Hacker News Reader

Comment by zzyzxd | Hacker News Reader

This is an interesting reading. Although there are more tracking mechanisms than pixels. Surely you can configure your email client to not to load remote content automatically, but most of the clients will still leak information in various html/css elements.

A while ago, I used https://www.emailprivacytester.com/ to test several famous iOS email clients, and most of them more or less leaked _something_, even without loading remote content. In the end, I found Fastmail and Apple's built-in iOS mail client to be the top-notch in terms of privacy (Fastmail leaked nothing but only their server side DNS server via DNS prefetch[1][2], which has nothing to do with client. Apple is slightly worse, but still far better than any other email clients like Outlook, Spark, Edison...)

1. https://www.emailprivacytester.com/testDescription?test=dnsL...

2. https://www.emailprivacytester.com/testDescription?test=dnsA...

View on HN

> Surely you can configure your email client to not to load remote content automatically, but most of the clients will still leak information in various html/css elements.

I believe MailMate does this by default? I've been using MailMate for a little over a year now and I've fallen completely in love with it.

https://freron.com/

Long time user of MailMate and was just about to ask this! I love MailMate for this privacy feature and ability to compose in markdown (P.S. - this is also my first HN comment ever)

> Surely you can configure your email client to not to load remote content automatically

Last time I checked, although I could prevent image loading in Gmail for desktop web browser, I could not do so in the Gmail iOS app.

If you're using Gmail, all hope is lost for not being tracked anyway.

You can still reduce your tracking… even if the companies can still get that information of yours, it's at a slightly higher cost to them.

I don't really see it this way. For many people, the only company of consequence that is tracking them is ultimately Google (and/or Facebook). Trackers that other companies install in their emails or websites are just sending the data back to Google in the end anyway. It's a redundant way for Google to capture information to build a profile of you with, but if you're using Gmail anyway, they don't need the extra tracking, they still get the same information.

That’s not true. Many advertisers and even newsletters try to figure out which of their emails you actually read and when, so they can optimize subject and date/time for better effect - e.g. emoji in subjects on Sunday get better hits with person X, finance data on Thursday evening with person Y.

They used to be able to tell where you were reading it from geoip, but google killed that by proxying all images through their servers as of a few years ago.

There's no setting in the app last time I checked but after this article I swapped on the ask to load pictures on Gmails webinterface and lo and behold now the Gmail iOS app ask me if I want to load pictures.

I probably should have added a disclaimer when posting this:

- "A while ago" is about a year ago. When choosing a new email client, run your own test and don't take my stale test results. emailprivacytester.com is fantastic.

- It is not an apples-to-apples comparison. I used Apple's native client as a pure IMAP client fetching directly from my email server, while I think many other apps want to pre-process your emails on their own server sides so they can providing timely email notifications without eating your smartphone's battery for background activity.

In case anyone is using protonmail and is curious about this: by default only DNS prefetch with the server's IP is leaked. Opting to load remote content leaks the reader's IP when grabbing CSS.

Thunderbird by default.

Turning in html should be an option done only when really needed.

I think it depends on the software's targeting user group. This is okay, and probably the preferred behavior if your users are all tech-savvy. But it is hard to explain to non-technical users why this ugly text email is better than that that email with beautiful pictures, or even what HTML is.

The pictures aren't in the email. The email contains instructions saying “phone Steve and ask for the images, then put them in this gap”, but if your computer follows those instructions then Steve knows when you're reading your emails, and where.

Who is Steve? Nobody knows, but he's in the “knowing who's reading emails and when” business. It's a shady business. Don't let your computer phone Steve.

My email client / provider leaked only DNS prefetch... nothing else... Before I even opened the message! I reckon it was my provider, as the IP address reported was wrong for me.

Thanks. Tried with Postbox on macOS with my e-mail address and nothing gets leaked, unless I enable loading of pictures. This is with HTML e-mail on by default (which is why its surprising to me). FWIW, I prefer HTML e-mail off by default, but I lost that battle some 10 odd years ago when I quit using Mutt.

Reply on news.ycombinator.com