Slightly related, but fraudsters love using .svg attachments, typically the mails purport to be for an invoice which you need to log into your Microsoft account to be able to “securely” view.
I’m not sure if Exchange Online doesn’t scan them or something, but I landed up making a rule which blocks all emails with either .svg or .htm(l) attachments and to notify me when blocked.
Happens a couple of times per month for the our small company, no false positives yet.
smelendez 16 minutes ago [-]
I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so.
Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
mmh0000 13 minutes ago [-]
Some of the big providers already do this, notably Apple and Gmail:
I think this is what icloud does. Seems like an easy way to make tracking useless if every client did it.
Galanwe 50 minutes ago [-]
Nice catch!
I am trying to read as less _online_ as possible nowadays. I essentially have dovecot in my crontab, and read it off roundcube. It's been working great, RoundCube is dead simple to setup and use, the UI and search are very fast.
stragies 31 minutes ago [-]
Hmm, I wonder, if roundcube was the exception (w.r.t feImage), or if soon other webmail clients will need to be patched
nullcathedral 10 minutes ago [-]
Author here! I have looked at Thunderbird. I'll go and look at some others as well, should have probably done that earlier.
Rendered at 19:45:13 GMT+0000 (Coordinated Universal Time) with Vercel.
I’m not sure if Exchange Online doesn’t scan them or something, but I landed up making a rule which blocks all emails with either .svg or .htm(l) attachments and to notify me when blocked.
Happens a couple of times per month for the our small company, no false positives yet.
Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
https://www.litmus.com/blog/gmail-prefetching-images
I am trying to read as less _online_ as possible nowadays. I essentially have dovecot in my crontab, and read it off roundcube. It's been working great, RoundCube is dead simple to setup and use, the UI and search are very fast.