Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

251–260 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#251

Post by r053bud »

Yeah, at this point, I’ve completely lost my main email address to spam and mailing lists; half of which seem to have broken unsubscribe pages. I’ve abandoned this email completely for personal communications and have a new email for that now. I continue to use my old email for any service or website, since I know they will likely sell my email in addition to spamming me to death.

This has all gotten completely out of control. Yet again, regulation seems to be about a decade behind.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#252

Post by hnick »

exabrial wrote: post #82
EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

In a previous life, we prevented the GET url problem by having a javascript POST and forward to a secondary URL. This allows everything to be "one click" (which honestly is a good thing) but prevents crawlers from accidentally triggering the unsubscribe. Not sure this still works today and obviously this is not legal advice.

I think some crawlers run JS, because a lot of the web simply won't work without JS to initialise the page state these days.

You can use captcha or similar, one workaround I've seen has a submit that is hidden so never clicked by real people then a visible submit that sets a hidden input and clicks the other one which requires the hidden input... not foolproof but avoids some accidents.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#253

Post by csomar »

mauriciob wrote: post #85
pirsquare wrote: post #51

Earlier quoted context omitted.

Why would you allow users to unsub from transactional emails?

Wrong address is one reason. For example, I receive transactional emails from a US-based ISP for someone else and the only way to unsubscribe is calling their customer service line. I’m not even in the same country.

This is not a spam problem but a security one. I received one guy (from the other side of the world) contracts and financial transactions. A mistake in domain name has resulted in his ?partner sending this information to me. Someone else could have used it. I think the process to handle these should a bit more different.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#254

Post by hnick »

jabroni_salad wrote: post #48
nwienert wrote: post #37

Earlier quoted context omitted.

I thought it was part of CAN SPAM that you can’t require a second action and that was why the big email sending providers moved to that.

You can require a second action such as clicking a button. What you can't do is take them to a page that says "to unsubscribe, send a certified letter to our headquarters and wait 90 business days". The entire transaction must be completed at the page you link to.

Or, as I so often get, ask me to log in to "my account". Which is not my account, it's someone else's account but they don't know their own email address, so logging in is probably technically unauthorised access to computer systems and highly illegal.

Bonus points when contacting support requires me to log in to "my account" too.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#256

Post by billy99k »

While this sounds great on the surface, it's used to control things like our elections. Politicians that Google likes can send as much mail as they want. Ones they don't mysteriously gets all of their email marked as spam.

Normies don't understand that big tech will basically control our elections from now on (and they won't understand how) unless we get the government involved.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#257

Post by kevin_thibedeau »

incompatible wrote: post #240
tppiotrowski wrote: post #238

Earlier quoted context omitted.

Also needing to log in before you can unsubscribe.

Especially if your account is no longer accessible; a problem I had with Uber after changing my phone number. Bombarded with "Uber Eats" spam and no way to unsubscribe without going through some kind of ridiculous process to reactivate the account.

I have that problem with a former utility company that keeps sending updates about the business that I've unsubscribed from multiple times. The one that irks me the most is TP-Link Kasa who has a marketing opt-out in the account creation flow and they still send repetitive spam without honoring the unsubscribe link.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#258

Post by cxr »

Ensorceled wrote: post #208
cxr wrote: post #106

Earlier quoted context omitted.

Not an answer to the question they asked. --- Okay, HN. Go ahead and explain what's offensive here. The question that was asked: "I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on the [query] string. Anybody ever seen that?" The question the parent commenter seems to have hallucinated: "Does anyone know how we can keep mail services from unsubscribing folks in error when these mail serv…

You could imagine they started their post with "Yes, it's a pretty common problem here's what we did ..." and then it makes sense.

No, it doesn't. The original questioner is already aware of the extremely common phenomenon where mail providers scan links in emails. That's not what the question is about. The first comment contains a very specific question about something different. The response is derailing the discussion.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#259

Post by kevin_thibedeau »

nvr219 wrote: post #236
cryptoegorophy wrote: post #232

Earlier quoted context omitted.

I wish Apple Hide My Email features existed 20 years ago. Any new signup now is I use hide my email.

I use fastmail masked email (which is basically the same thing) with the firefox plugin. I love it.

It gets better when you have your own domain and you can register with throwaways using spamco@mydomain.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#260

Post by WirelessGigabit »

albertgoeswoof wrote: post #128
WirelessGigabit wrote: post #120

Earlier quoted context omitted.

Side-note: for list-unsubscribe, do you determine the subscriber's identity that needs to be unsubscribed based on the sender or the receiver (like @unsubscribe.service.com)? Reason I'm asking is Unsubscribe rarely works for me due to my catch-all not SENDING emails from the address it was received on. It sends it from my actual address. Very annoying.

The RFC https://www.ietf.org/rfc/rfc2369.txt Section 3.2 is not specific on this - but the examples only show the To address, and no unique identifier beyond that, so it might not work out well for you for mailto list-unsubscribes. It also prefers mailto over https. If we build this as a mandatory feature at MailPace, we'll use an HTTPS webhook with a unique identifier for the email, so if you unsubscribe from a list…

I believe iOS & Outlook.com only support the mailto:.
Post reply on HN