Images Now Showing in Gmail

http://gmailblog.blogspot.com/2013/12/images-now-showing.html

by roryhughes • 13 years ago

107 128 13 years ago

gmailblog.blogspot.com

draz• 13 years ago

How does this affect invisible pixels (for analytics)?

badbrain• 13 years ago

Badly: http://blog.movableink.com/gmails-recent-image-handling-chan...

roryhughes• 13 years ago

Would the image not still load only once the receiver opens it?

Anonymous982363• 13 years ago

To clarify, it's bad for marketing people, but good for users desiring privacy.

pbreit2• 13 years ago

It doesn't sound that bad. First, apparently only affecting 2-5% of mail. Secondly, everything works the same except for the absence of useragent and cache control headers (which aren't that helpful anyhow for analytics, especially when you're still getting those on 90%+ of your messages).

natch2• 13 years ago

It devalues other tracking solutions, and makes Google's own paid analytics services more compelling. So users will still be tracked, but the trackers are more likely to have to share some of the money and data with Google.

mcintyre1994• 13 years ago

Google offer paid email analytics? Out of interest do they have a free version like they do for websites too? All I can find online are things like [0] showing how to use web analytics to track emails etc.

[0] https://plus.google.com/+DanielWaisberg/posts/XDrRoh3GoVP

steven20122• 13 years ago

I hate to be "that guy", but does this mean Google is storing every one of our pics on their proxy servers? For how long do they store them, and what is their data retention policy?

Also, remembering that Google has no obligation to protect non-American users, does that give the NSA access to them, to run things like facial recognition, etc?

Segmentation• 13 years ago

Assuming worst-case NSA scenario, even if the images weren't hosted by Google, the NSA would just pull the external images anyway for facial recognition/what not.

winslow• 13 years ago

That was my initial reaction to. I suppose it has its pros and cons just like anything else. However, with recent Google (among other companies) and NSA dealings I'm looking at this with my cynical eyes as another data retention policy.

runn1ng2• 13 years ago

Ummmm.... they already store all your e-mail. What difference does storing images make?

shabble2• 13 years ago

Because if you stop serving up the remote reference before it gets requested by a particular client, it won't be there.

If it's archived {immediately,on first request} permanently thereafter, there's now another copy outwith your control.

Edit: moreover, the images are requested locally by the user's browser. Google doesn't get a look at them at any point[1]. Whereas now, they get a permanent copy for free, because they're doing you such a favour!

[1] Directly, anyway. I guess they could use js to get the requests and headers and submit them back to the mothership, but on slow connections that could be pretty obvious.

arsenerei3• 13 years ago

Honest question: Does this differ from them storing the email which already contains the pictures?

jellicle• 13 years ago

These are hyperlinks to images; they aren't attached to the email.

shabble2• 13 years ago

Yes. Whilst you can embed images as MIME attachments (or data:// uri trickery and the like), the vast majority are <img> tags referencing external http:// uris. A message with remote image references is not a complete document, and won't render correctly unless those references can be followed. Google are instead fetching and caching those remote references, then serving them indirectly to you.

As comparison, Firefox has a 'save page' function which distinguishes between 'html only' (akin to the mail message), and 'complete', which would include all images, stylesheets, external js files, etc.

steven20122• 13 years ago

To me, it sounds like they did all the heavy lifting for the NSA, and then packaged it up as a "feature" for us. If Google handed over the emails themselves to the NSA, it would contain a lot more noise, but now it's really simple for the NSA.

The work is obviously to sift through all the emails, remove the photos, and separate/store them on a separate server. Now all NSA needs to do is get a daily dump of all the pics, and then run their data collection/facial recognition on them.

BHSPitMonkey• 13 years ago

Another commenter above noted that the cache duration is on the order of "a few minutes". If the email is opened a second time later on in the day, Google's cache hits the server again.

