MailTrackerBlocker – email tracker and spy pixel blocker plugin for Apple Mail

https://apparition47.github.io/MailTrackerBlocker/

by guessmyname • 6 years ago

58 35 6 years ago

apparition47.github.io

spzb• 6 years ago

Doesn't Mail do this by default by not loading remote images?

xoa• 6 years ago

Yeah, I'm mildly confused by what the sell point here is. I sort of assume that any loading of remote resources automatically represents tracking information for this use-case, every email can be trivially individualized to the receiver and in turn I don't see how it's feasible to prevent resource tracking. You either load remote resources, or you don't. I guess if techniques remain relatively unsophisticated for email and few people bother then individuals might slip under the radar, though partial blocking itself represents a signal. But unlike the web individual messaging remote resources seems like an arms race users would be destined to lose.

The only thing I could see really working would depending on a really big service that processed every received email immediately and proxied all remote resources without any user interaction. Plenty of challenges there too though, and harder to make it work with regular clients. Maybe dynamically rewriting the email to point to the proxied resources? Or automatically rendering/inlining them?

gruez2• 6 years ago

Maybe dynamically rewriting the email to point to the proxied resources?

AFAIK gmail already does that. It prevents people from knowing your IP address, but they still know whether you opened the email or not, since it's lazy loaded. Preferably there's a email service that always loads the images and stores it, so you can view images without any spying.

gruez2• 6 years ago

It does, but I guess this is for people who like images most of the time, and just want to avoid the tracking without sacrificing ux. I'm guessing it's inspired by https://hey.com/spy-trackers/, which also has a similar feature that works on a blacklist basis (presumably).

WhyNotHugo• 6 years ago

I'm curious why they wouldn't also eager-load _other_ images.

As soon as an email is received (regardless of whether the recipient account exists or not), load the image from the remote host.

This also degrades the spying capabilities of third parties. If they track image loads to translate this to "email opened", they'll immediately get pure false positives from any email they sent to @hey.com -- even if the account doesn't exist.

m4632• 6 years ago

Note that apple has a bug, and has had it for years and years.

If you have it turned off it won't load remote images...

EXCEPT: if you forward an email - it will load them all, all of them. This is especially troublesome if you want to forward a phishing email to IT.

(thank you little snitch. also I am not using the latest catalina apple mail)

LeoPanthera• 6 years ago

You can bypass this by doing "forward as attachment", which you should be doing anyway, since it preserves the headers.

miles• 6 years ago

For anyone not using it, the great thing about Little Snitch is being able to set just the precise port numbers and remote hosts you want a given app to access while blocking everything else, rendering plug-ins like MailTrackerBlocker unnecessary. You can also set profiles for different networks, and even have them switch automatically: https://help.obdev.at/littlesnitch/adv-profiles .

captn3m0• 6 years ago

Is it possible to port this to iOS?

wyxuan• 6 years ago

Im pretty sure plugins aren't supported for mail on iOS, but fusion of macos mail and ios mail in future w/ catalyst apps might allow it.

otherwise, you can just disable external image loading

saagarjha• 6 years ago

If you jailbreak, then maybe.

imposterr2• 6 years ago

Many email providers have dealt with this by proxying all external image links in emails through their own services.

See Gmail: https://support.google.com/mail/answer/145919?p=display_imag...

See Fastmail: https://fastmail.blog/2014/09/16/better-security-and-privacy...

Although, I'm not sure if these protections extend to those using third party email clients with these services.

techsupporter4• 6 years ago

I'm not sure if these protections extend to those using third party email clients with these services

In Fastmail's case, those protections don't extend. I've tested this and Fastmail rewrites the image URLs when viewing through their webmail client but passes the message unmodified when fetching via IMAP.

