Mail Question: embedded tracking pixels

[jdw13]

Does the Mail App protect against the much publicized 'tracking pixels' that is said to be embedded in many phishing email messages?

I seem to be getting a somewhat increased junk mail and it makes me wonder:

Using macOS Tahoe Mail "View" with "Column Layout," does the message preview notify spammers and phishers that I have an active email account?

....
The Change Privacy pref in Mail discusses hiding IP address, but even if email address is hidden is it not possible for the the phisher to create a unique tracking pixel for each email address to identify 'active' email addresses?

 

[arc of the universe]

Does the Mail App protect against the much publicized 'tracking pixels' that is said to be embedded in many phishing email messages?

I seem to be getting a somewhat increased junk mail and it makes me wonder:


....
The Change Privacy pref in Mail discusses hiding IP address, but even if email address is hidden is it not possible for the the phisher to create a unique tracking pixel for each email address to identify 'active' email addresses?

hi

i can not find the exact equivalent setting in Mac Mail, but in iOS Mail there is a setting that you can toggle on/off called "Load Remote Images". turning this off does (i have believed for many years) prevent tracking pixels.

i thought there was the same setting in Mac Mail. but its changed over time this way:
go to Mac Mail / Settings / Privacy tab. you will find a setting called Block All Remote Content.
you can select only this if you want. but, there is a more powerful overriding setting of Protect Mail Activity which will override the Block Remote Content because the Protect Mail Activity does the same thing and more, like this:
"Mail Privacy Protection works by hiding your IP address and loading remote content privately in the background, even when you don’t open the message. This makes it harder for senders to follow your Mail activity. ".

 

[jdw13]

hi

i can not find the exact equivalent setting in Mac Mail, but in iOS Mail there is a setting that you can toggle on/off called "Load Remote Images". turning this off does (i have believed for many years) prevent tracking pixels.

i thought there was the same setting in Mac Mail. but its changed over time this way:
go to Mac Mail / Settings / Privacy tab. you will find a setting called Block All Remote Content.
you can select only this if you want. but, there is a more powerful overriding setting of Protect Mail Activity which will override the Block Remote Content because the Protect Mail Activity does the same thing and more, like this:
"Mail Privacy Protection works by hiding your IP address and loading remote content privately in the background, even when you don’t open the message. This makes it harder for senders to follow your Mail activity. ".

Thank you. You encouraged me to revisit the "Privacy" settings. I noticed that configuration selection before but it could not be enabled. The online documentation did not make it clear to me that these are "either/or" selections, so both cannot be checked at the same time. One must disable "Protect Mail Activity" before selecting "Block All Remote Content" is possible. {I think selecting "Block..." should automatically de-select "Protect" if that is the requirement.}

I'll use Mail like this for while, but my email is probably already on a list of active email aliases.

 

[jdw13]

This may answer my own question, when I enabled Mail "Settings/Privacy/Block All Remote Content" is see that some previewed emails have remote content that is not seen unless I click on the "Load Remote Content."

So, it would appear to me that even previewed messages are vulnerable to 'tracking pixel' unless you select the "Block All Remote Content" option. Note this cannot be selected unless "Protect Mail Activity" is deselected.

I do not understand how the "Protect Mail Activity" can protect you. If the tracking pixel is uniquely associated with the email alias, then it should not matter how it is accessed. If the tracking content is accessed then the phisher is told this is an active email address.

 

[BrianBaughn]

I do not understand how the "Protect Mail Activity" can protect you. If the tracking pixel is uniquely associated with the email alias, then it should not matter how it is accessed. If the tracking content is accessed then the phisher is told this is an active email address.

I don't get it either.

 

[adrianlondon]

To block tracking pixels you have to block all remote/external content.

The Apple feature of downloading everything in the background will open every single tracker and, as it's pretty much instant, can even hint to the sender that you have Apple products. As such, this feature automatically validates your email address to the sender.

What it does do, however, is hide your location and also how many times - if any - you actually open the mail (as the external images are downloaded just the once).

 

[jdw13]

To block tracking pixels you have to block all remote/external content.

The Apple feature of downloading everything in the background will open every single tracker and, as it's pretty much instant, can even hint to the sender that you have Apple products. As such, this feature automatically validates your email address to the sender.

What it does do, however, is hide your location and also how many times - if any - you actually open the mail (as the external images are downloaded just the once).

Yes, this makes sense. It is a shame that Apple does not actually say what is happening. The 'simplified' description makes it impossible to understand just what you configuring. Thanks for confirming my suspicions.

So, I imagine the reason the 'Block All Remote Content' is deselected when you select 'Protect Mail Activity' is that all of the remote content is already on the Apple server.

 

[adrianlondon]

I do actually use it, as I got fed up with all remote images being blocked.

I hardly receive any spam, and the spam I do get is usually flagged correctly as such by my IMAP provider (which iOS and MacOS put in junk, which blocks remote images anyway).

 

[arc of the universe]

I do actually use it, as I got fed up with all remote images being blocked.

I hardly receive any spam, and the spam I do get is usually flagged correctly as such by my IMAP provider (which iOS and MacOS put in junk, which blocks remote images anyway).

me too. matches what i see.
i hardly ever get spam. at all.

in conjunction with Mail Privacy Protection, i also use a ton of Hide My Mail 1off addresses that in the event i do get spam from somewhere, i can instantly know which site leaked my Hide My Mail address.

i think its the convergence of these two together that helps.

 

[chown33]

I searched for keywords:
what does Mac Mail "Protect Mail Activity" do

One top result is this page:

Legal - Mail Privacy Protection & Privacy- Apple

Data & Privacy

www.apple.com

The 3rd paragraph says:

In addition, Protect Mail Activity routes all remote content downloaded by Mail through two separate relays operated by different entities. The first knows your IP address, but not any third-party Mail content you receive. The second knows the remote Mail content you receive, but not your IP address, instead providing a generalized identity to the destination. This way, no single entity has the information to identify both you and the third-party Mail content you receive. Senders can’t use your IP address as a unique identifier to connect your activity across websites or apps to build a profile about you.

TL;DR: it uses two relay servers to load the remote content.