whatever happened to read receipts? I wouldn't mind allowing a sender who wants to know if I've opened their email, access to a read receipt about it.
Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
21–30 of 81 posts
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#22whatever happened to read receipts? I wouldn't mind allowing a sender who wants to know if I've opened their email, access to a read receipt about it.
They still exist. Surprisingly, most folks aren't interested in letting every newsletter and promotion know that they were seen. So a surveillance arms race ensues instead.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#23I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
Some of the big providers already do this, notably Apple and Gmail: https://www.litmus.com/blog/gmail-prefetching-images
[deleted]
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#24You disclosed this the day roundcube was patched. Isn’t it usual to give us time to deploy updates before disclosing details?!
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#25I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
That still provides “human” vs “bot” feedback to the sender. An automated system processing emails isn’t going to be fetching images or rendering attached SVGs.
I think I might be misunderstanding. Why wouldn’t it? It’s not like the human is manually decoding the SVG or getting the PNG.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#26I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malic…
Did everyone get flagged then thanks to Barracuda? You’d think they’d realize there’s a problem if there’s a 100% fail rate.
Edit: also, to be fair, you basically told them you had opted out of the test, so it’s not completely ridiculous for them to ask you to do the training instead.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#27I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
Some of the big providers already do this, notably Apple and Gmail: https://www.litmus.com/blog/gmail-prefetching-images
Gmails prefetch is terrible for privacy because it honors http cache headers, which means tracking companies simply use a "no-cache, must-revalidate" header to defeat it.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#28I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
[deleted]
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#29You disclosed this the day roundcube was patched. Isn’t it usual to give us time to deploy updates before disclosing details?!
The patch disclosed details pretty clearly already.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#30I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malic…
Those knowb4me or whatever supposed security lessons are terrible. In our case the emails included links to external domains (to knowb4) that you were actually required to click, as in really not as a test to see who did it. And you presume to teach me Fing security...