0

Our company want to install a tracking feature (installed as an add-on to google) that pushes an invisible pixel to emails, and than you see if that email was opened or not.

The addon asks to get all data from the browser upon installation

Is that a secure thing?

I feel that it's giving a 3rd party, access to ALL my data/passwords/bank info...

Should I install such an addon?

8
  • This sort of tracking wouldn't be of any use for Google Mail users.
    – Ramhound
    Jun 12, 2014 at 13:30
  • It's an "addon to Google"? What is that supposed to mean? Jun 12, 2014 at 13:37
  • . Its an addon to google chrome. But i dont think the brand matters.
    – Saariko
    Jun 12, 2014 at 13:47
  • 1
    Any extension could do that. You just have to trust that the extension won't.
    – Jon
    Jun 12, 2014 at 14:13
  • @Ramhound, in Gmail you could still track if/when the user viewed the email, you just wouldn't get the user's machine machine information since GMail is being a proxy for all images.
    – heavyd
    Jun 12, 2014 at 14:15

3 Answers 3

3

Maybe!!

I've done email marketing with tracking where I designed the lot (the tracking system, the email, the databases etc). The idea is you include an image, when you download the image it sends details which is then executed on the server.

However, you must realise that, unless the technology has moved so quickly I'm behind, you have to download the pixel. If you don't download the pixel (the pixel means image) then it won't work. And email clients like Outlook often automatically prevent images from downloading!

So, is it secure? That depends on your set up and security. If you have an email client which allows me to run javascript or even execute macro's etc, then I would say no. And I could exploit it.

The other issue is you may have is, the third party (in this case Google), may be able to track you for your own needs (and I'm not suggesting for the power of evil). For example, tracking programs often include the users email so you know who opened the email. Emails are unique so maybe Google can also store this information gathered from your mail shot. Then, if the client has Gmail, the next time they log on to Gmail, they see adverts more tailored for their needs. This could even be showing your competitors.

Now, and this paragraph is opinion based, since you are doing this via Google, and I would say they are a fairly big company that the likelyhood is they are very security conscious. Having a vulnerability where data was leaked in the manner you describe would greatly damage their reputation; not something they would want to do. However, doing the same thing via Dodgy Dealing Enterprises may result in something less than ethical!

2

I don't think this will work as a "tracking" mechanism anymore for Gmail. I've used to use it but since Google introduced new secure way of viewing pictures in Gmail; where you download and upload all photos from Google servers, it won't work. It will display that the Email was opened as soon as Google (not the tracked user) downloads the photo from that link to its servers. Here's the announcement: Gmail Blog

So to answer your question, it's safe for the user, and since Chrome uses Sandboxing, it's safe for you. But does it work? I don't think so, since the default is the new way, and users have to manually select the old way.

0

As a generic statement, An add-on can theoretically steal any data your browser has access to, so its important to only download and install browser add-ons from developers you trust.

As for the tracking pixel, the service likely just hosts the image and logs the people who download it specifically. That means that for a person recieving one of these emails, their privacy is impacted to the same extent that visiting any webpage is. the site operator can see the IP address of the client (and from that infer geographic location), see what is in your system clipboard, your agent string, in some cases your visited site history, etc. They can read cookies from prior visits, and call plugins that may have additional information to provide (like the old flash stealth cookies). Is this secure? I would generally say no.

In the end, while I believe that using this (or any kind of read receipt algorithm) is unethical, if the user isn't give a prior opportunity to opt out, that is up to you, at least in the US when anyone can track anyone for any reason that turns a profit.

Hope that helps.

Not the answer you're looking for? Browse other questions tagged .