Protect user from pixel tracking

[nguyenkims]

Remove tracking in email before forwarding.

Moved from https://trello.com/c/ShR0rTpp/244-protect-user-from-pixel-tracking

[nguyenkims]

We are looking for a way to remove the tracking image (i.e. tracking pixel) without uploading all images contained in an email elsewhere as this clearly affects user privacy. If anyone has an idea, please let us know!

[ph00lt0]

I am a bit split on this. Why not offer it as a feature (opt-in)? Sometimes you want to see the images anyway and if you have to load them manually it snitches when you opened them first, and a lot of users won't understand the implications of this. Something like what apple' privacy relay does can really be beneficial IMO.

What also would really be cool would be a way of circumventing tracking links in emails, they more often are encoded nowadays making it impossible to avoid them. A feature that automatically opens them via a proxy and returns the real URL would really be cool. I can see this leading to issues and understand your concerns, but I think having the option would be cool.

[AedenThomas]

This might help. Also hope SimpleLogin brings a feature to hides the IP address when sending/replying to a mail so senders can’t link it to your other online activity or determine your location. And also it should prevents senders from seeing if and when you’ve opened their email.

[nguyenkims]

Thanks! The article is really good.

[nguyenkims]

As SimpleLogin removes all the headers before sending the email, a contact can't see your IP address.

it should prevents senders from seeing if and when you’ve opened their email.

This isn't easy as resources embedded in an email are loaded when you open the email which can notify the sender.

[AedenThomas]

This isn't easy as resources embedded in an email are loaded when you open the email which can notify the sender.

Apple is doing this with iOS 15. I don't know how they're doing this but I will be testing it with MailTrack.io once iOS 15 releases.

[TheFou]

I came here to suggest this, but I see it was already planned... nice !
It seems DuckDuckGo launched a beta doing exactly this : https://www.spreadprivacy.com/introducing-email-protection-beta/

They don't explain how they do it however... but they clearly state :
"We believe the content of your emails is none of our business, so DuckDuckGo will never save your emails for this service. We don't need to! When we receive an email, we immediately remove trackers from it and then forward it to you, never saving it on our systems. We don’t even save the headers (e.g., to/from). Read more in our Privacy Guarantees."

I just enrolled the waitlist for the beta myself, I'll try it when I get in.

[Vnzq4Qje3zzU]

Is it possible to render all remotes components of the HTML email server-side and inline the blob before forwarding the email? The email URL's would be available for the server to read anyway, so I don't think it's compromising privacy that much. (I would also guess that this is the way DuckDuckGo email does)

[Vnzq4Qje3zzU]

Here is the recent Protonmail approach: https://protonmail.com/support/knowledge-base/email-tracker-protection/. It seems that it will just block the trackers and proxy everything else, and it will still be possible to track when the user opened the email.

For an approach where only selected URL's are blocked/proxied, I found this still maintained repo:
https://github.com/leggett/simplify-trackers, which originated from this list of links blocked by the HEY email company.

It would be interesting to have these options:

1- Do nothing (default)
2- Block few resources and proxy everything else like ProtonMail. It would be possible by creating a new proxy interface like https://proxy.simplelogin.co?url=[originalURL] that will replace every URL in the email. This approach will still leak the timestamps of when the email was opened.
3- Download and inline the content like how I described in previous comment. This would be the most aggressive method.

[Vnzq4Qje3zzU]

This is an interesting read about an attempt to bypass the blockers: https://www.gmass.co/blog/tracking-pixel-blockers/.

It's also worth saying that any attempt with constructing a block list with the patterns of tracking URL's is not perfect - if you just want to know when a friend of yours opened your email, you can simply self-host the remote image and check the request logs in your server.

I'm not very familiar with how the code is organized, but I would guess the easiest way to start implementing this feature is with the proxy idea (2nd idea)? If you want to go for the aggressive 3rd idea later, you will already have some code to detect <img> URL's and some infrastructure to request (possibly) sensitive material in user's place.

The 3rd one requires of a lot of bandwidth and is maybe only available on the premium plan.

Does it really uses more bandwidth? It should use same as the 2nd idea. I wouldn't mind to for it to be a premium feature, though.

** the third idea of inlining the blob, if I wasn't very clear, I mean using the data URI scheme with <img src="data:image/...

[nguyenkims]

I agree that #2 and #3 should be similar bandwidth wise. Not all emails are opened (some people just read the email title and archive/delete the email right away) so #2 should use less bandwidth than #3.

Thanks for the article, it's indeed an interesting read. If email tracking services remove the image width and height, it's going to be difficult to detect whether an image is a tracking pixel without SimpleLogin downloading all images. I guess we can't never achieve a 100% solution and the goal is rather to remove as many tracking pixels as we can.

[Vnzq4Qje3zzU]

More discoveries:

1. Gmail proxies URL's by default since 2013, which means that IP and cookie tracking were never a problem for most of the people.
2. Adblocks are pretty good at blocking tracking pixels, even when is proxied through Google servers, which was a surprise to me because this means that DDG's email protection is not that useful as it seems (you need their official extension to use most of email's features, which will already block the trackers).

The only non-trivial features that can't be achieved with a simple adblock and wasn't solved by any other email services are read receipts (when/if the email was opened) and homemade trackers like I mentioned before (check out how many GitHub repos exists about that), both which are only solved by the 3rd idea.

*** I said about inline using the data URI scheme with base64 encoding, but you should instead add the images as attachments and use the CID format <img src="cid:.... Base64 is not well-supported on multiple email clients and (I think ?) will waste much more bandwidth because of the overhead. The core idea is the same, though.

[nguyenkims]

That's interesting to know that Gmail has been doing this for a while.

Lots of people use non-web email client so removing trackers is still useful for them.

And thanks for the info about CID format.

[shrimprugbysnowowl]

Since SimpleLogin is now partnered with Proton, maybe there's an opportunity to collaborate and more easily provide "Enhanced Tracking Protection" on the SimpleLogin side? Great job, everyone!

[c0nfigurati0n]

Just want too tough on the email headers part. Isn't replace the IP address of the sender in the email headers as simple as turning on a setting in some of the most popular self hosted email server software (or put it how every you like)? The point is, from what i understand it's not that hard to do if you just replace the IP address from the sender with the server IP address.

[nguyenkims]

The issue here is user can leak their IP address when opening an email with trackers when their email client load the images contained in the email. Using the same technique, the sender can also know when someone opens their emails.

[c0nfigurati0n]

Ah okay, thanks for clarifying it to me. But yeah, that's anther way they sure can collect that type of information.

[fredster33]

Just noting that #682 was merged into this discussion :)

[Vardor]

I got here because I wanted to request the same feature :)
Is there any update regarding this?

[emhl]

Protonmail has the ability to remove tracking links/pixels since July 19, 2023 https://proton.me/support/email-tracker-protection are there any plans to build off that to implement this feature without needing to fully reimplement it?