Hacker News new | past | comments | ask | show | jobs | submit login

hasn't Google gotten pretty good at comparing very similar files?

Sure, but they'd have to download the file first. At which point the tracking has succeeded.




...the tracking has succeeded.

Succeeded in what, confirming that Google is still in operation? Please note that Google doesn't even have to confirm the receiving email address is valid in order to get the image.


I just checked and Google rejects an e-mail after the RCPT TO: stage if the recipient address doesn't exist so they would not receive the message content.

    $ telnet gmail-smtp-in.l.google.com 25
    Trying 74.125.142.26...
    Connected to gmail-smtp-in.l.google.com.
    Escape character is '^]'.
    220 mx.google.com ESMTP nh2si25383829icc.26 - gsmtp
    EHLO myhostname.mydomain.com
    250-mx.google.com at your service, [my.ip.was.here]
    250-SIZE 35882577
    250-8BITMIME
    250-STARTTLS
    250-ENHANCEDSTATUSCODES
    250 CHUNKING
    MAIL FROM: <myusername@gmail.com>
    250 2.1.0 OK nh2si25383829icc.26 - gsmtp
    RCPT TO: <non-existant-address@gmail.com>
    550-5.1.1 The email account that you tried to reach does not exist. Please try
    550-5.1.1 double-checking the recipient's email address for typos or
    550-5.1.1 unnecessary spaces. Learn more at
    550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 nh2si25383829icc.26 - gsmtp


"early tests indicate that they don't actually do that, waiting for the user to click the email to make the request."


It'd be nice to see these "early tests".


You can easily try it yourself.

python -m SimpleHTTPServer 8080

creates a webserver serving the current directory, you can then create an email linking to a file in that directory and observe when it gets queried.


Easily is a bit of a stretch, because most users are on NAT setups and they would need to go into their router settings and know how to set them up to allow the external request to get through. So, yeah easily if (a big if) you know how to do that, or if (another big if) you are on a machine that is directly visible on teh interwebs.


Easy to do with ngrok.


That's not the point though. The point is most users don't have the knowhow.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: