{"id":39234,"date":"2019-07-04T11:25:53","date_gmt":"2019-07-04T11:25:53","guid":{"rendered":"http:\/\/icloud.pe\/blog\/?guid=c69f41c4374ee027755cf0f6f06300e6"},"modified":"2019-07-04T11:25:53","modified_gmt":"2019-07-04T11:25:53","slug":"premium-email-firm-superhuman-ends-pixel-tracking-after-backlash","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/premium-email-firm-superhuman-ends-pixel-tracking-after-backlash\/","title":{"rendered":"Premium email firm Superhuman ends pixel tracking after backlash"},"content":{"rendered":"<p><span class=\"field field-name-field-author field-type-node-reference field-label-hidden\"><br \/>\n      <span class=\"field-item even\"><a href=\"https:\/\/www.cloudpro.co.uk\/authors\/bobby-hellard\">Bobby Hellard<\/a><\/span><br \/>\n  <\/span><\/p>\n<div class=\"field field-name-field-published-date field-type-datetime field-label-hidden\">\n<div class=\"field-items\">\n<div class=\"field-item even\"><span class=\"date-display-single\">4 Jul, 2019<\/span><\/div>\n<\/p><\/div>\n<\/div>\n<p class=\"short-teaser\">\n<a href=\"https:\/\/www.cloudpro.co.uk\/\" title=\"\" class=\"combined-link\"><\/a><\/p>\n<div class=\"field field-name-body\">\n<p> A premium email startup which gained notoriety for letting users see who opened their messages and the location they were opened, by default, has apologised and promised to change its service.<\/p>\n<p>Superhuman, a plugin for email accounts that aims to speed up emailing, came under fire for using &#8216;pixel tracking&#8217; by default and without consent from those that receive messages sent from users of the service.<\/p>\n<p>But, after a number of complaints and a critical blog post that went viral, the company has issued an apology and promised to change its service.<\/p>\n<h2>Faster Emails<\/h2>\n<p>A lot of people became aware of Superhuman via a\u00a0<a href=\"https:\/\/www.nytimes.com\/2019\/06\/27\/technology\/superhuman-email.html\" ><em>New York Times<\/em><\/a>\u00a0profile. Under a picture of a diamond-encrusted &#8216;new message&#8217; pendant, the startup was described as a premium app for speeding up emails with AI-powered shortcuts and quirks. One of the reasons it attracted such attention was because it&#8217;s a $30 a month service and invitation-only &#8211; aspiring users need to fill in a questionnaire about their email usage to determine whether they need it.<\/p>\n<p>&#8220;We have the who&#8217;s who of Silicon Valley at this point,&#8221; the company&#8217;s founder Rahul Vohra, told the\u00a0<em>NYT<\/em>. It&#8217;s alleged that 180,000 people are on a waiting list to use the service. &#8220;We have insane levels of virality that haven&#8217;t been seen since Dropbox or Slack,&#8221; Vohra added.<\/p>\n<p>What these people are supposedly desperate for is an app that plugs into their existing email account (currently only works with Gmail and Google G Suite addresses) that promises to speed up the process of emailing others. There are features that let users undo sending, buttons to automatically pull up a contact&#8217;s LinkedIn profile, an &#8220;instant intro&#8221; shortcut that moves the sender of an introductory email to bcc, and a scheduling feature, which sees that you&#8217;re typing &#8220;next Tuesday&#8221; and automatically pulls up your calendar for that day.<\/p>\n<p>But one feature that was briefly mentioned in the piece caught the attention of users on Twitter; email tracking.<\/p>\n<h2>Read Receipts<\/h2>\n<p>&#8220;Superhuman is a surveillance tool that intentionally violates privacy by notifying senders every time their emails have been viewed by recipients,&#8221; Mike Davidson, a VP at InVision, tweeted. &#8220;I would never trust this company. Only way to make sure your own privacy isn&#8217;t violated is to disable images in your own email app.&#8221;<\/p>\n<div class=\"wysiwyg-widget-wrapper\">\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">Superhuman is a surveillance tool that intentionally violates privacy by notifying senders every time their emails have been viewed by recipients. I would never trust this company. Only way to make sure your own privacy isn&#39;t violated is to disable images in your own email app. <a href=\"https:\/\/t.co\/JZh2csd0ZB\">https:\/\/t.co\/JZh2csd0ZB<\/a><\/p>\n<p>&mdash; Mike Davidson (@mikeindustries) <a href=\"https:\/\/twitter.com\/mikeindustries\/status\/1144288602001571840?ref_src=twsrc%5Etfw\">June 27, 2019<\/a><\/p>\n<\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<p>\nLater, in a\u00a0<a href=\"https:\/\/mikeindustries.com\/blog\/archive\/2019\/06\/superhuman-is-spying-on-you\" >blog post<\/a>\u00a0that went viral, Davidson explained out that the email tracking, called &#8216;Read Receipts&#8217; on Superhuman, is a default setting for the service. He wrote that the read\/unread status of an email is not something the receiver can opt-out of. He showed an example of an email he had sent via Superhuman.