A Clever Way to Tell Which of Your Emails Are Being Tracked

http://www.wired.com/2015/03/ugly-mail/

by Libertatea • 11 years ago

44 68 11 years ago

wired.com

peacefool• 11 years ago

It's not a clever way, it's primitive, and does not monitor many advertising agencies (just 3 of them).

The clever way would be to discover ALL advertisers AND prevent spying on our emails.

mike-cardwell8• 11 years ago

This is where I usually jump in and mention a web app I wrote:

https://emailprivacytester.com/

Sends an email to you which checks to see how much stuff your email client is leaking. Turns out some email clients load remote content even before you click "Load Remote Images"

ojilles• 11 years ago

Wow that's a lot even on just iPhone Mail. This should get more attention!

mike-cardwell8• 11 years ago

I'm pretty sure the iPhone mail client loads images by default. And... I could be wrong, but IIRC it also doesn't even have a way of disabling this. I don't have one to hand to test with though.

aembleton2• 11 years ago

Thank-you. I didn't realise until I tried your tool that gmail is leaking out the fact that I'd opened an email. It runs through a proxy but it is still possible for it to uniquely identify that the email has been opened.

aembleton2• 11 years ago

Just noticed that under Settings > General > Images it is possible to turn off the loading of external images. That fixed it, no longer is it loading the images up.

Majestic121• 11 years ago

On Openmailbox, I have "Message queued. Attempting delivery" even after reading the mail, so I guess it's fine

panarky• 11 years ago

This is really cool, thank you!

It shows that with Gmail, you don't need a browser extension to block pixel trackers.

Gmail does that fine by default, just don't display images in the message.

gcr4• 11 years ago

Really? Gmail easily failed this test with flying colors when I tried it: the second I opened the test email, gmail fetched the 1px tracking image, revealing my User-Agent (but not my IP address, granted) to the server.

How did you configure your gmail settings to pass the test? I don't think I changed the default.

RexRollman• 11 years ago

Nice work Mike.

TheLoneWolfling2• 11 years ago

My university email server seems to silently filter out the emails. Wonderful.

mike-cardwell8• 11 years ago

Yeah, this happens. That's why it says the following on the front page:

"The email sent by this system contains numerous unusual tricks which will probably offend some spam filters. If possible, you may want to whitelist emails from sender addresses matching *@emailprivacytester.com before continuing."

If you don't have that level of control, I'm not sure what you can do about it.

notfoss• 11 years ago

Great app!

For me Thunderbird didn't trigger any test. K-9 Mail triggered the Meta refresh test (but asked me to choose the browser, perhaps because I have multiple browsers installed).

benihana• 11 years ago

Let me save you the trouble of even using the tool:

Yep, every email sent from a company to you for marketing purposes has a beacon and link tracking.

If you're alarmed by this, you should also know that every website you visit can track your IP, your OS and version, and your browser and version.

binxbolling• 11 years ago

I think the real value is in seeing who's tracking that you wouldn't expect. Yes, most know that marketers are tracking the hell out of us, but there may be use cases that many are not aware of.

ryandvm• 11 years ago

Uh... clever? I had to scroll back up and double-check the date to make sure this article wasn't 10 years old.

Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking?

javajosh• 11 years ago

Also, didn't Gmail start caching images on google servers such that tracking can't happen even if you display images? (Of course, google could track you but they already run the client so no big loss there.)

petercooper3• 11 years ago

They started caching images, but since open tracking pixel URLs are unique (after all, that's how they track an individual recipient) and Google only caches the image if you open the mail, essentially you still get tracking. You just don't get to count how many times the email is opened or the length it's opened (a common trick is to leave the connection open to see how long the client keeps the request open).

kazinator• 11 years ago

Is the author not aware that for the last decade or so every email program/service in the world prompts the user to load images to purposely thwart image tracking?

While that is true, people say "yes" because things don't display properly. Often elements like emoticons and whatnot are also remote images!

"Display remote images? Yes/No" is an all or nothing proposition, in other words.

