Problem / Motivation
Email Privacy Tester (source code) is a great tool for checking whether an email client is vulnerable to email tracking methods—and, if so, which ones.
Bulwark already has protection against the most common tracking methods, but there are still some ways to get around it:
Proposed Solution
It would be great if Bulwark could also block the remaining tracking methods:
Alternatives Considered
None for this feature request.
Feature Area
Email
Mockups / Examples
On https://www.emailprivacytester.com/, you can enter a test email address and see which tests are successful.
Additional Context
Most e-Mail clients are vulnerable to one or more of this tests.
EDIT:
The Browser (in my test scenario: Safari on MacOS) blocks some more tests: cssEscape, pictureSource, imgNewlineSrc, videoPoster and one of the <script>-Tests.
CSP blocks some sources but allows images from other servers (since users can access them if they want to):
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-4ba6c90c-5296-411e-b2c0-82b0fb262ad0'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'self' https:; frame-src 'self' blob:; object-src 'self' blob:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; media-src 'self' blob:
I think the best approach would be to filter the HTML source code and implement the strictest possible CSP, to have two lines of defense.
Problem / Motivation
Email Privacy Tester (source code) is a great tool for checking whether an email client is vulnerable to email tracking methods—and, if so, which ones.
Bulwark already has protection against the most common tracking methods, but there are still some ways to get around it:
Proposed Solution
It would be great if Bulwark could also block the remaining tracking methods:
Alternatives Considered
None for this feature request.
Feature Area
Email
Mockups / Examples
On https://www.emailprivacytester.com/, you can enter a test email address and see which tests are successful.
Additional Context
Most e-Mail clients are vulnerable to one or more of this tests.
EDIT:
The Browser (in my test scenario: Safari on MacOS) blocks some more tests: cssEscape, pictureSource, imgNewlineSrc, videoPoster and one of the
<script>-Tests.CSP blocks some sources but allows images from other servers (since users can access them if they want to):
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-4ba6c90c-5296-411e-b2c0-82b0fb262ad0'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'self' https:; frame-src 'self' blob:; object-src 'self' blob:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; media-src 'self' blob:I think the best approach would be to filter the HTML source code and implement the strictest possible CSP, to have two lines of defense.