[jeffreyg]

Doesn't gmail stop these attacks without needing to force plaintext only by simply disabling images by default?

[mike-cardwell]

Yes. There was a bug a few years back though where they would display attached SVG images. These images could actually contain javascript, which left it vulnerable to XSS.

[aptwebapps]

Why is zzz90210's post dead? Everyone knows about tracking via images. I never considered something like bgsound, probably a lot of other people did not as well.

And it's the whole point of the article.