Gmail blows up e-mail marketing by caching all images on Google servers • Hacker News Board

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#121

Post by sedev » Thu, Dec 12, 2013, 10:06 PM UTC

kevrone wrote: post #2

Holy crap. If I'm reading this right, this basically destroys all pixel tracking, so no more email open stats, no nothing.

Yes, and as a consumer, I couldn't be happier. All that shit is customer-hostile privacy-invading bullshit and I'm ecstatic that Google is making a move that kills it. I vigorously object to things like tracking bugs that leak information about me without my consent, so I'm in favor of measures like Google's that get us further towards people being unable to go on data fishing expeditions such as were possible with inserting arbitrary tracking bugs in emails. HTML email is a giant attack surface not just for Outlook Express-style remote code execution, but for invasions of privacy. If a marketer can't do their job without invading my privacy, I have no sympathy for them and I hope that this technical change stabs their business model in the belly.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#122

Post by ryan-c » Thu, Dec 12, 2013, 10:06 PM UTC

necubi wrote: post #19

There seems to be a lot of misinformation flying around. Here's [0] Google's support doc that clears up some of it. The most important part is at the end: "In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed…

I'm not yet seeing this option available in my account. :(

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#123

Post by mytummyhertz » Thu, Dec 12, 2013, 10:07 PM UTC

unless they are implementing this for fake email addresses, this is TERRIBLE!

it makes it super simple to enumerate valid email addresses.

patch it to fetch the images on valid+invalid email addresses, then we'll talk

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#124

Post by sedev » Thu, Dec 12, 2013, 10:11 PM UTC

petercooper wrote: post #65

seiji wrote: post #17

Earlier quoted context omitted.

You have no right to know what your users are doing after you send them a message. The privacy invading "tracking pixels" shouldn't exist in the first place.

Why shouldn't content providers be free to monitor usage if it's legal and easy to do? Would you next start to argue SaaS providers shouldn't have any Web server logs at all since it's a way of "tracking" users?

For the same reason that sending me a postcard doesn't entitle you to enter my house and take an inventory of my fridge. To get that information about a user, you should need informed consent, not just a marketer's wistful greed. That same "why not?" attitude is exactly the same bullshit user-contemptuous line of thinking that the NSA and the FBI use with their "intercept it all and let God sort it out" eavesdropping schemes.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#125

Post by vilhelm_s » Thu, Dec 12, 2013, 10:11 PM UTC

DannyBee wrote: post #77

ben0x539 wrote: post #64

Earlier quoted context omitted.

"early tests indicate that they don't actually do that, waiting for the user to click the email to make the request."

It'd be nice to see these "early tests".

You can easily try it yourself.

python -m SimpleHTTPServer 8080

creates a webserver serving the current directory, you can then create an email linking to a file in that directory and observe when it gets queried.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#126

Post by YourSexyMama » Thu, Dec 12, 2013, 10:17 PM UTC

badman_ting wrote: post #84

YourSexyMama wrote: post #61

So there is something I'm not seeing this being discussed anywhere. What about the idea of only storing one image for any and all recipients? Yes I know that the file name is changed based on recipient to try and track the users viewing of the image. But a simple md5sum of the file will indicate that it is potentially the same file as others being cached. Google would only need to store the references and the one fil…

But this only addresses the storage side. A request must still be issued for each unique URL in order to de-dupe.

Damn, I didn't think about that...

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#127

Post by austinhutch » Thu, Dec 12, 2013, 10:20 PM UTC

warfangle wrote: post #87

mml wrote: post #5

Earlier quoted context omitted.

Yup. I'd really hate to be in the bulk email business today. Perhaps google will sell them back the data they used to create themselves.

The future of marketing is forming cohesive communities with your customers, anyways, not spamming the shit out of them.

What does a "cohesive community" look like and is anyone doing this today?

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#128

Post by EGreg » Thu, Dec 12, 2013, 10:21 PM UTC

300bps wrote: post #116

EGreg wrote: post #90

Earlier quoted context omitted.

There is ONE way: fetch every single image right away regardless of whether the email is even valid. And then don't store the cached version if there is no valid email. Otherwise store it and display to the user. Since every result will be a positive - false or not - no information is revealed to the marketer AND the images are displayed.

There is ONE way: fetch every single image right away regardless of whether the email is even valid. And then don't store the cached version if there is no valid email. Otherwise store it and display to the user. Sure, in theory that works. In practice, you make an easy may to do a Denial of Service attack against Google or innocent third parties so it in actuality would never work. Send a million emails to Gmail acc…

Google does SPAM filtering and has no obligation to deliver those messages. It can throttle its acceptance of messages from the same IP block. How is this different than any other (distributed) DNS attack mitigation?

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#129

Post by glomph » Thu, Dec 12, 2013, 10:21 PM UTC

jellicle wrote: post #114

slg wrote: post #34

Earlier quoted context omitted.

Yeah, I am not sure where the original claim is coming from. It isn't that hard for Google to simply follow the links and compare the files as part of the caching process. So unless marketers start customizing the images in addition to the links, there isn't any reason why Google can't cache the images together. And even if marketers do start customizing images, hasn't Google gotten pretty good at comparing very simi…

The two of you are confused. The image link doesn't even have to return an image in order to successfully send information to marketers. An image link in the email to: http://thisalways404s.com/404/slg_read_my_email will work just fine. So, Google will follow the link and compare the files and... wait a second, the information we care about - that slg read my email - has already been transmitted.

Unless they did it at the time of mail arrival in order to better compare and save on loading times. In which case the information would be useless.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#130

Post by asdf3 » Thu, Dec 12, 2013, 10:25 PM UTC

drzaiusapelord wrote: post #16

So instead of my work mailing lists having accurate stats via ye olde tracking pixel, now only google does, which they will sell to their own chosen marketers and clients paying google's rate. This isn't the privacy and common-sense win you think it is.

Why aren't you asking for read-receipts if that's what's desired? If it's because people wouldn't send them, shouldn't that be their choice?