Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail blows up e-mail marketing by caching all images on Google servers

arstechnica.com

Post reply on HN
Print view View original

161–170 of 322 posts

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#161

Post by Silhouette »

Nacraile wrote: post #62
codeflo wrote: post #44

Earlier quoted context omitted.

Easy: Make the "Dear " part of the email an image. Boom, deduplication fooled. (Also, they don't currently seem to do anything like you're suggesting.)

What if google just immediately fetches images for all received messages, regardless of deliverability? They can dedupe wherever possible, but the sender still ends up with no information about whether the message was delivered, much less read.

What if google just immediately fetches images for all received messages, regardless of deliverability?

I'm trying to work out whether this is more useful as a way to get Google to DoS themselves or as a way to get them to DoS arbitrary web sites of others. Either way, isn't this a gift to trouble-makers?

Of course Google would probably develop an automated defence against such attacks quickly if they happened in practice, but it seems any such defence would necessarily involve not caching all the images in advance, which would defeat the original point.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#162

Post by mnutt »

Some other technical aspects of this:

GMail serves all images from a datacenter in Mountain View, CA, so if your email's images were served from multiple datacenters or a CDN, there is a good chance they will load more slowly, depending on your caching headers. They optimize images on the fly, which may introduce more latency. Their optimizer doesn't take into account whether the optimized image is smaller than the original, so the image they serve is occasionally larger (and/or looks worse) than the original. The maximum image size seems to be about 10MB.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#163

Post by thaumaturgy »

ivanca wrote: post #149
thaumaturgy wrote: post #142

Earlier quoted context omitted.

Snowshoe spam is pretty common now, with a lot of the larger networks mixing in spammers with legitimate traffic (lookin' at you, ovh.com). As it is right now, spam is just mostly a drain on network and human resources. This attack would also target storage. Google has enormous amounts of storage, so I've no idea whether it would be effective against them or not. But, it would be very effective against any smaller se…

Nope; still the same filtering; they are not going to cache things detected as SPAM; so an attacker would have to fool the anti-spam algorithm first... good luck with that!

I wasn't describing a new tactic for spamming, I was describing possible new tactics for targeted attacks. They're different things.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#164

Post by ivanca »

thaumaturgy wrote: post #163
ivanca wrote: post #149

Earlier quoted context omitted.

Nope; still the same filtering; they are not going to cache things detected as SPAM; so an attacker would have to fool the anti-spam algorithm first... good luck with that!

I wasn't describing a new tactic for spamming, I was describing possible new tactics for targeted attacks. They're different things.

An attack that relies on the possibility of being able to send millions of emails without being detected as spam; so it is unlikely to succeed.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#165

Post by MartinCron »

mytummyhertz wrote: post #123

unless they are implementing this for fake email addresses, this is TERRIBLE! it makes it super simple to enumerate valid email addresses. patch it to fetch the images on valid+invalid email addresses, then we'll talk

As others have pointed out, I don't think it's that difficult for you to enumerate valid gmail email addresses at the moment.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#166

Post by chc »

Steuard wrote: post #99
necubi wrote: post #19

There seems to be a lot of misinformation flying around. Here's [0] Google's support doc that clears up some of it. The most important part is at the end: "In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed…

Wow, I'm amazed by this. I was convinced that Google wouldn't have rolled out this new feature unless they had a way to avoid this sort of tracking. Isn't this exactly the privacy issue that led clients to adopt "Don't display images automatically by default" in the first place? (Why wouldn't they let users combine this behavior with the old one? That is, don't display images by default, but if you choose to display…

I thought "Don't display images automatically by default" was a response to porn images.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#167

Post by prostoalex »

jblow wrote: post #110
jaxn wrote: post #86

Earlier quoted context omitted.

AND it could create a dis-incentive to load up an email with unique images since as soon as you send the email out all of those gmail addresses are coming right back at your server to request the images.

And then you can cause Google to DDoS someone else's site by sending out spam containing lots of image URLs.

Users would have to have previously agreed to "Always load images from domain.com"

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#168

Post by [deleted] »

necubi wrote: post #19

There seems to be a lot of misinformation flying around. Here's [0] Google's support doc that clears up some of it. The most important part is at the end: "In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed…

[deleted]

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#169

Post by warfangle »

austinhutch wrote: post #127
warfangle wrote: post #87

Earlier quoted context omitted.

The future of marketing is forming cohesive communities with your customers, anyways, not spamming the shit out of them.

What does a "cohesive community" look like and is anyone doing this today?

No idea, and I don't think so. Just spitballing.

Re: Gmail blows up e-mail marketing by caching all images on Google servers

#170

Post by 3JPLW »

buro9 wrote: post #139
curveship wrote: post #133

Earlier quoted context omitted.

Wait, do I understand you correctly that Google fetched the image even before you requested that images be displayed in the email? That seems like a boon to marketers, not a bane.

A dialog popped up when I logged into email, and before I'd seen this thread. That dialog was much along the lines of "We'll now show you images in your email automatically." with a big "OK" button. I don't recall whether there was a less prominent "No, thanks" as I was only logging on to reply to one question really quickly. I suspect this is a UX anti-pattern. I've gone back into my settings and changed it back to…

The alternative to "OK" is "Settings," with a link that just dumps you into the main settings view… leaving you to find the Images section to change it back. Quite an opt-in.
Post reply on HN