Skip to contentExploitQuest

Email Leaks More Than Its Contents

Email was built in the open, decades before privacy was a concern. Every message carries a paper trail of where it came from, and a single loaded image can tell the sender you read it — from where, and when.

4 min readNot yet reviewed
Wrenlearner

I use a private messenger now. But most of the serious mail in my life is still email. Is that as private?

Rookmentor

No — and it is worth being honest about why. Email is old. It was designed to move text between machines in the open, long before anyone worried about who was watching. Privacy was bolted on later, unevenly.

Magpieadversary

Which is why it is my favourite. People guard their chats and forget their inbox tells me half of what I want without my ever reading a word.

The headers are a travel log

Every email carries headersMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. most people never see: a stack of Received lines recording each server the message passed through, often with an IP addressIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to., plus the time and sometimes the program that sent it. The body is what you wrote; the headers are where it has been.

Received: from laptop.home (203.0.113.45) by mail.example.com
Date: Tue, 24 Aug 2026 19:42:03 +0100
X-Mailer: SomeMailApp 7.2 (macOS)
Subject: dinner?
  1. Line 1The sending machine's IPIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to. — often your home connection — recorded in the header before the message even left. A rough location, for free, from a one-word email.
  2. Line 3The client and operating system, announcing themselves. None of this is the content, and all of it describes you.

Your email is encrypted in transit with TLSTLSThe encryption behind the padlock — it scrambles the contents of a page between your device and the site so nobody in between can read it.. Does that mean the provider cannot read it?

The pixel that reads you back

Open an email and images often load from the sender's server. A tracking pixel is a tiny, invisible image whose only job is to be fetched: the moment you open the message, your device quietly requests it, and the sender learns you read it, when, and from which IPIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to.. A read receipt you never agreed to.

What loading one hidden image tells the sender
# their server log, the instant you open the email:
GET /pixel.gif?id=you-specifically  203.0.113.45  09:14:22
# opened, by this recipient, from here, at this time
# you sent all of that by doing nothing but reading

You get a marketing email and simply open it to read, loading its images. What has the sender likely learned?

What actually helps

Treating email like a private channel

- Assuming "encrypted" means the provider cannot read it
- Loading remote images, sending opens and IPs back to every sender
- One address for everything, linking every account and contact together

Treating email as a postcard

- Blocking remote images; loading them only when you trust the sender
- Using per-purpose aliases so a leak in one place does not join the rest
- Reserving email for what can be a postcard; a real secret needs end-to-end
- For a serious adversary, composing over [[tor|Tor]] so the header IP is not yours

Email is not going away, and it does not have to be dangerous — but it is a postcard, not a sealed letter. Match how you use it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to., and keep the sealed things off it.

Wrenlearner

So the contents are only half of it. The headers and the pixel are the rest, and both leak by default.

Rookmentor

Right. Block remote images, split your addresses with separate identitiesCompartmentalisationKeeping separate parts of your life in separate identities that share nothing — so a breach or a link in one cannot spread to the others., and remember the provider can read the body. Email is fine for a postcard and wrong for a secret.

Magpieadversary

And every inbox that trusts it hands me a travel log and a read receipt, free. I rarely need the words.

So email carries a travel log in its headers, is readable by its provider, and reports your reading through remote images. Block those images, keep your addresses apart, and treat it as the open postcard it is. Next: how to actually choose a messenger — for the metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. it keeps as much as the contents it hides, and one more property, forward secrecyForward secrecyA property where stealing today's keys does not unlock yesterday's messages — each conversation is protected even if a key later leaks..