Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spy pixels in emails 'have become endemic'

bbc.co.uk

Post reply on HN
Print view View original

181–190 of 341 posts

Re: Spy pixels in emails 'have become endemic'

#181

Post by relix »

mcv wrote: post #162
relix wrote: post #65

Earlier quoted context omitted.

Yes, if that newsletter is using best practices. The recommended period is 90 days I believe, but you can get send an email asking if you're still interested (and in that email, there will be a link you should click if you want to stay subscribed). You may have had this happen before and probably thought that was just a scammy way to get you to click a link, but in fact it's completely legit.

I would not consider it "best practices" to automatically unsubscribe someone who legitimately subscribed. Have a double opt-in, and then assume they're interested until they explicitly unsubscribe. I'm subscribed to some mailinglist that I don't actually read but would be upset if they auto-unsubscribed me, because if I'm ever interested, I want it to be there.

What I described is literally listed under "best practices for bulk senders" by Gmail. These are hoops I'm not fond of jumping through either, obviously, but if Gmail marks all my email as spam I lose 4000 subscribers overnight so I do what big G asks me to do.

Re: Spy pixels in emails 'have become endemic'

#182

Post by jsmith99 »

wastholm wrote: post #59

What irks me is when email newsletters that I'm willfully subscribed to (the Economist comes to mind) inform me that "since I haven't been interacting" my subscription will be terminated. I have too been "interacting" (or as I call it, "reading") but my email client, very sensibly, doesn't load external resources, like pictures, willy nilly.

I wish The Economist was so careful when emailing me. I frequently get spam from them about 'exclusive subscriber only events' with no unsubscribe link because 'This service email [sic] contains important information about your subscription.'

Re: Spy pixels in emails 'have become endemic'

#183

Post by relix »

tomtheelder wrote: post #71
Nextgrid wrote: post #66

Earlier quoted context omitted.

I'm not sure why people would be wary of clicking the unsubscribe link on something they explicitly subscribed to in the first place. I mean, they trusted you enough to give you their email address to subscribe in the first place, right? The only scenario I can think of is when people didn't intentionally subscribe or were coerced into subscribing and those newsletters can go to hell and fully deserve to be marked as…

I think the original commenter really did mean weary and not wary. It's just a pain to be constantly unsubscribing from things, most of which you probably didn't intentionally subscribe to in the first place.

I did indeed mean weary.

Re: Spy pixels in emails 'have become endemic'

#184

Post by ColinWright »

peteretep wrote: post #151
billysielu wrote: post #95

Earlier quoted context omitted.

I've unsubscribed before only to find myself subscribed to a bunch of similar things instead. Clicking a link confirms your address reaches a person and is therefore worth spamming. Plus the risk of phishing. Plus the dark patterns in the unsubscribe UI.

> Clicking a link confirms your address reaches a person and is therefore worth spamming I think this is received wisdom that might have been true 20 years ago, but doesn’t stand up to scrutiny.

I use unique email addresses for everything, so I know where emails come from. More than once in the last two years I have unsubscribed from lists using the unsubscribe link, only then to have that email address received emails from new sources.

So for me, it does stand up to scrutiny, it still happens.

Re: Spy pixels in emails 'have become endemic'

#185

Post by amanaplanacanal »

benhurmarcel wrote: post #126
wodenokoto wrote: post #110

Earlier quoted context omitted.

It’s super annoying that other people’s spam habits hit you. For a while I couldn’t receive email notifications from Facebook because so many other gmail users marked them as spam, so no matter how many I unmarked, I was screaming in the wind. Fair enough that other people don’t wanna deal with that crap, but it should still be my prerogative to receive them. I first gave up, and later decided I didn’t care. But for…

You can create a filter to ensure that address is never marked as spam.

Depends on where you get your e-mail. I use outlook.com for one of my email accounts and there are things that it has decided are spam no matter how many times I mark as not spam and “add to safe senders.”

Re: Spy pixels in emails 'have become endemic'

#186

Post by jack_riminton »

gspr wrote: post #142
jack_riminton wrote: post #115

Earlier quoted context omitted.

Lol at the downvotes. I don't work for them!

If I were to guess, the downvotes stem from the suggestion that changing one's email provider to a specific other one is supposed to be a reasonable way to combat tracking pixels. It's kinda like suggesting moving to fix a leaky pipe.

