For emails that have pictures, Thunderbird doesn't display the pictures, saying that it's protecting my privacy.

How is it protecting my privacy by not displaying pictures? Pictures are things I am receiving, not sending.


Most e-mail clients these days allow e-mail messages to be written in HTML with remote resources and possibly even Javascript. This is a huge privacy problem because it allows the sender of an e-mail to embed an image (it doesn't necessarily need to be an image, but that's the most common tactic, I think) which is hosted at a server under their control (for example) http://www.example.net/tracker.jpg.

When anyone loads tracker.jpg from that server, the e-mail sender can see that the image was loaded, what IP address requested it, and the exact date and time it was requested (also if it has been requested more than once.) With this information the sender can learn the general physical location and exact date for each time the message is read.

The sender can further identify who loaded an image by adding URL parameters to the embedded image address (e.g. http://www.example.net/tracker.jpg?targetID=Bob%20Johnson&msgID=123456&sendDate=07012012.) An arbitrary number of parameters could be passed and they would all wind up in the server's logs along with all the other information.

The specified image needn't even be a valid image, either. It could be a specially crafted file that exploits image rendering bugs in a particular e-mail client, or even a program that sends a different exploit image based on what sort of e-mail client is asking for it.

"But," I hear you saying, "my web browser does all of those things already and no one says that it's dangerous!" And you're right, no one says it's dangerous even though every single one of the above dangers is just as valid for web browsers as it is for e-mail clients.

The big difference is that an e-mail is targeted at (usually) a specific person or organization: if you send a booby-trapped e-mail to every account at cia.gov, you might just be able to break into the CIA's network (one hopes the CIA leaves remote content blocked.) This sort of targeted attack is similar to spear phishing and has been used successfully to break in to even the most technologically savvy of companies (i.e. Google.) Note that this sort of attack is not limited to spear phishing alone.

So, basically, what it boils down to is that Thunderbird is playing it safe. It won't automatically load remote content but gives you a nice big button to press if you trust the sender.

  • 1
    Even without any forms of possible intrusion, I look at the linked back HTML in SPAM as telling them "It Worked" the fools (me being one of them) opened the e-mail , because as our server shows thier computer downloaded the picture we put in it. Got-cha. – Psycogeek Jan 8 '12 at 10:39
  • But that image would have to be be hosted on the sender's computer, correct? It's not something that anyone anywhere can do just sitting at their laptop, am I correct? – tony_sid Jan 14 '12 at 22:22
  • 2
    @limitless The image would have to be hosted on a computer that the sender controlled. This could be their actual personal computer but it's usually not. Most often the image is hosted on a web server somewhere. A basic hosting account with a shared web host is all that's really necessary, and those can be had dirt cheap or free. They might also use an innocent third party's web server, if they have managed to break into one. There are even commercial services that claim to be able to track e-mails in exactly the manner described, using their own web server as the source of the images. – Andrew Lambert Jan 15 '12 at 0:38
  • If the image is hosted on a web server somewhere, without hacking the server how can they get this information? – tony_sid Jan 15 '12 at 19:41
  • By owning or renting the server. Like I said, they're dirt cheap. – Andrew Lambert Jan 16 '12 at 1:57

For example, displaying pictures inside emails allows a potential attacker to know your IP.

It suffices to include the image http://attacker.com/picture.png?limitless in an email sent to your address. Once your client displays it, your email address has been succesfully linked to your IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.