How to protect yourself from email tracking

Email has been round for over 50 years. Back in 1971, what’s broadly considered the primary electronic mail was despatched by Ray Tomlinson as a take a look at of an electronic mail function on Arpanet. Since nobody had informed him what the historic occasion was, he simply despatched it to himself and the content material was one thing like “QWERTYUIOP,” he mentioned in an interview within the late 1990s.

The protocol nonetheless used to ship emails, smtp, has been round since 1981. The commonest protocol for retrieving and managing electronic mail, imap, was launched in 1988. The greatest technical adjustments since then are the addition of encrypted connections utilizing ssl/tls.

At no time within the early many years of electronic mail was privateness and safety of non-public knowledge included within the improvement of the e-mail know-how itself. Encryption for individuals who have to ship secrets and techniques got here pretty early with PGP (1991) and s/mime (1995), however 30 years later it has nonetheless not taken maintain out there. Other developments have meant that electronic mail at the moment has much less privateness safety than ever.

Threats to and from

Email can pose a privateness downside on two utterly completely different fronts, with utterly completely different necessities for protecting measures. One is the monitoring of your communication alongside the trail between you and the recipient — that’s, an exterior risk to your emails. But a far larger concern for most individuals at the moment is the risk that comes from throughout the electronic mail — numerous strategies to trace and spy on you through the technical content material of the emails you open.

How you’re tracked

As quickly as you open an electronic mail, the one who despatched it may possibly discover out the place you’re, when and what number of occasions you open it. All that is because of so-called monitoring pixels — tiny photographs, only a single white pixel, generated on the sender’s server with a random file title linked to you. This is utilized in every part from spam to newsletters and one-off emails.

Måns Jonasson, web professional on the Swedish Internet Foundation, factors out that monitoring through the scanning of photographs with distinctive file names linked to consumer profiles or accounts just isn’t restricted to monitoring pixels.

It might be any picture in an HTML electronic mail.

“HTML emails also allow you to track recipients using other techniques such as cookies and dynamic content,” says Cooper Quintin, senior public curiosity technologist on the Electronic Frontier Foundation (EFF).

Both Måns Jonasson and Cooper Quintin additionally speak in regards to the different widespread means you’re tracked: While monitoring pixels and the like work passively, monitoring hyperlinks are an lively kind of monitoring. There are principally two forms of monitoring hyperlinks: hyperlinks that don’t go to the ultimate vacation spot in any respect, however attain it through a server that tracks the press and sends you on, and common hyperlinks with an extra monitoring code after the handle itself.

In each instances, these are hyperlinks that you’re requested to click on on within the electronic mail, resulting in, for instance, a weblog put up or a product web page in a store. In the previous case, the browser will first go to a very completely different area and transfer on. You can usually see the web page begin to load a number of occasions earlier than it lastly opens, with a number of completely different addresses showing within the handle bar.

The second kind takes you on to the vacation spot, however should you click on on the handle bar to see the complete handle, you may see that it is rather lengthy and incorporates lengthy codes and different issues on the finish after the common handle. You may also see this by copying the handle and pasting it into the handle bar as a substitute of clicking on it.

Foundry

Stop monitoring

To keep away from being tracked by monitoring pixels and different monitoring photographs, there are two primary strategies. You can both flip off HTML emails altogether and open all emails as plain textual content, or you may flip off the automated loading of distant content material (of which photographs are the most typical kind).

“Turning off the automatic loading of images is the best, most concrete example of simple protection if you’re worried about being tracked, and it’s done automatically on suspected spam in Gmail and many other clients,” says Måns Jonasson.

Pamela Palma/EFF

Cooper Quintin recommends the extra drastic possibility of turning off HTML emails altogether. One benefit of this over stopping the loading of photographs is that it additionally prevents different potential safety flaws within the dealing with of HTML, so it offers some safety towards malware and hacking. But then again, it makes many emails comparable to mailings with affords that you just really wish to obtain not work correctly, so it’s a stability between privateness safety and profit.

As many customers at the moment have switched off the automated loading of photographs, some entrepreneurs have chosen to ship emails that comprise hardly any plain textual content. Almost all content material is positioned in photographs, and a textual content close to the highest says one thing like, “Does this email not look right? Open in browser instead,” with a hyperlink.

“It’s a trend I’ve seen […] that you have to load images to read the email because all the text is in images,” says Cooper Quintin.

To forestall monitoring in these instances, there’s not a lot you are able to do by yourself. It just isn’t potential to disable picture scanning and solely scan particular person photographs by clicking on them, for instance. If the photographs are hyperlinks and you haven’t switched off HTML emails, you may in fact click on on them, however then it’s most likely a monitoring hyperlink.

Effectively “washing” outbound hyperlinks is tough and tough, as a result of you have to know prematurely which of them are getting used for monitoring and it’ll by no means be 100 % efficient, and it dangers breaking reputable hyperlinks, similar to every other filtering on the web.

There are just a few firms which are actively working to forestall electronic mail monitoring. Apple customers have entry to a know-how known as Privacy Protection in Mail which protects towards each lively and passive monitoring. The service scans all photographs and different knowledge on Apple’s servers in order that the sender can not see your IP handle and if you opened the e-mail. It additionally scrubs away monitoring code from many suppliers, comparable to Google, Facebook, and Microsoft’s ad-saving codes.

Subscription-based electronic mail supplier Hey additionally has a number of applied sciences that cease monitoring. Like Apple, all photographs are loaded from the corporate’s servers somewhat than straight out of your gadgets, and Hey robotically removes monitoring pixels and different monitoring from a protracted record of identified trackers, plus any photographs and different content material that comply with typical monitoring patterns (comparable to one-pixel-sized photographs).

Encryption and surveillance

So far, it’s been all in regards to the electronic mail risk. But what in regards to the risk to electronic mail, like mass surveillance? The solely technique to absolutely shield your self from any type of surveillance is with full-strength encryption, the place solely you and the recipient have the keys to unlock the contents of your messages. However, such a encryption has by no means been broadly adopted for electronic mail.

Solutions like PGP, GPG, and s/mime are sophisticated to arrange and use. Both sides should create key pairs and trade their public keys, and get an electronic mail consumer that helps the know-how. This is sophisticated sufficient on a pc however nearly not possible on a cell phone, the place most individuals test their emails at the moment.

I requested Måns Jonasson and Cooper Quintin whether or not it’s even price attempting to get began with PGP as a non-public individual.

“Honest answer: No,” says Måns Jonasson.

PGP seems to be extremely tough even for IT safety consultants, to not point out unusual customers. “PGP is not the best solution for encrypted communication and I think it’s better to prioritize getting others to start using Signal, WhatsApp, ProtonMail and other forms of [total range encrypted] communication,” replies Cooper Quintin.

Both consultants additionally level out that the widespread notion that electronic mail just isn’t encrypted is, as Måns Jonasson says, a fact with modification.

Much of the e-mail site visitors at the moment is encrypted through TLS/SSL. Email protocols have been initially designed to be unencrypted, and for a very long time all electronic mail site visitors on the web was utterly unencrypted, however at the moment Gmail, Outlook, and the opposite huge giants are encrypted, no less than from server to server. And in the long run, nearly 100 % of electronic mail site visitors will definitely be encrypted.

The site visitors between customers’ gadgets and the e-mail servers is nearly at all times encrypted, and since most individuals at the moment have their electronic mail hosted by Google or Microsoft, Cooper Quintin says this usually signifies that emails are encrypted all the way in which.

If you’re a Gmail consumer and also you electronic mail one other Gmail consumer, the e-mail won’t ever depart Google’s servers.

Major suppliers like Gmail and Outlook additionally encrypt emails when they’re despatched between the businesses’ servers, so with few exceptions, emails you ship shall be encrypted all the way in which from you to the recipient. However, the businesses dealing with the e-mail can see the content material, and in addition scan all emails for malware, youngster pornography, and spam. If the messages have been absolutely encrypted, no such scanning may happen.

According to Cooper Quintin, because of this the risk to your privateness is that the police can, for instance, request your emails throughout a felony investigation, “so you might not want to send things via email that you don’t want to hear read out during a trial.”

The backside line is that Signal, WhatsApp, Imessage, and different messaging companies with full-strength encryption are higher for exchanging secrets and techniques between buddies, however apart from monitoring for advertising functions, common customers don’t should be significantly anxious about electronic mail.

“Not loading images in unknown emails and not clicking on links in such emails goes a long way,” says Mr Jonasson.

This article was translated from Swedish to English and initially appeared on pcforalla.se.