The e-mail client, rather, should determine which images will display in a visible way and reject all others even if the users says Yes. It should not fetch images whose tags don't specify a width or height, or that specify one less than 16x16 pixels, and those that are positioned such that they will be clipped, or clipped by something else, so that even if filled with fetched content, they will not be visible. Basically: calculate the set of image tags that refer to images which will be obviously visible to the user. Prompt for those, and do not fetch the rest regardless of the answer.

jerf• 11 years ago

At least recent versions of Thunderbird do allow domain-by-domain loading.

Of course, the standard user has no idea what that means, how to judge where the email comes from, or what any of the options mean beyond "see the pretty pictures", but, hey, one step at a time.

judk2• 11 years ago

Gmail controls this permission per sender. Nobody savvy enough to read Wired would use a mail system that was broken in the described way.

teaneedz2• 11 years ago

When I checked last, there are some popular email apps that don't provide an option to disable automatic attachment downloading - like Dropbox's Mailbox and Google's Inbox.

wodenokoto• 11 years ago

Doesn't google pre-download all images before hand and serve the user a cached copy?

ArekDymalski3• 11 years ago

"Ugly" "sneaky" "disturbing" "unsettling". The article's author made quite an effort to present a a long-established (and relatively harmless) practice as a horrible thing. What is funny in the era of really disturbing practices in invading our privacy.

mike-cardwell8• 11 years ago

If companies sent letters, which when opened, silently and without your knowledge sent a signal home to tell them that the letter delivered to your house had just been opened, would that be "harmless"?

Personally, I would consider it, ugly, sneaky, disturbing and unsettling. But then it's ok on the Internet because this sort of tracking is easy on the Internet right?

ArekDymalski3• 11 years ago

Let's stretch the analogy a bit further. If the company representative is talking to me face to face and watching my reactions (Do I hear? Do I understand?) is that unsettling? Do people cover their faces when they are in a shop/bank? No, it's a natural part of the communication.

Email is just a form of communication. I believe, ut's not that harmless that someone received the confirmation that his message was opened. Of course things get a bit complicated when someone gets too much information, but simple opening emails/clicking links is something we should accept. When we are walking down the street hundreds of people see us, see what we do. Most people do not have a problem with that. I really can't understand what is so different in case of online activity, despite the fact that we are familiar with other people seeing us in real world and the Interent is still a mentally new territory for us. And this distinction between the off- and online privacy is something what actually can inhibit the development of online society imho.

daddykotex• 11 years ago

Isn't Gmail serving image from it's own proxies acting as a protection against this kind of snooping?

In my understanding, opening the image loads the image from Google servers so it never hits the tracking website...

Am I right?

teej• 11 years ago

This only prevents device and IP information from being broadcasted. The main information the email sender still gets is if the email was opened at all.

mike-cardwell8• 11 years ago

It still leaks whether or not you viewed the email and what time, even if it doesn't leak the IP you came from.

Also of note: Fastmail also uses proxies in this fashion too now.

pyre• 11 years ago

what time

Not necessarily. Does Google cache the image when receiving the email, or when you view it?

de_Selby• 11 years ago

I just installed he extension and it seemed to give a few false alarms. One email chain with just a few acquaintances mailing back and forth was flagged.

corbet• 11 years ago

Weird. HTML message viewing in claws-mail refuses outright to load external images without an explicit request from the user. I have no idea why anybody would want or implement behavior different than that...?

ptaffs• 11 years ago

you do, it's because the big companies who write e-mail clients that the bulk of the population use, the same companies also are involved with advertising. There's no big money behind building a good quality privacy enabling e-mail client, or browser.

rlpb3• 11 years ago

Any email client that permits this to happen automatically is user hostile. I really hope that Gmail doesn't do this by default.

But I use mutt, so I'm not worried. If I really have to read an HTML-only email, I have mutt configured to pass the HTML to links for rendering, but in a way that links runs confined and without access to the Internet (or anything else) in order to do so[1].

It's been a few years now, and I don't feel I've really missed anything by going back to a text-mode email client. By being able to optionally render HTML as text, I can still read the occasional HTML-only email that I need to (for example: order confirmations). The rest of the time, plain text works just fine.

[1] http://www.justgohome.co.uk/blog/2014/02/mailcap-html-apparm...

_lce0• 11 years ago

Gmail isn't doing this by default but Inbox does it -- that's was prevented me from switching.