(Of course, this doesn't rule out the possibility that Google is actually holding onto each version they cache. I imagine it's not actually worth it for them to do so.)

mjbraun2• 13 years ago

I'm curious if this will help spammers. AFAIK, loading a tracking pixel helps validate an email address as active (since, by design, bounce messages probably wouldn't make it back to the spammer), even if the recipient didn't otherwise respond to the message. AFAIK, "Validated" email address lists are worth more than unchecked lists and if Google is preloading images for valid accounts, then that seems to make validation even easier for spammers.

spb• 13 years ago

However, if they make requests (that they don't necessarily have to keep) for images for all accounts (preloading on receive and not read), it does the opposite, which is a good thing.

mjbraun2• 13 years ago

The problem is, if the filename/URL is unique to the user like "spammersite.tld/images/50093825343.jpg" and 50093825343" is tied to my unique email, then on Gmail's download and caching of the image, they've validated my email. If another email has 023503850485.jpg, gmail wouldn't know that the underlying file is the same unless it loads it. I don't even have to have checked my mail for this to happen.

Anonymous982363• 13 years ago

There's still an "Ask before displaying external images" setting, and based on the description in the article, it looks like images are only requested when the email is opened, not when it is delivered to the inbox. But, this new system looks to be enabled by default, so more people will have images enabled, which means the web bugs will mostly get through now.

Ricapar• 13 years ago

I kinda like this. More often than not, I never click the "Display Images" link because I know doing so will essentially feed information back to the people who sent the email (the fact that I opened it, my geoIP location, browser, etc). I've been fine with a slightly degraded and less pretty email experience in order to give me some extra privacy and keep my information out of marketer's systems.

With this I guess I can see emails with all the images and other goodies without that worry. Works for me.

On the other hand... There's a good chance Google is caching all this now. But seeing as they're running the mail system I don't feel like it's too major of an intrusion beyond what they already have.

lukeschlather• 13 years ago

This just means they'll be paying Google for that info instead of being able to gather it themselves.

rasengan3• 13 years ago

This is a step in the right direction. However, please understand that it doesn't really make a difference in forms of real privacy Googlers!

The e-mail spam/list creators are a different kind of adversary than, for example, web trackers.

They will do something like this: http www theirimageserver com/images/img53.jpg?to=you@email.com (Obviously they will obfuscate and use some kind of hash instead of cleartext e-mail to disguise their tracking ways).

Regardless of whether some.google.ip loads it, or your.home.ip loads it, it won't change the fact that you@email.com loaded it and your email is very active, not just active in that it didn't bounce, but active in that you actually read it.

Once again, it's a step in the right direction though, and I'm looking forward to seeing greater innovations from Google in the privacy space, because I'm confident that there are Googlers who understand that privacy is not a feature nor a PR thing... it's the difference between the preservation of humanity and society versus not.

jackcarter• 13 years ago

Is it possible that Google also loads images in emails sent to invalid @gmail.com addresses?

herge2• 13 years ago

They can mitigate that by downloading all images that come to any address @gmail.com. That way spammers won't know if you@gmail.com is real or not, and still be at step 0 (and hopefully taking some bandwidth/processing time/log space from the spammer at the same time!).

rasengan3• 13 years ago

That is very true. Hopefully, that's what is going on!

m_ram• 13 years ago

This is probably obvious to people who do email marketing, but I just tested whether gmail bounces bad addresses. They do bounce addresses that have never been registered and addresses that have been deleted. This means that even before this change, spammers could find out if an address is active.

dictum• 13 years ago

Correct me if I'm talking directly from my rear end:

For that scenario, Google could ignore the arguments and just request the file. However, I'm not sure I get Google's implementation of the proxy, but if the images are grabbed only when the email is read, it's easy to track by adding a hash to the filename itself.

So, in the email company's server, they'd have a canonical file, for instance, acme-co/dec2013news/img53.jpg. For each subscriber, they'd have something like a symbolic link to img53.jpg specific to the subscriber, for instance img53-5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8.jpg.

EDIT: Checked a newsletter's source and that's what they already do. Since I don't deal with email marketing much, I honestly had no idea.

spindritf• 13 years ago

So if you send a different picture to each recipient, you can track if they open your message? Or does Google pull all images, whether you view the message or not?

mherdeg• 13 years ago

Is Google loading these images when a user opens mail? (Have they just automatically opted users in to "read receipts"?)

Or are these images pre-cached when mail is delivered (so that the fact that an image was loaded is just proof of delivery, which you should be able to get anyway?)

oh_sigh• 13 years ago

Since images usually contain tracking information, I wonder how this helps? Maybe the proxy automatically gets and stores the image as soon as the email is received? So in this manner, they will not be able to tell if/when a user actually clicks on a link?

enraged_camel• 13 years ago

Is there a way to turn it off? I'm on a limited data plan on my iPhone and I don't want images to load by default.

arsenerei3• 13 years ago

It's in the article.

Of course, those who prefer to authorize image display on a per message basis can choose the option “Ask before displaying external images” under the General tab in Settings. That option will also be the default for users who previously selected “Ask before displaying external content”.

keithwinstein• 13 years ago

[Update 2: I just tested with a newly-created Gmail account and the feature did not seem to have been rolled out to the new account yet.]

[Update: I'm not sure when this feature will actually be rolled out. I think my test below automatically displayed the image because my own email address appears to be implicitly a whitelisted sender (even though "images from this sender are always displayed" doesn't appear for it). Whether Google will alter the behavior when they actually deploy this feature, I don't know.]

[Original message:]

I just tested and, yes, Gmail only loaded the referenced image when I clicked on the message to open it within Gmail. I can't be sure, because perhaps if I had waited an hour without opening the message, Gmail would have automatically loaded the image anyway. But in reply to mherdeg below, the evidence suggests that, yes, Gmail plans to opt everybody in to sending "read receipts" by default for HTML messages that reference images.

I'm surprised by Google's statement that the previous behavior of prompting was "to protect you from unknown senders who might try to use images to compromise the security of your computer or mobile device."

I realize this was a benefit, but I always thought the main purpose was for privacy --- not to betray to the email sender when I opened the email. My guess is that Google did not view this as a privacy setting, or they probably would not have forcibly changed everybody's setting.

It's doubly strange that they did so without a notice inside Gmail that they did so -- just a blog post.

danielnr2• 13 years ago

I just ran the same test and can confirm the results. Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts.

I don't use any Google services outside of small tests like this, but it still makes me concerned for how this will affect the privacy of people I know.

finnh2• 13 years ago

"Email open" tracking just got a lot more reliable for all mass email & marketing automation vendors.

On the flip side, those same solutions can no longer set a persistent cookie with the image, so persistent tracking based on the initial email open will stop working.

Too• 13 years ago

Interesting. The fact that they don't even address this aspect of the change in the blog post makes you wonder if this is a deliberate or incompetent move. This should be obvious for anyone who works with email and easy enough to describe in layman terms the blog post. Who is the target group for the blog?

dragonwriter3• 13 years ago

Google will only load your image if you open the email, which means Google has just opted-in all users to mail receipts.

If you didn't have the "ask before displaying external content" option set before this change, you were "opted-in" to read receipts already -- its just that, due to protections designed to stop other malicious use of images, you were incidentally protected against images as the vector for silent read receipts.

With this change, you are better protected against the malicious uses of images the default-not-to-display option was designed to protect against, but exposed to external images as a vector for read receipts if you hadn't chosen to display external content only after confirmation. If you did choose that previously, then you also got the new "ask before displaying external images" chosen by default -- so if you were protected from senders injecting read receipts before, you still are now. If you weren't before, you aren't now, but then that's not really a change.

anonsumus3• 13 years ago

I don’t think you quite understand the changes here, no "read receipts" are sent, any analytics sent only point to the Google proxy processing the images, no individual recipients nor their actions are revealed.

See how marketers are scrambling to adjust to this change:

a.) Gmail is now requesting all images from proxy servers (googleusercontent.com), which incorrectly situates users in its headquarters in Mountain View, California when images are downloaded. This impacts the ability to geo-target image content for those Gmail users who are affected by the changes. (Note: Local Maps using zip codes appended as query parameters are unaffected.)

b.) Gmail is stripping the user-agent headers from the client request, which eliminates the ability to determine the Gmail user’s device and target image content appropriately.

c.) Gmail is removing the cache-control headers from the responses, which forces the user’s images to be stored in their browser’s cache for up to a day. This only impacts live image content if a Gmail user re-opens the email after the first open.

...

http://blog.movableink.com/gmails-recent-image-handling-chan...

Basically their only avenue for now is mobile email which will soon follow in adopting this method.

finnh2• 13 years ago

OP was using "read receipts" colloquially, to include "tracking images with a unique code embedded in them".

And, as such, OP's claims are exactly correct.

The only way this would not be true is if GMail pulled every image in every email, even if it's not read by the recipient. Given GMail's usage of the term "proxy server" in their blog post, as well as the tests by the OP and others on this thread, this appears not to be the case.

seanalltogether• 13 years ago

I don't understand how a proxy will protect me from an image loaded as

http://marketer.com/4b3403665fea6.jpg

where that hash is used to link to my email address

yajoe• 13 years ago

It's also weird that they didn't explain the how behind this line:

Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers.

In most cases, the unique identifiers are embedded in the URLs themselves, so simply serving through a proxy is ineffective. Should I blindly trust that you, Google, did the right thing?

Edit: looks like Google isn't stripping out the query parameters AND it isn't proxying for iOS devices! This is by far the least effective set of decisions... http://blog.movableink.com/gmails-recent-image-handling-chan...

I wonder if this change is a result of backlash over the promotions tab. These type of referenced images are most commonly used in marketing campaigns and were from businesses likely to pay good money to AdWords. As a concession for fewer overall impressions, perhaps, these groups got Google to let them track easier? The whole thing smells fishy.

mtrimpe3• 13 years ago

They'll probably retrieve and cache every image as soon as the email is received which would effectively render open statistics meaningless for GMail addresses.

ToastyMallows• 13 years ago

Update: I'm not sure when this feature will actually be rolled out.

FTA: This new improvement will be rolling out on desktop starting today and to your Gmail mobile apps in early 2014.

ChuckMcM3• 13 years ago

I appreciated the lack of pictures of large penises that accompanied spam. And of course the fact that you didn't get a tracking pixel fetched. So I wonder if they are going to fetch the image from their servers, cache it, and then show it. Cutting off a supply of information for email marketers, whom they will offer to supply 'opening' information for people who use the new Gmail Promotions feature. (ok that is a lot cynical)

cglace2• 13 years ago

There is still a way to track opens for images but it is now impossible to detect device and location.

swedegeek2• 13 years ago

Yea, it's hard to not think this is ultimately not a great move. It seems rather shortsighted from a Gmail user's perspective if Google can't address concerns over spammers being able to verify email addresses, or even just analytic trackers. It is also vastly less appealing to hear that Google plans to cache all images, which we know Big Brother is grabbing as well. And in the case where someone may want to actually see images for a marketing email (albeit, extremely rare for me), it actually hamstrings the source of the email from possibly providing customized images/content based on geolocation/browser/etc. that I could be interested in seeing.

So, what's the upside vs. just having the option to display images as desired and NOT have Google cache them?

maxerickson2• 13 years ago

Aren't verified email addresses a relic of the past? Does anybody actually get anything other than nonsense spam anymore?

swedegeek2• 13 years ago

That feels a bit like the "I have nothing to hide argument." Should we just accept that probably spammers no longer send address verifying emails, and tacitly approve this change helping them out if they do? Ultimately, the default should be to let people decide for themselves to opt in to something like this. Forcing this with some pretty big head scratching holes in the benefits seems rather evil.

tehwebguy2• 13 years ago

Protect me from images? That is not why I used this feature.

