Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
1–10 of 81 posts
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#2Nice catch!
I am trying to read as less _online_ as possible nowadays. I essentially have dovecot in my crontab, and read it off roundcube. It's been working great, RoundCube is dead simple to setup and use, the UI and search are very fast.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#3Hmm, I wonder, if roundcube was the exception (w.r.t feImage), or if soon other webmail clients will need to be patched
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#4I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so.
Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#5Slightly related, but fraudsters love using .svg attachments, typically the mails purport to be for an invoice which you need to log into your Microsoft account to be able to “securely” view.
I’m not sure if Exchange Online doesn’t scan them or something, but I landed up making a rule which blocks all emails with either .svg or .htm(l) attachments and to notify me when blocked.
Happens a couple of times per month for the our small company, no false positives yet.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#6I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
Some of the big providers already do this, notably Apple and Gmail:
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#7I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
I think this is what icloud does. Seems like an easy way to make tracking useless if every client did it.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#8Hmm, I wonder, if roundcube was the exception (w.r.t feImage), or if soon other webmail clients will need to be patched
Author here! I have looked at Thunderbird. I'll go and look at some others as well, should have probably done that earlier.
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#9Not disputing the article, nor insinuating that there's some ulterior motive, but it's curious that this blog has only one post; and the About page suggests a lengthier history (with references to what would have been previous posts).
Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
#10Hmm, I wonder, if roundcube was the exception (w.r.t feImage), or if soon other webmail clients will need to be patched
I wouldn't vouch 100% for my PHP understanding but it looks like SnappyMail removes `` elements entirely (`BuildHtml` in `snappymail/v/2.38.2/app/libraries/MailSo/Base/HtmlUtils.php`)