Is Gmail showing images by default a good idea for privacy?

Question

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default:

Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers.

Also, on this page they explain why they think that this is safe:

Some senders try to use externally linked images in harmful ways, but Gmail takes action to ensure that images are loaded safely. Gmail serves all images through Google’s image proxy servers and transcodes them before delivery to protect you in the following ways:

• Senders can’t use image loading to get information like your IP address or location.
• Senders can’t set or read cookies in your browser.
• Gmail checks your images for known viruses or malware.

In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed and you’ll be asked whether you want to see the images.

This appears to be a step in the wrong direction by giving marketers visibility of which messages have been delivered and then opened. Is this a good idea? Google is possibly compromising the privacy of its users for marketeers that are not necessarily customers of Google.

If I use the Email Privacy Tester with the default Gmail options on, I can see that the sender is notified as soon as I open the email on the web. I could see how Google could be clever about this by removing the tracking information from links, but it appears that this is not the case.

For example if Google processes the same message containing <img src="http://www.example.com/img.jpg?trackingId=1234" /> to multiple recipients, but with different trackingIds they could be clever and show the image to users by requesting the URL without the trackingId, which is initially what I thought may be happening. The algorithms would need to be pretty sophisticated to work out which section of the URL was used if it was not in the query string, and to also ensure that the image received was the right one, but this is what Google excel at if you judge them from their search engine.

What are their motivations for exposing user privacy for the ability to view images by default?

Answer 1

Their motivations are to increase the value of their service, based on cost-benefit analysis of the problem space and their solution.

Pros: Better email experience, most threat vectors of loading images defanged.

Cons: Threat vector of identifying read activity ('read receipt' or 'live email detection') via unique images.

Mitigation: Most of the people who would abuse the remaining con are spammers. Google also filters spam, lowering the likelihood you'll be confronted with an email that would benefit from this new system. Also, as long as they provide opt-out, they cover people like (presumably) you who aren't happy with the tradeoff.

Heck, this is Google. They could load and cache every image from every email upon arrival, negating the remaining con - the attacker finds that every image is loaded, without regard to the status of the inbox or the reader's interest. Sure, it would take bandwidth and disk, but see step 1, "this is Google."

Answer 2

No this changes privacy behaviour in an unexpected way.

There are two changes they have made:

• Images are loaded using a proxy. This is good for privacy.
• Images are loaded by default. This is bad for privacy.

I understand that this behaviour is configurable. I will be loading images by default; I am happy that this is a good usability/privacy trade-off for me. But people's needs differ, and I think it is a bad change that they are enabling this by default. The previous mechanism of needing to manually load images seems to be quite widely understood, even among less technical people.

Answer 3

If Google would try to remove tracking information from links, it's very easy to counter that trick for people who write Newsletter delivery software. They could just set up their servers in a way that gives every image request a unique ID.

The motivation for displaying images by default is pretty clear. It increases usability. Most users want to see images getting displayed.