Feeds

Apple Mail and iPhone users get vid-tracked

A trail of HTML 5 tags

Choosing a cloud hosting partner with confidence

Paranoid or spam-averse users should steer clear of Apple's desktop or iPhone mail clients for a while, as mails can't be prevented from using HTML 5 tags for tracking.

In common with the majority of email clients, Apple's can be configured not to load remote images embedded in messages, for privacy and spam prevention. But while other clients won't load any remote content by default, Apple's will contact remote servers even when loading images has been switched off, if the content is addressed using HTML 5 tags.

Embedding remote images in emails is common practice for those wanting to know if an email has been read: the server places a unique image name in each mail and tracks when the message has been displayed as the email client loads the image, which may itself be invisible.

Unfortunately spammers quickly adopted the technique to establish if email addresses were genuine, so most email clients won't load embedded content by default - offering a "Load Images" button instead. Apple's clients do load images by default, but offer the user the opportunity to switch off loading of "Remote Images" in the account settings.

But one Mike Cardwell noticed, and wrote up on his blog, that the Apple takes the definition of "Images" literally: while loading images might be switched off but a link to a non-existent audio file is logged at the remote server, without the user being aware that their opening of the email has been logged.

We've checked out the bug, and sure enough even where "Load Remote Images" is switched to 'off', a link referenced with the <audio> tag shows up on the server without any indication to the iPhone user, while the same mail opened on Thunderbird or Windows Mobile didn't attempt to load anything when configured not to load images.

It's not worth getting over-excited over what is, really, quite a minor issue, but it seems likely that those who take the trouble to switch off Remote Image Loading are expecting not to have their email tracked and could well be disappointed to find they aren't as secure as they thought. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Sea-Me-We 5 construction starts
New sub cable to go live 2016
Vodafone to buy 140 Phones 4u stores from stricken retailer
887 jobs 'preserved' in the process, says administrator PwC
BT claims almost-gigabit connections over COPPER WIRE
Just need to bring the fibre box within 19m ...
EE coughs to BROKEN data usage metrics BLUNDER that short-changes customers
Carrier apologises for 'inflated' measurements cockup
Comcast: Help, help, FCC. Netflix and pals are EXTORTIONISTS
The others guys are being mean so therefore ... monopoly all good, yeah?
Surprise: if you work from home you need the Internet
Buffer-rage sends Aussies out to experience road rage
EE buys 58 Phones 4u stores for £2.5m after picking over carcass
Operator says it will safeguard 359 jobs, plans lick of paint
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.