Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default:

Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers.

Also, on this page they explain why they think that this is safe:

Some senders try to use externally linked images in harmful ways, but Gmail takes action to ensure that images are loaded safely. Gmail serves all images through Google’s image proxy servers and transcodes them before delivery to protect you in the following ways:

  • Senders can’t use image loading to get information like your IP address or location.
  • Senders can’t set or read cookies in your browser.
  • Gmail checks your images for known viruses or malware.

In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed and you’ll be asked whether you want to see the images.

This appears to be a step in the wrong direction by giving marketers visibility of which messages have been delivered and then opened. Is this a good idea? Google is possibly compromising the privacy of its users for marketeers that are not necessarily customers of Google.

If I use the Email Privacy Tester with the default Gmail options on, I can see that the sender is notified as soon as I open the email on the web. I could see how Google could be clever about this by removing the tracking information from links, but it appears that this is not the case.

For example if Google processes the same message containing <img src="http://www.example.com/img.jpg?trackingId=1234" /> to multiple recipients, but with different trackingIds they could be clever and show the image to users by requesting the URL without the trackingId, which is initially what I thought may be happening. The algorithms would need to be pretty sophisticated to work out which section of the URL was used if it was not in the query string, and to also ensure that the image received was the right one, but this is what Google excel at if you judge them from their search engine.

What are their motivations for exposing user privacy for the ability to view images by default?

  • 1
    Quoting you "In some cases, senders may be able to know whether an individual has opened a message with unique image links." – domen Dec 13 '13 at 9:54
  • ?trackingId=1234 or whatever might be a part that points the user to a different image. While img.jpg normally is the image "name", nothing says that it is the only way to identify which image to serve to the client. – domen Dec 13 '13 at 9:55
  • I alluded to that - Google already have image recognition algorithms in their image search. – SilverlightFox Dec 13 '13 at 9:59
  • At least it shouldn't open up your mail account for Cross Site Request Forgery. If they retrieve the image via proxy, displaying the image won't force your browser to access the original URL and execute it with your identity. – Sebastian_H Dec 13 '13 at 10:15
  • This is one of the reasons why they still let you go back into the settings and turn image loading off again. (That, and bandwidth concerns.) – Moshe Katz Dec 18 '13 at 0:41

Their motivations are to increase the value of their service, based on cost-benefit analysis of the problem space and their solution.

Pros: Better email experience, most threat vectors of loading images defanged.

Cons: Threat vector of identifying read activity ('read receipt' or 'live email detection') via unique images.

Mitigation: Most of the people who would abuse the remaining con are spammers. Google also filters spam, lowering the likelihood you'll be confronted with an email that would benefit from this new system. Also, as long as they provide opt-out, they cover people like (presumably) you who aren't happy with the tradeoff.

Heck, this is Google. They could load and cache every image from every email upon arrival, negating the remaining con - the attacker finds that every image is loaded, without regard to the status of the inbox or the reader's interest. Sure, it would take bandwidth and disk, but see step 1, "this is Google."

  • 2
    Yes, if they requested every image (even image links sent to non existent addresses) that would be a good way to put a stop to all email tracking. – SilverlightFox Dec 13 '13 at 13:43
  • +1, for saving me from saying exactly the same things. – Behrooz Dec 13 '13 at 21:58
  • 1
    A serious Con from the OP needs to be added to the list: real-time image loading by default provides timestamped read receipts, which is a definite privacy problem, not just for spam. – pseudon Dec 14 '13 at 16:05
  • That's actually the same exact con, but it is two different ways of looking at it. I've updated the answer to try and describe this better, thank you. – gowenfawr Dec 14 '13 at 23:19

No this changes privacy behaviour in an unexpected way.

There are two changes they have made:

  • Images are loaded using a proxy. This is good for privacy.
  • Images are loaded by default. This is bad for privacy.

I understand that this behaviour is configurable. I will be loading images by default; I am happy that this is a good usability/privacy trade-off for me. But people's needs differ, and I think it is a bad change that they are enabling this by default. The previous mechanism of needing to manually load images seems to be quite widely understood, even among less technical people.

  • 6
    We must meet different non-technical people; the ones I meet are usually puzzled why they need to click an extra button to see images, or think it's about bandwidth if they've been on the Internet for long enough. – Gilles Dec 13 '13 at 13:26

If Google would try to remove tracking information from links, it's very easy to counter that trick for people who write Newsletter delivery software. They could just set up their servers in a way that gives every image request a unique ID.

The motivation for displaying images by default is pretty clear. It increases usability. Most users want to see images getting displayed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.