Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default:
Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers.
Also, on this page they explain why they think that this is safe:
Some senders try to use externally linked images in harmful ways, but Gmail takes action to ensure that images are loaded safely. Gmail serves all images through Google’s image proxy servers and transcodes them before delivery to protect you in the following ways:
- Senders can’t use image loading to get information like your IP address or location.
- Senders can’t set or read cookies in your browser.
- Gmail checks your images for known viruses or malware.
In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed and you’ll be asked whether you want to see the images.
This appears to be a step in the wrong direction by giving marketers visibility of which messages have been delivered and then opened. Is this a good idea? Google is possibly compromising the privacy of its users for marketeers that are not necessarily customers of Google.
If I use the Email Privacy Tester with the default Gmail options on, I can see that the sender is notified as soon as I open the email on the web. I could see how Google could be clever about this by removing the tracking information from links, but it appears that this is not the case.
For example if Google processes the same message containing <img src="http://www.example.com/img.jpg?trackingId=1234" />
to multiple recipients, but with different trackingId
s they could be clever and show the image to users by requesting the URL without the trackingId
, which is initially what I thought may be happening. The algorithms would need to be pretty sophisticated to work out which section of the URL was used if it was not in the query string, and to also ensure that the image received was the right one, but this is what Google excel at if you judge them from their search engine.
What are their motivations for exposing user privacy for the ability to view images by default?
?trackingId=1234
or whatever might be a part that points the user to a different image. Whileimg.jpg
normally is the image "name", nothing says that it is the only way to identify which image to serve to the client.