When the email is sent, there is no record of the message. There is only an image URI that points to the image that contains the message. So, the NSA won't be able to grab a copy as it's sent. However, if an organization has the ability to intercept all images that are loaded in the browser (through the ISPs, for instance), it can grab a copy of the image containing the message. In that case, some OCR would have to be done in order to extract the message (which, agreed, is not hard to do if you are explicitly looking for messages contained within images).
That is correct. If the NSA or any other organization really wants to read your message, it will be able to. There are several ways to accomplish this (including what you just mentioned as well as the image sifting and OCR method I included above), but some of them just involve more work/modification-of-strategy than others.
Comments
When the email is sent, there is no record of the message. There is only an image URI that points to the image that contains the message. So, the NSA won't be able to grab a copy as it's sent. However, if an organization has the ability to intercept all images that are loaded in the browser (through the ISPs, for instance), it can grab a copy of the image containing the message. In that case, some OCR would have to be done in order to extract the message (which, agreed, is not hard to do if you are explicitly looking for messages contained within images).
I'm assuming you secure the image URL with HTTPS at least to minimize the chances that an ISP could intercept it on the wire?
Nope. SSL MITM via CA.
That is correct. If the NSA or any other organization really wants to read your message, it will be able to. There are several ways to accomplish this (including what you just mentioned as well as the image sifting and OCR method I included above), but some of them just involve more work/modification-of-strategy than others.