that someone read my email.

I'm not trying to overload google's storage capability here (lol), I'm just interested in the information leak.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#57

Post by surrealize »

codeflo wrote: post #44
surrealize wrote: post #39

Earlier quoted context omitted.

Google could retrieve and cache a random sample of the images and hash them. Then they could note which image links go to the same images. And they could identify image links by noting that a bunch of emails have the same structure except for one image link that's different for every recipient. So I think they actually could take a pretty good stab a deduping images with unique tracking URLs. It might not be perfect,…

Easy: Make the "Dear " part of the email an image. Boom, deduplication fooled. (Also, they don't currently seem to do anything like you're suggesting.)

With google's machine learning brain trust, I think they could still do a pretty good job deduping. Maybe not perfect, but I'd bet on them to win an arms race.

Edit: ah, codeflo and EGreg are right. I was just thinking about the task of determining that the images serve the same role in each message (which I'm sure google could do a good job of). But (as they point out) in the "Dear " case they'll still have to show the right image to the right user. Although, as Nacraile and jaxn say, if they load all those images eagerly they'll remove the value of those unique tracking images, and impose a cost on the sender.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#58

Post by jessaustin »

untog wrote: post #47
slg wrote: post #34

Earlier quoted context omitted.

Yeah, I am not sure where the original claim is coming from. It isn't that hard for Google to simply follow the links and compare the files as part of the caching process. So unless marketers start customizing the images in addition to the links, there isn't any reason why Google can't cache the images together. And even if marketers do start customizing images, hasn't Google gotten pretty good at comparing very simi…

hasn't Google gotten pretty good at comparing very similar files? Sure, but they'd have to download the file first. At which point the tracking has succeeded.

...the tracking has succeeded.

Succeeded in what, confirming that Google is still in operation? Please note that Google doesn't even have to confirm the receiving email address is valid in order to get the image.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#59

Post by ricardobeat »

nanidin wrote: post #48
coffeecheque wrote: post #3

Longer discussion here: https://news.ycombinator.com/item?id=6895606

Hmm - so we can flood Google's cache by sending an email full of links to procedurally generated images?

You'd never win that race.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#60

Post by ben0x539 »

ceejayoz wrote: post #18
codeflo wrote: post #12

> E-mail marketers will no longer be able to get any information from images—they will see a single request from Google, which will then be used to send the image out to all Gmail users. Unless you click on a link, marketers will have no idea the e-mail has been seen. Absurdly wrong, marketers already use a unique image URL for each email recipient, and Google has no way to know that all of those point to the same im…

In fairness, it's a partial privacy improvement - it masks IP and user agent, as well as repeat opens.

If no actual http request between the email recipient and the sender happens, doesn't that also imply that the sender has less opportunity to do all the regular http user tracking stuff to associate the browsing session with that email address? That seems vaguely beneficial.
Post reply on HN