141–150 of 322 posts
> E-mail marketers will no longer be able to get any information from images—they will see a single request from Google, which will then be used to send the image out to all Gmail users. Unless you click on a link, marketers will have no idea the e-mail has been seen. Absurdly wrong, marketers already use a unique image URL for each email recipient, and Google has no way to know that all of those point to the same im…
Earlier quoted context omitted.
There is ONE way: fetch every single image right away regardless of whether the email is even valid. And then don't store the cached version if there is no valid email. Otherwise store it and display to the user. Sure, in theory that works. In practice, you make an easy may to do a Denial of Service attack against Google or innocent third parties so it in actuality would never work. Send a million emails to Gmail acc…
Google does SPAM filtering and has no obligation to deliver those messages. It can throttle its acceptance of messages from the same IP block. How is this different than any other (distributed) DNS attack mitigation?
As it is right now, spam is just mostly a drain on network and human resources.
This attack would also target storage. Google has enormous amounts of storage, so I've no idea whether it would be effective against them or not. But, it would be very effective against any smaller service providers that tried to do the same image caching thing (which so far seems to be a roundly bad idea, IMO).
It would also open up the possibility of using Google as an attacker to take down other sites. If Google's servers immediately requested the image for caching, then just send out a few million messages to Google addresses, each one with a unique URL pointing to some big image file on some site you want to take down. Most sites will accept a query string after an image URL, so ... bob's yer uncle. As it is now, this isn't an effective attack because you need to get people to actually open up the email message and then click "Display images", all within a short period of time.
So instead of my work mailing lists having accurate stats via ye olde tracking pixel, now only google does, which they will sell to their own chosen marketers and clients paying google's rate. This isn't the privacy and common-sense win you think it is.
> which they will sell ... Citation? I was not aware of this.
> E-mail marketers will no longer be able to get any information from images—they will see a single request from Google, which will then be used to send the image out to all Gmail users. Unless you click on a link, marketers will have no idea the e-mail has been seen. Absurdly wrong, marketers already use a unique image URL for each email recipient, and Google has no way to know that all of those point to the same im…
This is a silly fear, all email clients already do this, as you don't display raw unmodified HTML from emails, you have to scrub it. They are just adding one new kind of scrubbing to the list of things they already must do.
Earlier quoted context omitted.
Why shouldn't content providers be free to monitor usage if it's legal and easy to do? Would you next start to argue SaaS providers shouldn't have any Web server logs at all since it's a way of "tracking" users?
For the same reason that sending me a postcard doesn't entitle you to enter my house and take an inventory of my fridge. To get that information about a user, you should need informed consent, not just a marketer's wistful greed. That same "why not?" attitude is exactly the same bullshit user-contemptuous line of thinking that the NSA and the FBI use with their "intercept it all and let God sort it out" eavesdropping…
Facebook is doing this from decades.
Earlier quoted context omitted.
Google does SPAM filtering and has no obligation to deliver those messages. It can throttle its acceptance of messages from the same IP block. How is this different than any other (distributed) DNS attack mitigation?
Snowshoe spam is pretty common now, with a lot of the larger networks mixing in spammers with legitimate traffic (lookin' at you, ovh.com). As it is right now, spam is just mostly a drain on network and human resources. This attack would also target storage. Google has enormous amounts of storage, so I've no idea whether it would be effective against them or not. But, it would be very effective against any smaller se…