I used it so that images like /verifyRealEmail.php?email=$myaddress wouldn't work.

macspoofing2• 13 years ago

If the gmail proxy caches every image that is sent to a gmail address, then this bad for spammers, and good for everyone else. That's one less mechanism to verify valid (or active) email address.

tehwebguy2• 13 years ago

I wonder if Google will access an image URL in an email sent to a nonexistent address

natch2• 13 years ago

Seems it's being rolled out in a sloppy fashion. In my Gmail account, images in email have suddenly stopped working. There is still a "display images" button, and when I click it, the images do not load. When I attempt to open an image link from the email message in another tab, I get a 404 error on Google's proxy server, with a super long URL.

antr2• 13 years ago

    "Google’s own secure proxy servers"

will that mean that people who track me opening their email with 1px images won't be able to track that? I hope this is the case...

prezjordan• 13 years ago

Sure looks like it. I wonder how analytics companies feel about this. It's important to know how many people are opening your emails.

antr2• 13 years ago

I guess the compromise is giving the user the option to choose: (i) I would like to be tracked, (ii) I don't want to be tracked. I genuinly dislike people who send me personal/work emails with tracking mechanisms...

timdorr2• 13 years ago

The request is still made (now via a proxy), so email opens can still be tracked. But other identifiable information (IP, user agent, etc) can't.

pyalot2• 13 years ago

And since images are now no longer proxied, that's the end to this "email DRM" sillyness. Good riddance.

taggartbg• 13 years ago

Does this mean that every image will be saved onto Google's proxy server at the time that Google receives it, or at the time that the user opens it?

I don't want to lose the ability to track email opens to gmail users through Mandrill/SendGrid/whatever...

nfoz• 13 years ago

I sure want you to lose that ability.

It's crazy that email clients ever provided that vulnerability in the first place.

roshodgekiss• 13 years ago

Many ESPs already have a workaround in place for ensuring that open % stats are not affected. Here's Campaign Monitor's take on the issue: http://www.campaignmonitor.com/blog/post/4118/how-gmails-ima...

Also, a postmaster's version: http://emailexpert.org/gmail-tracking-changes-the-fix-what-y...

Disclosure that I'm from Campaign Monitor and wrote that first post. As you can imagine, we've been getting a fair few enquiries about image tracking and opens today...!

alooPotato3• 13 years ago

This proxying actually rolled out on December 3rd to most gmail.com users. We, Streak, happenned to launch an email tracking feature on the same day (http://www.streak.com/email-tracking-in-gmail).

Here's what we've learned:

- the proxying of requests only happens when a user is viewing the mail inside Gmail (i.e. gmail does not actually affect the message body, its just proxying at render time)

- gmail only caches in the image for a few minutes. So for email marketers, if your recipient views the email then views it again a few hours later, the marketer will see two requests for the image

- there is basically no personally identifiable information in the request that Google's proxy sends to the server hosting the image. So from that perspective this is actually a boost in privacy than the previous state of the world. None of the headers, cache controls, cookies, ip addresses, referrers or user agents are passed to the original image server

- obviously you can encode some ID into the image URL itself but all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email - so again, no PII gets disclosed

- it is true that marketers will see a more accurate count of opens (because displaying images is on by default)

- there seems to be several ways to get gmail's proxy to NOT cache the image and simply proxy the request every time the user opens the emails

thedufer4• 13 years ago

obviously you can encode some ID into the image URL itself but all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email - so again, no PII gets disclosed

All that lets you do is...confirm that the email address exists. Until this change, that was a very difficult thing to do; now, its equivalent to getting a message through a spam filter. This is going to help spammers _a lot_.

lallysingh• 13 years ago

gmail already bounces email to nonexistant addresses.

alooPotato3• 13 years ago

It wasn't very difficult to do - in our testing, approx 60% of emails we sent out had images requested for them meaning users clicked on the display images link. May be us nerds dont do it but regular users seem more likely to.

timdorr2• 13 years ago

there seems to be several ways to get gmail's proxy to NOT cache the image and simply proxy the request every time the user opens the emails

What are those ways?

PavlovsCat• 13 years ago

all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email

You just have an email address. Once that image is downloaded, you know it's active the sky basically falls down.

stephenhuey• 13 years ago

Thanks for the information! So if you want to display a dynamic image containing real-time information when the recipient opens the email, it will still work since Gmail only caches the image for a short time, right?

alooPotato3• 13 years ago

Depends what you want to base the dynamic information on. If you want it to be time based, I.e the current t stock price then that should still be possible. But say you want it to be based on user location, like the weather in the users location then that won't work because you won't have the users original IP address so you won't be able to roughly detect their location.

chimeracoder• 13 years ago

- obviously you can encode some ID into the image URL itself but all that lets you do is identify the email address of the user that opened the email. But you already had their email address because you sent them an email - so again, no PII gets disclosed

This functions as a read receipt (like the tracking pixels).

The image might be cached later, but since it is initially loaded the first time an email with it is is opened, this means that implementing read receipts on all outgoing emails is as simple as making the URL for each image unique to the user.

Thus, the marketer knows:

1) That the email was opened 2) When the email was opened

along with whatever information they already have about the user.

This is a HUGE privacy implication. Even if "no [further] PII gets disclosed", it discloses a lot of information that is both sensitive and easy for marketers to join with existing identifying information.

mason55• 13 years ago

I would not say that "no PII gets disclosed".

And I would say you don't know what PII means.

You might consider this to be a violation of privacy but you're not disclosing any PII that the sender didn't already have. And in fact it's decreasing the amount of PII that's being disclosed because you're not longer sending any browser information when the image is loaded.

dsaber• 13 years ago

I think that's a great feature. Loading images manually is always annoying and isn't a great user experience. Novice user's don't always understand why it's risky and they probably opt to display the images anyways.

However, one interesting question is how can third-party analytics will workaround this? Is there a way? Given that gmail holds a large market share of email users, this is really going to negatively affect the usefulness of such services.

skloubkov• 13 years ago

Seems like a privacy hole.

Mailer can setup url that is composed of random words and is unique per email.

Ex: www.tracker.com/weather-dog-city-nice.jpg could identify you + timestamp of request and bam, you have record of: valid email, address isn't blocked and that user reads emails from recipient. No proxy in a world would be able to make this request anonymous.

No idea what advantage of this is apart from google eventually offering an alternative to gmail (think of comment system being replaced on youtube)

Pirate-of-SV• 13 years ago

So it's going to break https://emailprivacytester.com/ by default?

Aldo_MX2• 13 years ago

This is relevant for email marketers:

  In some cases, senders may be able to know whether an individual has opened
  a message with unique image links. As always, Gmail scans every message for
  suspicious content and if Gmail considers a sender or message potentially
  suspicious, images won’t be displayed and you’ll be asked whether you want
  to see the images.

https://support.google.com/mail/answer/145919

pdknsk• 13 years ago

I wonder if Google will eventually PageSpeed the images and advertise it as a feature. "Mails load faster with Google Mail!".

mike-cardwell• 13 years ago

Just tried this out with https://emailprivacytester.com/ - The proxy request only happened when I viewed the email. It came from 66.249.88.50 (google-proxy-66-249-88-50.google.com) and had the User-Agent:

Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 (via ggpht.com)

I viewed the email using Firefox 26 on Debian.

duaneb• 13 years ago

Just because it's through a proxy doesn't mean identifying information can't be embedded in the URL.... This is used as a "customer read email" callback.

forgotAgain• 13 years ago

In some cases, senders may be able to know whether an individual has opened a message with unique image links.

From https://support.google.com/mail/answer/145919?p=display_imag...

Images Now Showing in Gmail

Related Stories