I guess they "new take on mail" by google is not designed for end-users privacy.

aareet• 11 years ago

Google actually uses an image proxy to thwart tracking based on images.[1]

http://googlesystem.blogspot.ca/2013/12/google-uses-proxy-to...

gcr4• 11 years ago

Are you sure Mutt's not doing this?

I read my mail with Emacs, but according to https://emailprivacytester.com/ , when I click on a message, Emacs parses the HTML and inserts images into the buffer. This is default behavior with the `notmuch` mail reader

EDIT: Chat with dkg on the #notmuch IRC channel shows there's a patch to fix this that isn't in a release quite yet.

My point: Be careful, even if you're using a "dumb" mail client! :)

wampus2• 11 years ago

A typical Mutt configuration relies on the entry for text/html in ~/.mailcap. It's quite common to use lynx for rendering, as in the following:

    text/html; lynx -dump %s; nametemplate=%s.html; copiousoutput

Since lynx doesn't load images, that would be safe from this kind of tracking. But another configuration using a different renderer might allow it.

Furthermore, it is also possible to prefer the plaintext version of an email if there's a choice. From my ~/.muttrc:

    alternative_order text/plain text text/html

I can't remember ever being put out by not being able to read messages that fetch images from the web. Even if I have to open a URL, I do it in Firefox, where I run RequestPolicy.

rlpb3• 11 years ago

I'm sure. Mutt gives me direct control over how it processes MIME attachments with particular content types. I'm using this to make sure that text/html only gets parsed by a confined converter. See my link for details.

rol• 11 years ago

Just gonna hijack this thread to mention that if you use Gnus (the other Emacs mail client) to read your email you can use the variable "gnus-blocked-images" to block any images that match a URL.

Doing

    (setq gnus-blocked-images ".*")

will block all the images in the emails.

I tested it using "https://emailprivacytester.com" and the it picked up only the DNS prefetch link/anchor which I assume are due to my ISP and not Gnus.

omgitstom• 11 years ago

I've always had these assumptions:

If you open an html email, you are being tracked.

If you click on a link in an email, you are being tracked (plain text / html)

Is there any email clients someone can recommend that force plain text in multipart emails? Or convert html emails to be viewed as plain text if the email isn't multipart?

mnw21cam• 11 years ago

Alpine will do this for you. It doesn't suck too badly.

pbhjpbhj• 11 years ago

mutt?

kmail used to be hugely anti html in emails so they may have more options than most for avoiding it.

In thunderbird, which is my current MUA, you can choose View > Message Body As ... > Plaintext and it will display everything it can in plaintext. There's also Simplified HTML and Original HTML as options.

convert html emails to be viewed as plain text if the email isn't multipart? //

Not sure if that's what thunderbird is doing but it appears to be (if I send a HTML-only email to myself the thunderbird will display it as plaintext).

throwawayaway• 11 years ago

as much as i'd like another "don't be evil" "debate" gmail shouldn't work like that.

http://gmailblog.blogspot.ie/2013/12/images-now-showing.html

correct me if I'm wrong, but the tagging support page is for "creative pages" with doubleclick, not emails:

https://support.google.com/dfp_premium/answer/1347585?hl=en

EDIT: ok well, turns out i'm wrong and here's how to turn off automatic image loading

http://now.avg.com/disable-gmail-automatic-image-load/

unusximmortalis• 11 years ago

the simplest (and also spartan) way to protect yourself is to set your email reader to not show pictures. so you read your emails without pictures and then you explicitly allow pictures for those emails you trust (from family, friends, etc.)

"every action IS a reaction"

mrottenkolber• 11 years ago

Specifically, they know when you’ve opened an email sent by one of their clients, where you are, what sort of device you’re on, and whether you’ve clicked a link, all without your awareness or consent.

No they don't, I don't do HTML mail.

makmanalp• 11 years ago

It's "Yesware" - sloppy. This has been done for years and years such that it's pretty much common practice with any service that sends email now. And any half-decent mail client asks you before loading external resources. I guess it'd be nice if they specified why it matters.

A Clever Way to Tell Which of Your Emails Are Being Tracked

Related Stories