I've started using Sidekick to know when an email is opened or one of the links in it is clicked. What I ask now is how to know if an email I received is provided with a similar tracking system.

With Sidekick, every link is changed (to something like www.sidekick.com/abcdefg123), so that's the easy point. The difficult (to me) one is the tracking one. What is more, is it possible to know an email is being tracked before you open it?

  • 4
    The better class of email client will not automatically download email images (web bugs) or run any scripts precisely to avoid this level of tracking. – LateralFractal Oct 14 '14 at 14:00
  • @LateralFractal , could you add some examples? I use Gmail... Anyway, you say in that emails there is some hidden image I can find once opened? – Andrestand Oct 14 '14 at 15:21
  • 1
    Gmail enabled auto-downloading for some images some time ago. If it trust sender, it downloads image. But you can still disable it. Go Settings -> Main tab -> Images section. You'll see option forcing gmail to ask you before any image download – zxcat Oct 15 '14 at 10:52

How it works: Picture a pipe. The pipe has a huge variety of valves and possible turns (blocked off by more valves), and information flows to and from a variety of points. The pipe is the internet, and, in some cases, your e-mail providers. Your spy is trying to get you to open a valve to a point HE controls so he can tell when you read his e-mail, so he exploits the system. When most users would send something like "here, look at picture x (picture x file)!"* Your attacker sends "here, come and get picture x so you can look at it (link to picture x)!"** To get picture x, you have to open the valves to your attacker's 'point.' When you do that, he knows that you read the e-mail, but he can also determine where you are (your IP, and from that, your physical location), your OS, and your browser. An attacker might make the entirety of his e-mail picture x, in which case he can change the e-mail even after he sends it.

So, how would you stop this? Well, not easily. If you know who your attacker is, it's an easy matter to block content from his IP or web address, but most web-based clients download pictures automatically, and you can't scan e-mails that aren't ON your computer. I like @LateralFractal's idea of rendering only plaintext, if your provider offers it. Basically, for web-based e-mail, it all comes down to "what does your e-mail provider do to stop this?" Usually, the answer is "not too much." Sorry.

Of course, your attacker could also send you something like "COMMUNITY ALERT: HAVE YOU SEEN THIS PERSON? THE POLICE ARE OFFERING A $5000 REWARD FOR HIM. SEE HIS MUG SHOTS HERE: www.badwebsite.com". Then, by clicking on the link, you open up the pipe to the spy without his having to do any work at all!

*all this results in is you seeing picture x, all of the "words" are parsed by the e-mail client and turned into something readable

**still results in you seeing picture x

  • Can you point e-mail client, which don't filter IFRAME in e-mail? Usually images used for tracking. Because iframes, scripts and other dangerous stuff filtered by all mature email clients and email web-interfaces – zxcat Oct 15 '14 at 10:41
  • @zxcat I have to admit that I'm not an HTML expert, but I have sent e-mails that work on similar principals (using tools written by others) to Yahoo, Gmail, hotmail, etc. – KnightOfNi Oct 15 '14 at 22:22

You can't necessarily know if an email you receive is designed to be tracked but as tracking is limited to certain techniques, you can infer a higher probability of this behaviour if the email seems tailored towards such an end:

Email includes images that need to be downloaded remotely

Typically an email can have all images and formatting stored internally inside a multipart mime type container. So if an email doesn't do this and refers to external images that your email client must download then this might be an email with a web bug in it.

A web bug is any remote resource that the email client is encouraged to download for displaying the email; such that downloading it proves that the email was opened by the recipient. These can be 1x1 transparent GIFs that have a unique URL, such as http://spy.server/email-1234567890abcdefg.gif

Good desktop email clients will not download external images automatically without your permission to avoid this privacy risk. Webmail services may not provide this feature.

Email lacks some or all of its pertinent information, requiring online access

This isn't necessarily a bad thing, as banks will require you to login to their website to discourage phishing. But any hyperlink in an email can be used to track you if you click on it.

You may not know that an email is being tracked before you open the email unless your email client has fancy anti-malware features. The simplest approach is to set your email client to only render emails as plaintext. This gives you the opportunity to decide if the email looks legit and whether you trust the sender sufficiently to switch to HTML rendering on an as-needed basis.

  • This is a great answer! I'd delete mine to get this one accepted, but apparently I can't. – KnightOfNi Oct 21 '14 at 23:55
  • @KnightOfNi That's ok. Answers float up or down naturally. Once questions have been around awhile, I find about 20% of them have answers scored out of alignment with their initial acceptance. After all, the tick mark simply means the answer was useful (or the only one available) to the original poster rather than future visitors. If you deleted your answer you couldn't get votes on it. – LateralFractal Oct 22 '14 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.