12
Dec
Gmail_Icon

You probably see that "Display images below" button in Gmail all the time on both mobile and desktop. This is the default behavior because it makes it harder for spammers and advertisers to track you. However, Google says it has prepared a workaround that mitigates the security concern and will allow it to show those images by default.

Images

When you get an email containing images, the files are loaded from an external host server. Each time you download the images in an email, the sender (read: spammer) can use that to track you. They know firstly that you are a real person and not a broken inbox, but it can also give them an IP address. Google is circumventing this by opening each image in the email, then serving it to you from its proxy servers instead of an external one. This instantly renders image loading data useless to spammers, and makes it safe to show you all your email pics by default.

Google is also going to be scanning for malicious content hidden in images at the same time. So consider this a double win. If you don't like awesome things, you can set Gmail to go back to the old behavior of hiding images by default.

[Gmail Blog, +Gmail]

Ryan Whitwam
Ryan is a tech/science writer, skeptic, lover of all things electronic, and Android fan. In his spare time he reads golden-age sci-fi and sleeps, but rarely at the same time. His wife tolerates him as few would.

  • Emilio

    Um, but the spammers still get to know the inbox exists :/ How is this a win?

    • spacekobra

      Not entirely.
      If 1000 emails they send all report the same IP it's useless to them. They have no way to get any data from you.

      • Floflo

        They can know which e-mail addresses work and are used by someone if they add a unique parameter to the image URL in the e-mail.

        • spacekobra

          I don't think spammers send out emails to random emails waiting for ones that work.

          • bozzykid

            Actually they do. That is why they embed user specific urls to images. It let's them harvest emails without getting a response.

          • spacekobra

            Okay, and the odds of them getting your email are still insanely high. Plus we still don't know how google does this.
            Do they proxy first or as you open the email?
            If its the latter then no change.

          • http://www.jaxidian.org/update teh Jax

            I agree with BozzyKid and have plenty of spam ending up at catch-all addresses to prove it. Odds of them getting my email address? If they have a list of twitter handles (really, how hard is that?), then they have a great source to use to start guessing gmail addresses. (I'm assuming you meant "aren't insanely high")

          • spacekobra

            But they know if its a valid email just by the email sending. All you're doing is spreading FUD.

          • Scott

            You must not have ever set up or maintain an email system then or you would know that actually happens.

          • spacekobra

            We aren't talking about your email systems. We are talking about gmail.
            If this is really that much of an issue then turn it off for your email.

          • Scott

            I'm talking about you saying that you don't think spammers just send spam to random email addresses hoping they're valid. I'm saying they do just that. Which happens to all email systems...including Gmail.

          • spacekobra

            Well I never claimed expertise so I'll take your word for it.

        • didibus

          Well, they can already know if the email exists, if they don't receive a delivery failed error. But I don't see how they would know if the email is actively used. I understood it as Google downloads the images beforehand, so I expect Gmail to fetch the images even for inactive email accounts.

      • http://www.jaxidian.org/update teh Jax

        It's not just about tracking your IP but also tracking your email address as being valid.

        • spacekobra

          If the email sends in the first place it is a valid email.

          • http://www.jaxidian.org/update teh Jax

            I assume you're referencing the "no reciepient at this address" type messages? That's not universal. Many servers refuse to provide such info, and rightly so imho. So many servers will pretend like it wasn't sent even though it was an invalid address.

          • spacekobra

            Gmail sends one.
            We are talking about gmail.

            Besides, I don't think spam networks are based off of computers sending to random recipients in hopes that they work. They get your email from somewhere.

          • xnadax

            They send out A LOT of spam to random addresses. I get hundreds of spam e-mails every day to completely random and nonexistent addresses on my mail server.

      • Sam

        What about all those emails you receive that are from honest companies that use the display stat to give you a better experience?

    • Scott

      Just makes it harder to utilize any data they receive back that's all.

      • http://www.jaxidian.org/update teh Jax

        No it doesn't. It gives them very reliable data on what email addresses are and are not valid.

        • Daniel Smith

          Wrong. You can already detect whether an email address is real or not, it's part of the SMTP protocol.

          Whether it's an active and monitored inbox though is a different story.

          • http://www.jaxidian.org/update teh Jax

            You mean by detecting "no recipient at this address" type messages? That's not universal. Many servers refuse to provide such info, and rightly so imho.

          • Daniel Smith

            You can usually connect to the email provider server and query whether an email to an address would be accepted, most email servers use it except Exchange.

