2 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

To follow up on Ramhound's comment on chao-mu's answeranswer, using https links eliminates one attack vector -- someone who has access to the communication between the client's MUA and the server will not be able to see the content of the images.

However, the value of this is somewhat debatable if the image must display without user authentication (which would normally be the case for an email).

Email itself is transmitted over SMTP. Many SMTP links are SSL/TLS encrypted, but not all are. Therefore, if the client's MTA, or another SMTP server along the path, is not configured with SSL and the attacker therefore has access to the plain email, he can simply extract the https links and access them directly to determine the content of the image.

Furthermore, if the email is a "bulk" email, then one can assume that the image links will become "well known" and so any security added by https is effectively moot.

Using S/MIME or OpenPGP would be useful to encrypt the email end-to-end, and would work well in combination with email that includes https image links.

To follow up on Ramhound's comment on chao-mu's answer, using https links eliminates one attack vector -- someone who has access to the communication between the client's MUA and the server will not be able to see the content of the images.

However, the value of this is somewhat debatable if the image must display without user authentication (which would normally be the case for an email).

Email itself is transmitted over SMTP. Many SMTP links are SSL/TLS encrypted, but not all are. Therefore, if the client's MTA, or another SMTP server along the path, is not configured with SSL and the attacker therefore has access to the plain email, he can simply extract the https links and access them directly to determine the content of the image.

Furthermore, if the email is a "bulk" email, then one can assume that the image links will become "well known" and so any security added by https is effectively moot.

Using S/MIME or OpenPGP would be useful to encrypt the email end-to-end, and would work well in combination with email that includes https image links.

To follow up on Ramhound's comment on chao-mu's answer, using https links eliminates one attack vector -- someone who has access to the communication between the client's MUA and the server will not be able to see the content of the images.

However, the value of this is somewhat debatable if the image must display without user authentication (which would normally be the case for an email).

Email itself is transmitted over SMTP. Many SMTP links are SSL/TLS encrypted, but not all are. Therefore, if the client's MTA, or another SMTP server along the path, is not configured with SSL and the attacker therefore has access to the plain email, he can simply extract the https links and access them directly to determine the content of the image.

Furthermore, if the email is a "bulk" email, then one can assume that the image links will become "well known" and so any security added by https is effectively moot.

Using S/MIME or OpenPGP would be useful to encrypt the email end-to-end, and would work well in combination with email that includes https image links.

1
source | link

To follow up on Ramhound's comment on chao-mu's answer, using https links eliminates one attack vector -- someone who has access to the communication between the client's MUA and the server will not be able to see the content of the images.

However, the value of this is somewhat debatable if the image must display without user authentication (which would normally be the case for an email).

Email itself is transmitted over SMTP. Many SMTP links are SSL/TLS encrypted, but not all are. Therefore, if the client's MTA, or another SMTP server along the path, is not configured with SSL and the attacker therefore has access to the plain email, he can simply extract the https links and access them directly to determine the content of the image.

Furthermore, if the email is a "bulk" email, then one can assume that the image links will become "well known" and so any security added by https is effectively moot.

Using S/MIME or OpenPGP would be useful to encrypt the email end-to-end, and would work well in combination with email that includes https image links.