<\/p>\n<p>&#8220;A running log of every single time you have opened my email, including your location when you opened it,&#8221; he explained. &#8220;Before we continue, ask yourself if you expect this information to be collected on you and relayed back to your parent, your child, your spouse, your co-worker, a salesperson, an ex, a random stranger, or a stalker every time you read an email. Although some one-to-many email blasting software has used similar technologies to track open rates, the answer is no; most people don&#8217;t expect this. People reasonably expect that when &#8211; and especially where &#8211; they read their email is their own business.&#8221;<\/p>\n<h2>Pixel Tracking<\/h2>\n<p>Every time you view an image while browsing the Web, that image is stored on a server and downloaded to your computer. As such the host server has knowledge of where that computer is and when it downloaded the image.\u00a0<\/p>\n<p>This technicality can be used to embed a tiny image, often a mere pixel wide, into web pages and emails, which can be very difficult to spot or transparent.<\/p>\n<p>As such, opening an email with such an image in it triggers a download from a server which effectively exposes the time the recipient opens the email and the computer&#8217;s location, essentially serving at the foundations for automatic read receipts.\u00a0<\/p>\n<p>As Davidson&#8217;s example showed, the emails not only show when they were opened but also where they were opened. So in a sense, Superhuman could be used to track the location of people by simply sending them an email. This is down to IP addresses as the downloaded tracking pixel records it &#8211; this how the internet determines where your computer is physically and digitally. Criminals sometimes exploit this to work out if a house is empty and ripe for looting.<\/p>\n<h2>The Outcome<\/h2>\n<p>The exposure Superhuman received in the\u00a0<em>NYTs<\/em>\u00a0quickly turned to controversy, but the company has been swift to offer a fix. CEO Vohra posted an apology in a\u00a0<a href=\"https:\/\/blog.superhuman.com\/read-statuses-bdf0cc34b6a5\" >blog<\/a>\u00a0and said that effective immediately, Superhuman will stop tracking locations, will delete existing location information and will turn off read receipts by default.<\/p>\n<p>&#8220;When we built Superhuman, we focused only on the needs of our customers,&#8221; he wrote. &#8220;We did not consider the potential bad actors. I wholeheartedly apologize for not thinking through this more fully.<\/p>\n<p>&#8220;We are removing location information in all read statuses for all emails sent with Superhuman, effective immediately. This will also apply to emails sent in the past.&#8221; <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p><span><br \/>\n      <span><a href=\"https:\/\/www.cloudpro.co.uk\/authors\/bobby-hellard\">Bobby Hellard<\/a><\/span><br \/>\n  <\/span><\/p>\n<div>\n<div>\n<div><span>4 Jul, 2019<\/span><\/div>\n<\/p><\/div>\n<\/div>\n<p>\n<a href=\"https:\/\/www.cloudpro.co.uk\/\" title=\"\"><\/a><\/p>\n<div>\n<p> A premium email startup which gained notoriety for letting users see who opened their messages and the location they were opened, by default, has apologised and promised to change its service.<\/p>\n<p>Superhuman, a plugin for email accounts that aims to speed up emailing, came under fire for using &#8216;pixel tracking&#8217; by default and without consent from those that receive messages sent from users of the service.<\/p>\n<p>But, after a number of complaints and a critical blog post that went viral, the company has issued an apology and promised to change its service.<\/p>\n<h2>Faster Emails<\/h2>\n<p>A lot of people became aware of Superhuman via a&nbsp;<a href=\"https:\/\/www.nytimes.com\/2019\/06\/27\/technology\/superhuman-email.html\" target=\"_blank\" rel=\"noopener noreferrer\"><em>New York Times<\/em><\/a>&nbsp;profile. Under a picture of a diamond-encrusted &#8216;new message&#8217; pendant, the startup was described as a premium app for speeding up emails with AI-powered shortcuts and quirks. One of the reasons it attracted such attention was because it&#8217;s a $30 a month service and invitation-only &#8211; aspiring users need to fill in a questionnaire about their email usage to determine whether they need it.<\/p>\n<p>&#8220;We have the who&#8217;s who of Silicon Valley at this point,&#8221; the company&#8217;s founder Rahul Vohra, told the&nbsp;<em>NYT<\/em>. It&#8217;s alleged that 180,000 people are on a waiting list to use the service. &#8220;We have insane levels of virality that haven&#8217;t been seen since Dropbox or Slack,&#8221; Vohra added.<\/p>\n<p>What these people are supposedly desperate for is an app that plugs into their existing email account (currently only works with Gmail and Google G Suite addresses) that promises to speed up the process of emailing others. There are features that let users undo sending, buttons to automatically pull up a contact&#8217;s LinkedIn profile, an &#8220;instant intro&#8221; shortcut that moves the sender of an introductory email to bcc, and a scheduling feature, which sees that you&#8217;re typing &#8220;next Tuesday&#8221; and automatically pulls up your calendar for that day.<\/p>\n<p>But one feature that was briefly mentioned in the piece caught the attention of users on Twitter; email tracking.<\/p>\n<h2>Read Receipts<\/h2>\n<p>&#8220;Superhuman is a surveillance tool that intentionally violates privacy by notifying senders every time their emails have been viewed by recipients,&#8221; Mike Davidson, a VP at InVision, tweeted. &#8220;I would never trust this company. Only way to make sure your own privacy isn&#8217;t violated is to disable images in your own email app.&#8221;<\/p>\n<div>\n<blockquote data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">Superhuman is a surveillance tool that intentionally violates privacy by notifying senders every time their emails have been viewed by recipients. I would never trust this company. Only way to make sure your own privacy isn&#8217;t violated is to disable images in your own email app. <a href=\"https:\/\/t.co\/JZh2csd0ZB\">https:\/\/t.co\/JZh2csd0ZB<\/a><\/p>\n<p>&mdash; Mike Davidson (@mikeindustries) <a href=\"https:\/\/twitter.com\/mikeindustries\/status\/1144288602001571840?ref_src=twsrc%5Etfw\">June 27, 2019<\/a><\/p>\n<\/blockquote>\n<\/div>\n<p>\nLater, in a&nbsp;<a href=\"https:\/\/mikeindustries.com\/blog\/archive\/2019\/06\/superhuman-is-spying-on-you\" target=\"_blank\" rel=\"noopener noreferrer\">blog post<\/a>&nbsp;that went viral, Davidson explained out that the email tracking, called &#8216;Read Receipts&#8217; on Superhuman, is a default setting for the service. He wrote that the read\/unread status of an email is not something the receiver can opt-out of. He showed an example of an email he had sent via Superhuman.<\/p>\n<p>&#8220;A running log of every single time you have opened my email, including your location when you opened it,&#8221; he explained. &#8220;Before we continue, ask yourself if you expect this information to be collected on you and relayed back to your parent, your child, your spouse, your co-worker, a salesperson, an ex, a random stranger, or a stalker every time you read an email. Although some one-to-many email blasting software has used similar technologies to track open rates, the answer is no; most people don&#8217;t expect this. People reasonably expect that when &#8211; and especially where &#8211; they read their email is their own business.&#8221;<\/p>\n<h2>Pixel Tracking<\/h2>\n<p>Every time you view an image while browsing the Web, that image is stored on a server and downloaded to your computer. As such the host server has knowledge of where that computer is and when it downloaded the image.&nbsp;<\/p>\n<p>This technicality can be used to embed a tiny image, often a mere pixel wide, into web pages and emails, which can be very difficult to spot or transparent.<\/p>\n<p>As such, opening an email with such an image in it triggers a download from a server which effectively exposes the time the recipient opens the email and the computer&#8217;s location, essentially serving at the foundations for automatic read receipts.&nbsp;<\/p>\n<p>As Davidson&#8217;s example showed, the emails not only show when they were opened but also where they were opened. So in a sense, Superhuman could be used to track the location of people by simply sending them an email. This is down to IP addresses as the downloaded tracking pixel records it &#8211; this how the internet determines where your computer is physically and digitally. Criminals sometimes exploit this to work out if a house is empty and ripe for looting.<\/p>\n<h2>The Outcome<\/h2>\n<p>The exposure Superhuman received in the&nbsp;<em>NYTs<\/em>&nbsp;quickly turned to controversy, but the company has been swift to offer a fix. CEO Vohra posted an apology in a&nbsp;<a href=\"https:\/\/blog.superhuman.com\/read-statuses-bdf0cc34b6a5\" target=\"_blank\" rel=\"noopener noreferrer\">blog<\/a>&nbsp;and said that effective immediately, Superhuman will stop tracking locations, will delete existing location information and will turn off read receipts by default.<\/p>\n<p>&#8220;When we built Superhuman, we focused only on the needs of our customers,&#8221; he wrote. &#8220;We did not consider the potential bad actors. I wholeheartedly apologize for not thinking through this more fully.<\/p>\n<p>&#8220;We are removing location information in all read statuses for all emails sent with Superhuman, effective immediately. This will also apply to emails sent in the past.&#8221; <\/p>\n<\/p><\/div>\n","protected":false},"author":403,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-39234","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/39234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/users\/403"}],"replies":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/comments?post=39234"}],"version-history":[{"count":1,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/39234\/revisions"}],"predecessor-version":[{"id":39235,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/39234\/revisions\/39235"}],"wp:attachment":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/media?parent=39234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/categories?post=39234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/tags?post=39234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}