I have assumed for some time that de facto Gmail leaks information about the contents of my email. Having just read a related question, I'm wondering if my assumption is correct.

Suppose, for example, Merck buys an ad that links to keywords related to embarrassing medical condition XYZ. They link the ad to a URL in which they have encoded XYZ. When I click on the ad, whose text is something innocuous, I'm sent to the XYZ URL, whose contents sets a cookie saying "Gmail tagged as XYZ". Voila, Merck has now pried personal info from my Gmail account. (Merck also takes the precaution of logging my IP.)

Is there any reason this wouldn't work? Does anyone do this? The only defense I can see if Google wants to prevent this is to carefully examine keywords (nearly impossible to do with 100% efficacy) and also do some robot testing for cookies. Or legal defenses, but suing your clients gets messy.

(Note 1: Merck is a trademark and simply an example; I have no beef with them. Nor do I have any embarrassing medical conditions for which they sell pharmaceuticals. :)

Note 2: This is far more insidious these days, since Gmail stopped only displaying keyword ads by the particular email containing the keywords. Now you could click on an ad for a free iTunes song that leaks info about an email you read 10 minutes ago.)

  • 4
    Merck will not know who you are. All they will know is that someone from IP clicked on a GMail ad.
    – dnbrv
    Feb 28 '12 at 23:06
  • But you should assume that email is intrinsically insecure, and that your messages can be read by every mail server that they pass through. Feb 29 '12 at 16:01
  • 1
    Merck does not know my name at this point. However, they know that the person using this browser had a Gmail message with the keywords that they believe represent a certain condition. Moreover, they can then connect this with cookies on the same browser to discover my name or other identifying details. Ergo, they have pierced the "privacy" of my email.
    – Paul
    Mar 2 '12 at 15:44
  • Of course, as SMTP is not encrypted. However, trusting the email provider(s) is the intrinsic presumption of using email. Also note that generally email does not go through multiple providers, e.g., it goes straight from Yahoo to Gmail. Or, within a provider, it doesn't transfer at all; it just moves from one Gmail account to another.
    – Paul
    Mar 2 '12 at 15:47
  • For example, researchers have used cookies to connect to social network accounts, thereby identifying individuals. For more info on cookie abuse correlation, see en.wikipedia.org/wiki/Internet_privacy#HTTP_cookies
    – Paul
    Mar 2 '12 at 15:53

Of course it's possible. But hell it's possible with any ad. You could be researching xyz's embarrassing condition and click an ad there and, the same thing could happen. It's really hard to actually maintain your anonymity. So technically it's possible, but most good companies would respect your privacy and the ones that don't most likely wouldn't be an ad that would even appeal to you.

If your really worried just change your name in GMail to some made up name. Use VPN's as well to hide your ip.

  • True, but this attack leaks the contents of email whether you sent it or not, or have any interest in XYZ. For example, Merck encodes the ad's keywords in the URL, then shows you an ad saying click here and we'll send you a $10 voucher just because we like you. Once you click on it, they know you have an email with these keywords. Or better yet, some third party does this for Merck and claims it's an ad for Coke or whatever. From a theoretical perspective you could eventually read someone's email this way, a few bits at a time.
    – Paul
    Jul 4 '12 at 23:02
  • So for example this approach could used to learn about all sorts of things you never Google'd, because you knew better than to do that. I'm not terribly worried about it from a personal perspective; it's just interesting to me as a security and information theory problem. De facto Google would probably block this before it got too effective.
    – Paul
    Jul 4 '12 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.