OK, I was going to shoot off some know it all info about how email tracking works and what data paypal can glean from you reading their maill, but I thought let's give it a test and find out what they really can see from an email.
So first off, email tracking is done with php, asp or other server side scripts disguised as images. They use images because this is really the only type of external file you can load in most email clients. Any other file will provide the same resluts.
I wrote a quick tracking script in php and sent myself an email through it to my gmail acct. It did not track anything on me until I clicked on display images. When I clicked here's the data that I was able to get:
Code:
SERVER:
HTTP_HOST=localhost
HTTP_CONNECTION=keep-alive
HTTP_USER_AGENT=Mozilla%2F5.0+%28Windows+NT+5.1%29+AppleWebKit%2F537.1+%28KHTML%2C+like+Gecko%29+Chrome%2F21.0.1180.89+Safari%2F537.1
HTTP_ACCEPT=%2A%2F%2A
HTTP_ACCEPT_ENCODING=gzip%2Cdeflate%2Csdch
HTTP_ACCEPT_LANGUAGE=en-US%2Cen%3Bq%3D0.8
HTTP_ACCEPT_CHARSET=ISO-8859-1%2Cutf-8%3Bq%3D0.7%2C%2A%3Bq%3D0.3
HTTP_COOKIE=emailtest%3DThis%2Bis%2Bsome%2Btest%2Bdata%3B+emailtest2%3DSome%2Bmore%2Bcookie%2Bdata%3B+deviceorder%3D01234567%3B+device%3D6%3B+network_type%3D0
PATH=C%3A%5CWINDOWS%5Csystem32%3BC%3A%5CWINDOWS%3BC%3A%5CWINDOWS%5CSystem32%5CWbem%3BC%3A%5CProgram+Files%5CQuickTime%5CQTSystem%5C%3BC%3A%5CProgram+Files%5CCommon+Files%5CAdobe%5CAGL
SystemRoot=C%3A%5CWINDOWS
COMSPEC=C%3A%5CWINDOWS%5Csystem32%5Ccmd.exe
PATHEXT=.COM%3B.EXE%3B.BAT%3B.CMD%3B.VBS%3B.VBE%3B.JS%3B.JSE%3B.WSF%3B.WSH
WINDIR=C%3A%5CWINDOWS
SERVER_SIGNATURE=
SERVER_SOFTWARE=Apache%2F2.2.21+%28Win32%29+PHP%2F5.3.8
SERVER_NAME=localhost
SERVER_ADDR=127.0.0.1
SERVER_PORT=80
REMOTE_ADDR=127.0.0.1
DOCUMENT_ROOT=C%3A%2Fwamp%2Fwww%2F
SERVER_ADMIN=admin%40localhost
SCRIPT_FILENAME=C%3A%2Fwamp%2Fwww%2Ftests%2Ftestmailtracker.php
REMOTE_PORT=3980
GATEWAY_INTERFACE=CGI%2F1.1
SERVER_PROTOCOL=HTTP%2F1.1
REQUEST_METHOD=GET
QUERY_STRING=
REQUEST_URI=%2Ftests%2Ftestmailtracker.php
SCRIPT_NAME=%2Ftests%2Ftestmailtracker.php
PHP_SELF=%2Ftests%2Ftestmailtracker.php
REQUEST_TIME=1348632187
COOKIE:
emailtest=This+is+some+test+data
emailtest2=Some+more+cookie+data
deviceorder=01234567
device=6
network_type=0
This looks like a lot, but the critical pieces of data that they have are:
REMOTE_ADDR=127.0.0.1 (my ip if I weren't running this through a local server)
HTTP_USER_AGENT=Mozilla%2F5.0+%28Windows+NT+5.1%29+AppleWebKit%2F537.1+%28KHTML%2C+like+Gecko%29+Chrome%2F21.0.1180.89+Safari%2F537.1 (my browser footprint)
It even shows the cookie that I set up as test, but the tracking script would have to be on the same domain as the place the cookie originated for this to work.
So the moral is, don't display images if you don't want to be tracked. You won't be tracked if you hide images.
