Re:A 0-click exploit chain for the Pixel 10
by GeekyBear on Friday May 15, 2026 @05:36PM
(#48154213)
The email client I use doesn't display images in an email until I explicitly ask it to.
Re:A 0-click exploit chain for the Pixel 10
by thrownthatway on Friday May 15, 2026 @07:12PM
(#48155131)
That has no bearing on the points made in the comment you replied to.
Re:A 0-click exploit chain for the Pixel 10
by marysol5 on Saturday May 16, 2026 @04:45AM
(#48158216)
Which came as a reaction to "tracking cookies" and the like being added to e-mail.
It was a reaction, not a proactive response.
Re:A 0-click exploit chain for the Pixel 10
by fc417fc802 on Saturday May 16, 2026 @04:54AM
(#48158275)
Rather than tracking cookies it's a form of delivery confirmation via unique url. One of the mitigations is to configure the server to unconditionally fetch (and retain) all embedded media immediately on receipt of the message. Which makes the BigTech example all the more egregious.
Re:A 0-click exploit chain for the Pixel 10
by gremlinunderway on Sunday May 17, 2026 @09:36AM
(#48168814)
Why are you withholding the name of the webmail provider?
Literally the only thing even remotely pressuring these firms to implement better security is bad PR (and it barely does that), so by not being explicit you are bypassing this
Or my favorite, I marked an extremely suspicious message with what was almost certainly a malicious attachment as junk in a certain BigTech webmail client (the only other option was phishing which it most certainly was not) and it "helpfully" opened the unsubscribe link in my local browser without first asking me for permission. It's difficult to imagine the level of incompetence and dysfunction required to not only write but review, approve, and deploy such a feature in a security and privacy sensitive context.