No I wouldn't suggest that. I mainly moved because of the other features

But the pressure from Hey is persuading some companies to stop doing it https://twitter.com/dhh/status/1359437390763483141?s=20

So it's not avoiding the root cause entirely

Re: Spy pixels in emails 'have become endemic'

#187

Post by grishka »

relix wrote: post #50

If you're running a mail newsletter, this tracking is pretty important. You're supposed to stop sending emails to someone who's not interacting with them, or you get an extra point towards being flagged as spam. Since people are already weary of clicking the unsubscribe link and instead casually mark everything as spam, every little bit towards keeping your reputation counts. It's a damned if you do, damned if you do…

I open every single email I receive. How would one not? Would you have a permanent unread counter instead or would you delete them without opening or what?

Re: Spy pixels in emails 'have become endemic'

#188

Post by mike-cardwell »

spullara wrote: post #154
mike-cardwell wrote: post #101

Earlier quoted context omitted.

It does not. That's how it should work, but it does not work that way. It downloads them on demand if and when the user views an email. So it protectes the users IP address from the spammer/marketter, but not the fact that the message was viewed nor when it was viewed.

The amount of email that is sent and not opened would probably destroy the origins - might be ok. But it would waste a huge, huge amount of bandwidth and CPU to download them which would open up an attack vector (DoS) on any email service that did this. Images can be legitimately very big...

I'm not convinced that this would be as big a problem as you're suggesting. If somebody is sending thousands of emails with html containing embedded images, the receiving system of those emails only needs to download each of those images once, and cache them.

Unless they're using different URLs for each image for tracking purposes. Which would become pointless if the images were downloaded immediately.

They could probably get away with applying size limits to images too, and simply have placeholder/broken images if the images are unreasonably large.

It would even work for people using normal IMAP clients if they attached the images to the email directly and switched out the href in the img tags to point at the attachment instead.

This whole thing could be a user setting which can be toggled. Defaulting to the most privacy friendly option.

Re: Spy pixels in emails 'have become endemic'

#189

Post by mike-cardwell »

wruza wrote: post #152
mike-cardwell wrote: post #96

Earlier quoted context omitted.

I run https://www.emailprivacytester.com - People will visit my site, enter their email address, receive an email from me, click the "confirm" link in that email, then once confirmed that they control the email address, go to another section of the website and send themselves a test email. Then they will go into their email client and click the spam button on both of the emails that I sent them. The confirmation emai…

They do that because they have no guarantee that a site will respect an “unsubscribe” request, and it wouldn’t drag them through a shady multi-step “but why” dialog, and it wouldn’t send them another email with “Dear sucker, we see your request and sadly have to react, but you know how these servers work, right? Wait for a week or twelve before all our systems are aware that you wanted to unsubscribe from one of our…

I think you're missing the point. They opted in to receiving my email. They handed over their email address to me and requested that I send them an email.

They then told their email provider that the email they requested was spam.

I've considered putting up a page with a list of these peoples email addresses, but I feel like it would end up causing me more problems than it's worth.

[edit] There should be a system where I can prove to an email provider that I was in fact given permission to send to an address (for a period of time, and/or for a specific quantity of messages). If there was a standard email header where you could stick a callback URL like:

  Request-Permission: url=https://www.example.com/callback period=1D count=10
Then when e.g Google receives this message, they could have some sort of UI to say "The sender of this email wants permission to send you up to 10 emails for the next 24 hours". The user when then click yes or no. If yes, Google would fire off a request to my callback URL, so both me and Google knows I have permission. Google could then skip/reduce spam filtering for those emails then too.

Re: Spy pixels in emails 'have become endemic'

#190

Post by grishka »

wahern wrote: post #9
pfundstein wrote: post #4

I can't think of any email clients that automatically download external images by default. The article seems to be over-blowing the issue a bit.

GMail displays them. It uses a proxy for downloading, but I don't think that matters unless they're preloading all images unconditionally upon server-side receipt of the message. Apple's macOS Mail.app client displays external images by default, as does their iOS app.

There is a plugin for macOS Mail.app that tries to emulate Hey's tracker blocking.[1] I just installed it and it seems to be working. Also translated all 3 strings to Russian while I'm at it.

[1] https://github.com/apparition47/MailTrackerBlocker

Post reply on HN