          • CoreRooted

            It's easy to detect valid email addresses from a console into an SMTP session. Per RFC 2821, a server MUST return a 550 status code for mail that is undeliverable.

          • Kesey

            "Many servers refuse to provide such info"

            This article is about GMAIL which does provide this info. What is your point?

    • http://www.jaxidian.org/update teh Jax

      My thoughts exactly! This change *DOES* compromise your privacy! At least there's still the hidden checkbox to keep this feature around while we hope that Google doesn't still pre-load those images for us to "protect us". :-(

      • Andres Schmois

        If your tinfoil hat buzzes when you open up an e-mail, go ahead and disable this feature. You have given zero evidence that this feature is actually bad for you. All the evidence you have given is valid e-mail addresses, which gmail ALREADY has a system for it (if gmail address doesn't exist, you will get a response that tells you address does not exist). If gmail makes this feature available, every single e-mail will be marked as "not dead" making their image tracking useless. Now if someone has this feature off, you're going to be standing out as "dead" even though gmail's default is "not dead" and now they have you as monitored inbox.

        • didibus

          Good point, this will actually make dead emails, those who don't fetch the images, into great target. Not only you know this guy is active, you also know he is a security freak.

          • Andres Schmois

            Don't really like the "security freak" label as we all are these days (with good reason!) but everything else is spot on.

          • didibus

            Haha, well I didn't really mean to be pejorative, more humorous. I just thought that I would have maybe kept this off in my paranoia, and ironically, opened myself as a target even more.

            I try to be as secure as I can. I've turned encryption on on my phone, I install apps I believe have just the right amount of permissions, I don't root my phone because I don't want to open myself up to root exploits, I try and lock my bootloader in between times I feel like messing around with custom roms. But I feel like, it is always the most simple things that leave you open, like social engineering, or just viewing images in an email. I love how Android is designed, I'm sure my PC is full of open holes, apps have so much power over Windows, I hope they eventually add a proper sandbox to it.

    • guitarguy23

      I think they won't know if it's an active account; plus, any malicious virus sent through an image file has already been detected by Google before it hits your inbox. I THINK. :P

    • Daniel Smith

      You can already tell if a Inbox already exist without needing to use images, most email servers will tell you.

    • Jerry Heiselman

      Unless google opens *all* images whether or not they actually end up in an Inbox.

      • Josh Legoza

        Thank you for saying what I was thinking as I read all of the comments. If it's sent to @gmail.com (valid or not), does google go pull the images and put it on their proxy server? If so, spammers don't get valid data, cause every email they send appears to be to an active inbox and all have the same IP.

        • didibus

          I'm guessing so, if not, it only protects from the spammer getting your ip address.

        • Jerry Heiselman

          And, ideally, it would destroy whatever server they are using for the images. I can't imagine many spammers have the infrastructure/bandwidth to tolerate Google making that many requests in such a short amount of time.

    • Steph Chi

      So a no news for you ;-)
      It's about cache : 1 request by a mailbox then the proxy asks for the image for every one concern ... Which tracking then ?

  • Cherokee4Life

    When will this go live?

    • http://benpike.net/ Ben Pike

      From the original Google Blog post: "This new improvement will be rolling out on desktop starting today and to your Gmail mobile apps in early 2014."

  • ginobili1

    Awesomesauce!

  • Bretton Key

    This a step in the right direction, I hope the next wave of updates focus on performance and grouping together messages better may be bring a card feel to mobile messaging.

  • christian

    If they download all images and process them when they arrive, and not when we read them, then its useless data.

    • Karen Davis

      my&nbsproomate's&nbspstep-aunt&nbspΜ­­­­­­а­­­­­­κ­­­­­­℮­­­­­­ѕ&nbsp$­­­­­­­­­70&nbspevery&nbspհ­­­­­­օ­­­­­­υ­­­­­­r&nbspon&nbspthe&nbspі­­­­­­ո­­­­­­τ­­­­­­℮­­­­­­r­­­­­­ո­­­­­­℮­­­­­­τ.&nbspShe&nbsphas&nbspbeen&nbspwithout&nbspW­­­­­­օ­­­­­­r­­­­­­κ&nbspfor&nbspsix&nbspΜ­­­­­­օ­­­­­­ո­­­­­­τ­­­­­­հ­­­­­­ѕ&nbspbut&nbsplast&nbspΜ­­­­­­օ­­­­­­ո­­­­­­τ­­­­­­հ&nbspher&nbsp
      р­­­­­­а­­­У&nbspcheck&nbspwas&nbsp$­­­­­­­­­18984&nbspjust&nbspW­­­­­­օ­­­­­­r­­­­­­κing&nbspon&nbspthe&nbspі­­­­­­ո­­­­­­τ­­­­­­℮­­­­­­r­­­­­­ո­­­­­­℮­­­­­­τ&nbspfor&nbspa&nbspϜ­­­­­­℮­­­­­­W&nbspհ­­­­­­օ­­­­­­υ­­­­­­rs.&nbspRead&nbspmore&nbspon&nbspthis&nbspѕ­­­­­­і­­­­­­τ­­­­­­℮,
      ....Perfect23.Com

      ✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔So consider this a double win. If you don't like awesome things, you can set Gmail to go back to the old behavior of hiding images by default.

    • Fatty Bunter

      These images will be in the noise of useless data. Facebook and Twitter alone all like a firehose of mostly useless data

    • Steph Chi

      Right! Article says proxy with cache.

  • godutch

    This will make it harder for spammers if google downloads all images by default: getting 100% positive feedback is much worse than 0.01% of users inadvertantly opening a message and having the address confirmed

    • Sam

      And harder for honest companies that you've opted in to

      • didibus

        You mean something like MailChimp. Tracking how many people did read your email and not. I guess that is a bummer for them, but I'd consider campaigns like these spam personally. Even email that I subscribe to willingly, I don't see why they need to know if I looked at it or not. I have subscribed, that's the only info I agreed on giving them, not when and where I'm reading their mail from.

        • Raymond Berger

          Yeah, maybe Google could make exceptions for trusted websites?

      • Jeremy Wagner-Kaiser

        I don't see any privacy intrusion into my email inbox as legitimate. Whether it's an "honest" company or not is irrelevant.

        • BigG

          Like Google wasn't reading your emails and serving ads based on it...

          • Aki

            like every other mail services because that works spam filtres.

      • theartofrain

        Don't worry, spammers and marketers will still know if and when you open their emails.

        They just won't know your IP address.

  • David Neylon

    I really don't want images shown by default on my phone unless I'm on wi-fi unless it's something I really want to see.

  • Sam

    A lot of businesses send email and use displayed images in order to deliver better more relevant content to users. I get email from YouTube for instance, are you suggesting that's spam?

  • Mystery Man

    But google will see mah nudez

  • http://www.geekchoice.com/washington-dc Dagmar Schneitz

    Emilio has a point. I'm very skeptical about this.

    • SSDROiD

      Why?

  • anita

    I think its a plus

  • Abhi Kurve

    Somewhere someone is figuring
    out something to complaint about. I mean, someone besides Microsoft. I
    can already see the next Scroogled ad campaign.

    "Did you know Google downloads image attachments through a proxy server so that they
    can better track what images you see and serve ads? By using this,
    you're allowing yourself to be Scroogled harder. Switch to Outlook and
    you can have spammers put you to risk. Spammers, but not Google."
    (A comment by a G+ user)

    • Steph Chi

      Nicely done!

  • Marcell Lévai

    It's already active for me. I was looking forward to having this.

  • Simon Belmont

    Lets hope they bring this to the stock email client, too. I recall reading they may be bringing the stock email client to the Google Play Store soon, so it would be great to see rapid fire updates for stuff like this on it.

    I generally only allow photos for emails that I get from trusted sources. But this is definitely a really nice solution.

  • james kendall

    hum well so much for keeping your data use in check

  • theartofrain

    So, marketers now know when (and if) you opened their email.

    The remaining bits of privacy are being (profitably) sucked out of our lives.

  • theartofrain

    "This instantly renders image loading data useless to spammers"

    How so?

    Spammer's will still know WHO opened their email and WHEN, they just won't get your IP address.

    (I assume that Google proxies will fetch the image when you open the email, and they will use the spammer-supplied URL, connected to your identity, e. g. http://spamsr.us/trackem.jpg?u=ryanwhitmanxmascmapaign -- so the spammers will still get their WHO and WHEN tidbits).

    So spammers will get less data, because they won't have our IP addresses, but they will also get more data, since more people will assume they are safe, and enable the "ah, what the heck, download images for me" gmail setting.

    If Google has any safeguards against this, I would love to hear them say it.

  • taster

    Don't use Yahoo - you can never get your emails - They have no customer care - ever