For emails that have pictures, Thunderbird doesn't display the pictures, saying that it's protecting my privacy.
How is it protecting my privacy by not displaying pictures? Pictures are things I am receiving, not sending.
For example, displaying pictures inside emails allows a potential attacker to know your IP.
It suffices to include the image
When anyone loads
The sender can further identify who loaded an image by adding URL parameters to the embedded image address (e.g.
The specified image needn't even be a valid image, either. It could be a specially crafted file that exploits image rendering bugs in a particular e-mail client, or even a program that sends a different exploit image based on what sort of e-mail client is asking for it.
"But," I hear you saying, "my web browser does all of those things already and no one says that it's dangerous!" And you're right, no one says it's dangerous even though every single one of the above dangers is just as valid for web browsers as it is for e-mail clients.
The big difference is that an e-mail is targeted at (usually) a specific person or organization: if you send a booby-trapped e-mail to every account at
So, basically, what it boils down to is that Thunderbird is playing it safe. It won't automatically load remote content but gives you a nice big button to press if you trust the sender.