Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I know that it is possible for a spammer to generate an email that claims to be from a certain sender, regardless of whether it actually is. They could use that to send me mail purporting to be from something well-known (like my bank) and thus force my browser to download an image file from their site.

I'd happily approve an option that said "always display images from this site", but it's from the SENDER which can be spoofed, so I'm afraid to use this feature.

Am I overlooking something? Does Google do something here so that this is actually safe? Is there a better way I can handle this than downloading images on each message individually when I go to view it?

share|improve this question
add comment

3 Answers 3

up vote 4 down vote accepted

Most of the time when a email address is faked Gmail will warn you. The image is most likely being only allowed if it's from a certain URL anyway, so if it isn't, it's pretty likely Gmail would either warn you it's not from the sender or ask if you still want to view it.

share|improve this answer
    
I was hoping for something more definite, but I guess this will have to do. –  mcherm Dec 10 '11 at 22:36
add comment

Yes it is safe to turn on the option "always display images from" option, if you know the sender.

In case of a spam message, Gmail detects it and gives you the warning.

share|improve this answer
add comment

Images are Web Bugs.

The major reason that images are blocked by default is because they allow you to be tracked - they allow the sender to know that you read their email.

With a plain email, the sender does not get any notification when it's read. When the email contains an image, your web browser then fetches the image from the sender's web server. Images often contain encoded parameters that identify you completely, and this leak the fact you read this mail back to the sender.

share|improve this answer
1  
This answer would have been useful if the question had been "Why does Gmail block images?". But the question was "'Is it safe to allow images from sender given that sender is a field that can be spoofed?" –  mcherm Dec 31 '11 at 1:48
    
@mcherm - I just wanted to emphasize what the security risk exactly is, and how it can be abused. –  ripper234 Dec 31 '11 at 2:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.