Characterizing Pixel Tracking through the Lens of Disposable Email Services

### Overview In this talk, Han from Virginia Tech presents a measurement study examining disposable email services and email pixel tracking. While email addresses serve as critical personally identifiable information (PII) connecting online activity to real-world identities, users increasingly encounter tracking pixels embedded in messages. To protect privacy and prevent user profiling or targeted phishing, users often turn to disposable email services (e.g., maildrop.cc, guerrillamail.com, mailinator.com). Han investigates why users rely on these services, the security risks associated with them, and leverages the collected email dataset to conduct an empirical analysis of email tracking prevalence and techniques.

### Key Topics - **Risks of Disposable Email Services**: Many temporary email platforms provide public, shared inboxes without authentication, meaning anyone using the same username can read incoming messages. Furthermore, providers often fail to delete messages within their promised retention periods. - **Sensitive Data Exposure**: Analysis of inboxes revealed critical PII, including credit card numbers, Social Security numbers (SSNs), and Employer Identification Numbers (EINs), as well as sensitive account notifications. - **Account Hijacking Risks**: Across the dataset, 86,000 emails were related to account creation, registration, password resets, and authentication codes—including messages from healthcare.gov, the Air Force, and iOS document scanners. - **Email Pixel Tracking**: Senders embed 1x1 or hidden tracking pixels to determine if and when an email is read, the recipient's location, and device details. - **Evasive Tracking Methods**: Trackers often conceal pixel dimensions by omitting size attributes or route through extensive redirect chains via hidden third-party trackers.

### Technical Details - **Data Collection**: The researchers monitored 70,000 disposable inboxes across 7 popular disposable email services from October 2017 to January 2018. They selected 10,000 popular usernames (e.g., `info`, `john`, `admin`) derived from prior data breaches. In total, they gathered between 2.3 and 2.7 million messages from approximately 210,000 sender domains. - **Tracking Detection Criteria**: An image was classified as a tracking pixel if either: 1. The image URL contained a recipient identifier (either raw email address or a hash; evaluated using 32 hash function types and over 33,000 combinations). 2. The image had an exact display or rendered size of 1x1. - **Evasive Techniques Identified**: - *Size Hiding*: 24.9% of tracking images omitted size attributes in the HTML markup, requiring the researchers to dynamically fetch pixels to confirm their actual dimensions. - *Redirection Chains*: 54.8% of tracking URLs used redirects. In total, 2,825 hidden trackers were identified, with Google-owned `doubleclick.net` being the top hidden tracker (appearing in over 96,000 emails). - **Tracking Prevalence**: - 24.6% of all analyzed email messages and 5.5% of all senders utilized email tracking. - Tracking was far more prominent among popular senders: nearly 50% of domains in the Alexa top 10,000 performed tracking. - First-party tracking was slightly more common than third-party tracking. - Unlike web tracking (where Google tracks ~80% of top 1M sites), email tracking was less concentrated: the top 10 trackers accounted for 31.8% of tracking senders.

### Takeaways Public disposable email services present major security risks due to shared inbox visibility and inconsistent message deletion policies, exposing sensitive PII and account recovery mechanisms. Concurrently, email tracking is prevalent among major senders, employing redirect chains and dynamically rendered pixels to monitor recipients. Proposed defenses include HTML filtering, preloading images, and email client proxying (such as techniques deployed by Gmail) to shield individual user IP addresses and browsing environments from trackers.