0

After a recent upgrade, eM Client started showing me avatars for e-mail senders (including senders of spam messages). On their blog eM says:

eM Client now automatically downloads and displays avatars for your contacts from the web. We download from Gravatar, domain icons and more.

Can a spammer use a Gravatar, domain icon, (or "more") as a read receipt to track me?

1 Answer 1

1

In short, I doubt it. I realize that's not a great answer in itself so here's a breakdown of my thought process.

This sort of tactic usually requires a 'unique' resource. For example a tried and true tactic is to embed a link to a 1 pixel image with a unique name/url in a message. If the image gets downloaded later then you know they opened the message. The key is it's one-to-one.

I haven't used Gravatar before but from what I'm seeing it looks more like a many-to-one relation (many users downloading one image). I don't know what kind of tracking data Gravatar may make available to it's users but I imagine at best (worst?) it would contain the IP addresses of where it was downloaded from. Even assuming the user does have access to that data (which I seriously doubt) I can't think of any way that by itself could be used to correlate a users email.

(Though now that I think about it Gravatar itself might make an interesting vector for confirming email addresses. Generate random email address, attempt to download Gravatar, if successful email address is (more likely to be) legit. But I digress.)

For someone to pull off this sort of thing with a domain icon would probably require a unique domain for each message...doable but not likely.

As for the 'or more', nobody can really answer that without knowing what the 'or more' is. I looked at the site, found the same post you pasted here and I can't seem to find any more detail than that on the 'or more'.

tldr; Probably not but if it bothers you check your settings, maybe there's one to turn off this default behavior. If there isn't you might try reaching out to the devs and suggest the ability to do so. If you do reach out and they don't seem to be going for the 'security angle' try the 'data angle'. "I don't want it to auto download these images because it's using up my data". Hope that helps.

2
  • Unique domain not necessary. A unique subdomain would suffice. Commented Oct 30, 2017 at 18:22
  • @DanielGrover Ah, good point.
    – user138563
    Commented Nov 6, 2017 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .