Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

   The joy of Streak, and the fact that they work remotely, 
   is that I could see them forwarding my email to each other.

   You’ll see in the map below that it was opened in multiple 
   locations, multiple times.

   It’s like sending a text to someone you’re interested in 
   after a date, and knowing that they’re talking to their 
   friends about how to respond. They’re interested.
 
   This doesn’t always work obviously, but it gave me a ton of 
   confidence in the moment.
Interesting... Tracking people opening your app. I assume this tracking using a hidden image in the email?


"hidden images" don't work with most clients. I guess it was some link with a token they were clicking.


See [1] for a description of how the tracking works - scroll down to "So how does that tracking work?". It appears to use embedded links to message-specific 0-by-0 pixel remote images.

[1] http://www.ghacks.net/2014/02/22/can-streak-really-track-gma...


"Whenever a user opens the email without proper protection" is the caveat here.


Someone posted a site they'd built recently that would send you an email with all the nasty tracking tricks in them, and let you see which your client fell for. I was sad to see gmail choked on most of it.


Make sure to check that the IP addresses are yours. Gmail loads images to their own servers and then serves them to your Gmail UI from there, so trackers shouldn't get your actual IP.


I just tested gmail with emailprivacytester and it didn't fall for any of them (and only fell for the image tags when I clicked a button to allow images in the e-mail to be displayed) so they may have beefed things up in response to that site


Well, I am very happy to see that OS X's Mail.app with remote content disabled does not trigger a single one of them.


I wrote a blog post about this for iOS apps: https://dannysu.com/2015/12/11/best-ios-email-apps-for-priva...

If you're on mobile, basically majority of the apps out there suck at this.

You need to turn image loading off by default and then Gmail, built-in Mail, and FastMail are the only ones that pass.


No need to feel sad. People who use Gmail likely aren't concerned about privacy anyway.


If anyone can identify the site peteretep mentions, eternal gratitude: I want to test it.



Didn't google started to host copies of images referenced in gmail a while back though? This should make this method useless for a lot of email addresses.


What about non-hidden images with a token?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: