Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

51–60 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#51

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how…

Why would you allow users to unsub from transactional emails?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#52
post #8

> "Gmail’s AI-powered defenses stop more than 99.9% of spam, phishing and malware from reaching inboxes and block nearly 15 billion unwanted emails every day." This will be a pain for legit use cases but will net to a better place for the ecosystem. Much like strong KYB/KYC for bulk text messaging.

You joking right? The amount of text messages spam I receive now on Verizon, and some 8 months ago before on T-mobile is staggering.

Are you suggesting that because of stronger KYB/KYC for sending bulk, that increased the amount of spam text you get?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#53

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

Yes, I know I've seen someone talk about this before, I think it's their link safety checking thing:

https://techcommunity.microsoft.com/t5/security-compliance-a...

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#54

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how…

Why would you allow users to unsub from transactional emails?

Because you're not evil?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#55

Doesn't matter to me, if an email doesn't have a one click unsubscribe I just mark it as spam. Messes with their email reputation so they hopefully get kicked off of reputable email services.

I honestly don't care about their reputation, I just mark anything I don't want as spam. It's easier than finding the tiny 8-point link at the bottom and rolling the dice on whether their unsubscribe is one click or not. I don't feel obligated to protect their shitty business model.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#56

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

I thought it was part of CAN SPAM that you can’t require a second action and that was why the big email sending providers moved to that.

It's not really common for clicking a link to immediately unsubscribe, almost everyone requires you to click a button after navigating to the unsubscribe link. Otherwise you have issues with link scanners unsubscribing your recipients without their knowledge. There are some more complex ways to approach this with JavaScript checks for "real browser" but IMO these are more likely to create frustrating friction to unsubscribing (by not working if the user has an adblocker for example) than having the user click a button.

I've seen this pattern of unsubscribe link, then click button approved as CAN-SPAM compliant more than once so I don't think there's a legal concern. The CAN-SPAM rule seems more targeted at the systems you used to see a lot that required the user to log into their account, type in their email address, or figure out a complicated "communications preferences" list to use the unsubscribe form.

check out https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C...

It's a little fuzzy to me how exactly to interpret this but I think you could reasonably read it as allowing even unsubscribe pages that require you to type your email address in again (even though I detest these and don't think the problem they're intended to solve is a meaningful one).

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#57

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

You may not have to comply with CAN SPAM legally, but I absolutely hate when orgs do this.

Please try to make the world a better place instead of doing the legal minimum.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#58

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

Yes, I know I've seen someone talk about this before, I think it's their link safety checking thing: https://techcommunity.microsoft.com/t5/security-compliance-a...

It's odd that they're, essentially, fuzzing my app.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#59

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

I receive a lot of scam emails from Google Docs - ie random users 'sharing' Google Docs with me that are either ads or viruses or both.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#60

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

The majority of my spam is to firstname.lastname@gmail.com, because I have a common name. I assume spammers put together a list of common names and infer addresses from them. This would probably help me a lot.
Post reply on HN