PixelBlock – Gmail extension that blocks email open tracking(chrome.google.com) |
PixelBlock – Gmail extension that blocks email open tracking(chrome.google.com) |
- Gmail USED to block images unless you do "allow images"
- Gmail changed to a system where gmail pre-fetches the images and runs them through safety checks.
- Gmail only does this check if you open the email.
- Even if you block the pixel, you only block the gmail cache of it. NOT the original.
Unless I misunderstand.
You will find images are NOT retrieved by Google's proxy before or after opening the email when you have external images turned off in Gmail.
1) Ensure Gmail is set to "Ask before displaying external images".
2) Send yourself an HTML email with an img tag pointing to a site you control (doesn't even need to be a real image).
3) Check your server log to see if the img url was retrieved.
4) Open the email in Gmail, but don't click "Display images".
5) Check your server log again.
6) In Gmail click "Display images" and check the server log again.
Only when explicitly clicking "Display images" does GoogleImageProxy fetch the image.
Conclusion - don't install an extension that can spy on everything you do. Just ensure external images are not displayed by default.
This is only true if you allow external images to be displayed by default.
If you set Gmail to ask before displaying external images, then message open detection does not work unless you explicitly tell Gmail to display images on an individual message.
Google changed the default settings, but you can re-enable this behavior.
(I still can't believe Google turned on remote images by default.)
On the other hand it is not very effective as the block list is quite limited. 33 entires if I have counted well.
[1] - Check for yourself - https://gist.github.com/chew-z/7b70da3724626ab04cfc9676bee18...
Several examples are mentioned here: https://www.howtogeek.com/188346/why-browser-extensions-can-...
https://news.ycombinator.com/item?id=6898454
I guess the vector here is when you read an email versus where from / using which device / etc.
var matches = document.querySelectorAll('a[href*="www.google.com/url?q="]');
// remove all google spying redirects
for (var i = 0; i < matches.length; i++)
{
if (/^(https?:\/\/(www\.|encrypted\.)?google\.[^\/]*)?\/?url/.test(matches[i])) {
var match = /[\?&](url|q)=(.+?)&/.exec(matches[i]);
if (match != null) {
matches[i].href = unescape(match[2]);
}
}
}My email based workflow and toolchain has been plaintext only for years and I think I've been better off for it. The recent efail vulnerability just made me shrug. Plain text mail is all around more reliable, more accessible, less obfuscated, more to the point by the nature of the medium, easier to implement [...].
It's Google! I wish I could make you understand but I probably can't.... :(
PS: I have built https://www.mailtag.io/
Your point, in turn, would be that if you never give Gmail permission to load the images for the email sent to you, then Gmail never tries to access that image file that is, by filename, linked to the specific email that was sent to you.
dancablam's point is separately valid. If you think Gmail's image proxying is going to hide your reading (with images) of the email, well, these days not so much, depending upon the design of said email and corresponding tracking.
Maybe Gmail still catches crap/malicious metadata in viewed images, including stuff that can be escalated/elevated by parsing bugs and whatnot. As long as their detection is updated to catch whatever's being thrown at you in a particular email.