Hacker News new | ask | show | jobs
by zwaps 1911 days ago
I receive a lot of newsletters and communiqués, some of which I even signed up for.

So, I don't know what designers use to receive e-mail, but here in the non-designer / non-linux world, Outlook is pretty popular. Now, Outlook - at least all configurations I have seen, has pictures via HTML disabled. I have sampled a few IT departments only, of course, but I feel like this is probably a pretty common policy.

So let me tell you:

Your picture banners, your "rounded corner buttons", your main engagement centerpiece that's just a picture ... it all ends up being one of those nice 90's type beveled empty box we remember from surfing with IE and ISDN.

This may be a shock, but it really doesn't make your important newsletter look any better. So, if you are not specifically going for nostalgic "bad modem connection" look and feel, maybe ease off the HTML pictures a bit, okay?

8 comments

To be precise: it is not like pictures are disable, but instead 'external resources' are disabled. So if you embed the picture into the e-mail it will be shown. For small pictures that is quite reasonable.
Ding ding ding. As a sender, the upside is that virtually all GUI users will see the images without prompts or placeholders; the downside is that you don't get a read receipt. As a (GUI user) recipient, the upside is that you will see the images without prompts or placeholders while preserving your privacy; the downside is that you hit your storage quota way sooner.

Technically, embedded images are a lot like attachments, but mail clients are smart enough not to display the little has-attachment paper clip download widget because the MIME headers for the image will say "Content-disposition: inline" instead of "Content-disposition: attachment". Then the HTML img element references it using the cid: scheme instead of the https: scheme or similar. Anyway, the experience is great.

I suspect Mail Studio doesn't offer this because its MO is that "Designs are exported as standard HTML and can be imported in your email marketing platform of choice." This embedded image technique would require that Mail Studio export (or send) the entire multipart MIME message, not just the HTML part.

People who use gmail/gsuite get html emails, the images are proxied by google. People using gmail are a huge chunk of the market.
I did not know that images get proxied. Either way, I use gmail with images turned off by default and I rarely enable images for specific senders.
Interesting. I've always thought that images within emails would also serve as a read receipt to the server that sent them when enabled or shown. Would this still apply? Google providing a proxy for this could totally pollute this data (which could be a good thing!).
> I've always thought that images within emails would also serve as a read receipt to the server that sent them when enabled or shown

Yes, that's exactly what happens. Proxying the image only hides the user's IP address. If the images in the email load from external resources like https://example.com/fetch-resource?id=something_unique GMail has no way of knowing if something_unique uniquely identifies a user.

This is why disabling images is helpful. Of course Gmail also lets you enable images per sender, and you may find that quite acceptable for sites you have a relationship with (e.g. a shopping site which already knows your IP address and is sending you delivery notifications).

My understanding is that is exactly why Google provides a proxy for that.
Last time I checked Google is proxying the external ressources right in the moment when the email is opened, so it just protects the IP address.
Someone tested [0] and the result agrees with you. And this Gmail help article [1] elaborates on the scope of protection, which is equivalent to "IP address and HTTP headers":

> Google scans images for signs of suspicious content before you receive them.

> These scans make images safer because:

> - Senders can’t use image loading to get information about your computer or location.

> - Senders can't use the image to set or read cookies in your browser.

> - Gmail checks the images for known harmful software. Sometimes, senders may know whether you've opened an email that has an image. Gmail scans every message for suspicious content. If Gmail thinks that a sender or message is suspicious, images aren’t shown and you’ll be asked if you want to see the images.".

###

Personally, I think this is quite silly, because I routinely disclose my IP address and HTTP headers without considering it particularly sensitive, but I don't want senders to know that their their email messages have been opened.

[0] https://blog.filippo.io/how-the-new-gmail-image-proxy-works-...

[1] https://support.google.com/mail/answer/145919?hl=en-GB

Wouldn't this image rewriting mess with e-mail signing?
Yeah most companies don't care about the IP they care that the email was opened by the target/victim and that's what happens even with proxied images.
Google proxies the requests, and makes one (and only one) upstream request. This prevents subsequent 'pings' if the user opens the email again later.
I always assumed this was intentionally done this way so that people click the “display external content” warning and inadvertently activate the tracking pixels.
IIRC, that was the exact argument for disabling image loading when it was first introduced.

The responsible thing for services like gmail and o365 to do would be to eat the resource costs and just open ALL external content within a privacy sandbox, thereby polluting the data. Then you can re-enable displaying of images for everyone and the experience for designers and end users gets better.

Gmail does exactly that, I believe? It proxies the external resources to hide your IP.

What it can’t do sadly is strip out tracking functions (unique IDs and such). Dunno how that could even be solved tbh

Gmail proxies the images when you open the email.

What the parent is suggesting is for Gmail to download the images as soon as the server receives the email, thereby rendering any tracking data meaningless.

Earlier in my career I decided to go around this by rendering photos in HTML Tables!

http://azimi.me/img2html/

Last time I check Outlook for Windows had 4% popularity among our customers and Word as render engine. Actually everything broke what other standard mail clients could handle. We had to make a lot of idiot changes because of Outlook in the content. We still have sometimes issues but if the rendering brakes we don't treat Outlook errors as blockers anymore.
Outlook is probably the most common desktop client, but I think most people (even in corporate settings) are using webmail these days; either Google Apps Suite or Office 365. The former at least displays images by default (Google re-hosts them and rewrites the email source). Not sure if MS does the same.
Outlook for Web does have something similar now they call "Outlook service" that loads images through the service under their Privacy and data settings. I think it defaults to "Always use" and the alternative is "Don't use." It sounds like it definitely protects your home IP address from being exposed, it might not prevent a tracking pixel working as read receipt if it doesn't fetch the image until you open the message.

My messages still don't load remote images and are topped with "Some content in this message has been blocked because the sender isn't in your Safe senders list" followed by a link to add the sender's address to the trusted list and another link to show blocked content in this particular message.

I have Apple's Mail desktop and mobile apps set to not load remote content but I think the default is for them to load.

> Since determining the client in which an email is opened requires images to be displayed, the data for some email clients and mobile devices might be over- or under-represented due to automatic image blocking.

I wager Outlook users are less likely to have remote images enabled

It probably depends on the industry.

Some of the biggest companies in Europe use Outlook the desktop client, with said external resources disabled.

May differ in technically more advanced countries, of course.

Webmail is actually better thN the desktop client, but I have to remember to keep it in the background.

A desktop client with a thin wrapper around the websinterface would be best.

In the many companies I've seen in Germany not a single person used outlook OWA except for when outlook had problems starting up..
This. Plus if you pay for stuff like mobile data and receive dozens of emails a day on your phone, these high MB emails add up. Less bloat means more money saved for me at least.
Here we have a newsletter which is wholly one big raster screenshot without any fancy html and no trace of text.
Heh, I get those.

It comes to me as an empty bevel box and an unsubscribe link.

That’s what I call succinct!