Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

201–210 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#201

Post by drdaeman »

georgyo wrote: post #181

Reading all the comments makes me think I'm an outlier. I very aggressively unsubscribe from everything so I get very little mailing list spam. Maybe a few messages a month. What I do get _constantly_ is spam email messages to my inbox from Gmail and Outlook domains. At least one a day for many years. Because it from Gmail, they have very little spam filtering done, yet if any other provider sent these messages then…

> I very aggressively unsubscribe from everything

Never unsubscribe from anything you haven't subscribed for (or at least where you haven't gave your email address to the sending party), because I believe any interaction with unsolicited emails provide spammers with a clear signal that their spam is not just delivered but also read and interacted with, so they get more agressive.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#202

Post by OJFord »

jupp0r wrote: post #199
sleepyhead wrote: post #174

Earlier quoted context omitted.

This is exactly why GDPR exists. What you are describing is illegal in the EU. Sending marketing communication requires clear opt in consent.

Are you sure? I don't have more than anecdotal data, but I remember unsubscribing from EU newsletters to be much more cumbersome than from US ones.

If it's at all difficult just reply saying something with the 'GDPR' keyword and they'll hop on it.

A few times I've had unsubscribe links absent or not working for whatever reason and done that and a human's replied and sorted it out.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#203

Post by hunter2_ »

albertgoeswoof wrote: post #137
CobrastanJorji wrote: post #132

Earlier quoted context omitted.

Why is list-unsubscribe is optional for your senders?

It's transactional email - so generally speaking it's not a subscription list that recipients are on per se. This is in line with the CAN SPAM guidance (although that is a US law it's good guidance to follow globally). Also it requires senders to actually implement it, which is not possible to confirm. Although we could add a catch all service that does this automatically, which I think we'll do.

I get tons of messages from otherwise reputable companies (household names) that have no "unsubscribe" options because they consider the messages required for active account holders (and I'm not ready to close my account) but the messages certainly aren't triggered by a transaction that I'm party to. For example, banks will periodically inform me about how I should stay vigilant to avoid fraud, and all sorts of similar concepts. Any thoughts on whether this type of stuff violates CAN SPAM?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#204

Post by legitster »

janosdebugs wrote: post #152
legitster wrote: post #129

Earlier quoted context omitted.

Unfortunately for us, the Privacy team at our org has determined that a one-click unsubscribe link in the body of the email is unacceptable (passing an identifier into the URL of the link). So we accept either the client unsubscribe link, or users who click the unsubscribe link in the email have to provide their email address on the unsubscribe page.

What was the legal reasoning behind this?

If someone gets forwarded the email and they take action based on another person, or erroneously get unsubscribed by an email scanning tool, those are no-no events according to our lawyers.

Keep in mind our webforms you can put whatever email you want in them. But something to do with the fact that we are knowingly storing the information and it crosses to another system.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#205

Post by gsich »

starttoaster wrote: post #200
thaumasiotes wrote: post #190

Earlier quoted context omitted.

> Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself Have you tried doing this recently? Creating an email address has become a fairly draconian process.

Yeah, I just made a new google account today. It takes about 2 minutes. You need a birth date (easily lied about), a phone number (it's google, they have your phone number already, no reason to lie) where they will send you an 8 digit code for you to confirm, then type in your desired email address and your password. Hardly draconian. Viola, you have a gmail account. You can do more to ensure you're the only one that…

Phone number is draconian.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#207

Post by rbut »

EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

Yes have seen this is in a couple of my SaaS applications.

If it's in the querystring then they essentially fuzz it by changing some part(s) of the value. I noticed this because I use signed tokens and it raised an exception in Sentry when the signed token was invalid.

I ended up moving the signed token into the URL itself and the problem went away. eg. /unsubscribe/abcd1234/

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#208

Post by Ensorceled »

cxr wrote: post #106
exabrial wrote: post #82

Earlier quoted context omitted.

In a previous life, we prevented the GET url problem by having a javascript POST and forward to a secondary URL. This allows everything to be "one click" (which honestly is a good thing) but prevents crawlers from accidentally triggering the unsubscribe. Not sure this still works today and obviously this is not legal advice.

Not an answer to the question they asked. --- Okay, HN. Go ahead and explain what's offensive here. The question that was asked: "I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on the [query] string. Anybody ever seen that?" The question the parent commenter seems to have hallucinated: "Does anyone know how we can keep mail services from unsubscribing folks in error when these mail serv…

You could imagine they started their post with "Yes, it's a pretty common problem here's what we did ..." and then it makes sense.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#210

Post by hunter2_ »

crazygringo wrote: post #169
3c6bYDXLMj wrote: post #164

Earlier quoted context omitted.

These aren’t transactional. An email isn’t transactional just because the sender has a relationship with the recipient.

I think they mostly are -- they're all about reminders for upcoming appointments and vehicle checks (the dealership), confirmation of bill payment and notices of rate rises and holiday hours (the gym), and confirmations of tee time reservations or payments or something or other with the golf course.

What definition of transaction relates to a notice about holiday hours?
Post reply on HN