I understand why they'd do this but I'd love to have a setting that says to do this privacy rewrite when using an external client.

imposterr2• 6 years ago

Thanks for clarifying. Might be worth shooting them a message to ask for this feature. They've always been good about fixing bugs and at least responding to requests, even if they decide not to pursue it.

rmccue• 6 years ago

Gmail’s don’t extend, at least via the IMAP API.

jabroni_salad• 6 years ago

Some 3rd party antispam products also follow all the links they can find gauge their intent.

My company's marketing department has complained about this after noticing that our own clients have a 100% click rate. It's because we are reselling Barracuda.

m4632• 6 years ago

I think that's an interesting take on it. Sort of like the adblockers that go the other way and click on ALL the ads.

If you can load all images at reception time (and put them somewhere), maybe that gives less information.

Of course it might give them a clue about your spam processing if it comes first and those don't get loaded.

upofadown2• 6 years ago

That only blocks your IP address. They still know you looked at the email and when you opened it. That is the most valuable information.

csunbird2• 6 years ago

No, it does not. By downloading the images to Gmail's/mail providers cache, they are effectively giving the impression that the user opened the mail just when it was delivered. The mail provider then shows their cache when you open the mail, the tracker will not work.

techsupporter4• 6 years ago

This plugin is awesome but one thing I've noticed lately is several financial institutions use tracking pixels to verify e-mail addresses and if you don't open an e-mail in a way that loads the pixel once every so often, they drop you from paperless statements.

I've run into this with Capital One and Discover. Every year I have to log in and click "yes I want paperless statements" and then 11 statements later I get one in the mail with a message about "we miss you, you're not opening our e-mails so here's a paper statement unless you tell us you want e-statements and you open our e-mails." Never mind that I log into the mobile apps and web-based account management systems multiple times per month...

joncp• 6 years ago

Hmmm. They email you your statements? Am I getting that right? If so, that seems like a pretty big security issue.

techsupporter4• 6 years ago

No, they e-mail to tell me that a statement is available for viewing on their web site or mobile application. But if I don't "open" one of those e-mails every 12 months, they kick me off of paperless statements and go back to sending them via regular mail.

awinder• 6 years ago

Just making sure but do you ever click through on an email link or do you just use it as a notification and then go and log in? I’m curious if they just need to be looking at click + open events or if that wouldn’t even help in this scenario.

8organicbits• 6 years ago

Note, of course, that the former increases your risk of accidentally visiting a phishing site.

I kind of wish banks didn't put links in their email.

smichel17• 6 years ago

If you go to the site and log in, they have an opportunity to ask you to confirm that you still want emails.

dave5104• 6 years ago

To be honest, this seems like a decent check for banks to make. Based on my experience with users and the emails attached to their accounts, not all of them have an attachment to an email address that you or I might have (I haven't switched addresses in decades.) They also somehow frequently lose access to inboxes.

ignoramous• 6 years ago

The banks could verify if the user is checking their mails by asking them to reply to the email or click on a link explicitly to confirm the receipt? Tracking with pixels... there's so much wrong with it that it needs a blog post of its own, and thankfully someone did just that: https://mikeindustries.com/blog/archive/2019/07/superhuman-i...

wayne• 6 years ago

Wow! I've been trying to figure out for a year why my financial institution hasn't been able to deliver me electronic statements. Every month or so it's been auto-switching back to snail mail. I even switched email services and did extensive tweaks to my spam blockers to try to figure out what was happening. Them looking at the email image-loads never occurred to me... thanks for sharing that!

otherme123• 6 years ago

This is horrific UX. Mi bank is almost 100% paperless, and once a month they send this exact mail. I read the subject (something like "You have a message with your monthly statements") and I delete the mail without opening. They never punish me for refusing to get tracked.

Pixel tracking is awful, if you do it at least show some decency and don't blame the victim if they don't fall in your trap.

tinus_hn• 6 years ago

Pretty dumb because like most clients, the #1 email client Outlook does not load these.

MailTrackerBlocker – email tracker and spy pixel blocker plugin for Apple Mail

Related Stories