Live data from Hacker News

Don't verify email addresses by sending spam to them

milek7.pl

31–40 of 67 posts

Re: Don't verify email addresses by sending spam to them

#31
I have a Gmail address in the format of x.surname@gmail.com, which is obviously potentially applicable to tens of thousands of people.

The amount of misdirected mail I get is astounding. I literally just got a delivery updaye for hair removal cream, with the option to sign the unknowing recipient up to a paid for tracking subscription service.

The problem isn't just making sure the address is valid.

You need to ensure you're sending communications to the correct person.

Re: Don't verify email addresses by sending spam to them

#32
post #24

I just did a signup on a brand new email address and was not able to recreate. No random spam emails reported. Just a normal verification email. It's likely that the email the author received is pure coincidence. Especially if they are using a client that downloads emails in batches. FWIW it looks like their validation email is sent by Customer.IO via Mailgun. Both have squeaky clean service agreements so it's unlike…

Mailgun's validation API, presumably the underpinnings of Pangram's, returns more than a simple yes/no validity. My educated guess is that this is part of figuring out all of those extra fields. * https://mailgun.com/products/validate/ * https://documentation.mailgun.com/docs/validate/oas/openapi-...

This is a good bet, particularly this:

> Catch email addresses that have turned into honey pots

> Make smart decisions on who you should and shouldn’t send to using our risk score

Identifying honeypots is tricky business. Sending something that looks like obvious spam from random burner domains and seeing if it still gets delivered is not a bad way to do it.

Re: Don't verify email addresses by sending spam to them

#34
post #24

Earlier quoted context omitted.

Mailgun's validation API, presumably the underpinnings of Pangram's, returns more than a simple yes/no validity. My educated guess is that this is part of figuring out all of those extra fields. * https://mailgun.com/products/validate/ * https://documentation.mailgun.com/docs/validate/oas/openapi-...

This is a good bet, particularly this: > Catch email addresses that have turned into honey pots > Make smart decisions on who you should and shouldn’t send to using our risk score Identifying honeypots is tricky business. Sending something that looks like obvious spam from random burner domains and seeing if it still gets delivered is not a bad way to do it.

Yeah, but any site that uses signup email addresses to send spam should be immediately blacklisted. Sending spam to potentially legitimate email addresses is a really bad idea and should destroy any credibility you may have had.

Re: Don't verify email addresses by sending spam to them

#35

I just did a signup on a brand new email address and was not able to recreate. No random spam emails reported. Just a normal verification email. It's likely that the email the author received is pure coincidence. Especially if they are using a client that downloads emails in batches. FWIW it looks like their validation email is sent by Customer.IO via Mailgun. Both have squeaky clean service agreements so it's unlike…

This seems like crossing a fine line of legal vs the right thing. More than likely Panagram Labs is just on one of the customers using a third party API to get validation on the email. This third party API is the one who is abusing this technique most likely using pixel tracking for email addresses they havent seen before.

Partly fun part is what Panagram here has done is to expose an endpoint for anyone to transitively use the email validation API in their product

Re: Don't verify email addresses by sending spam to them

#36

I would make even stronger advice. If you want to verify an email, send me a one-time code with several hours expiry that I have to resubmit through my logged in web identity at your site. It drives me batty that a financial provider (retirement vendor from previous employer) won't seem to let my "paperless" setting remain active. Only because I don't ping their abusive email tracking pixels etc. To me, paperless mea…

To me, paperless means they ATTACH MY STATEMENT TO THE EMAIL. Not signing up to any paperless until they do, none yet have met this bar. The statement is supposed to be a snapshot of the status of the account at a given moment, if you have to open their website to view it they could regenerate it from whatever crap data they have lying around at the given moment. If it can change every time you look at it, it's a qua…

they send important (financial?) documents over email???? who tf does that what vendor is this

Re: Don't verify email addresses by sending spam to them

#37
post #23

Earlier quoted context omitted.

That'd be nice, but I'd even settle for the plain pdf attached to the email.

For things like financial records, I would not want plain PDF in the email. I think it needs encryption for confidentiality. I am geeky enough to use PGP or S/MIME if they had the option, but I can definitely see how vendors would see this as too fringe with retail customers. I would not like the typical "secure email" which is nothing more than a volatile link back into yet another website.

Hmm, yeah some people feel that plain emails are not secure for sensitive information. As a result, some banks provide a "secure email" box that's usually PITA to use.

It'd be great if there's a unified API for all financial institutes to provide sensitive info (statements, tax forms etc.) and you just need to run a software tool to download them once in a while or when you need it.

Re: Don't verify email addresses by sending spam to them

#38
post #23
post #18

Earlier quoted context omitted.

I really wish you could provide a PGP public key to your bank and have them just email the damn pdf every month.

That'd be nice, but I'd even settle for the plain pdf attached to the email.

Unencrypted sensitive data in an email is a really bad idea. I hope they never do that.

Although what I would really like, and think is long overdue, is an extension to email that normalises encryption and sender verification. It's ridiculous that email can be spoofed like that. (The same is even more true for phone numbers.)

Re: Don't verify email addresses by sending spam to them

#39
post #31

I have a Gmail address in the format of x.surname@gmail.com, which is obviously potentially applicable to tens of thousands of people. The amount of misdirected mail I get is astounding. I literally just got a delivery updaye for hair removal cream, with the option to sign the unknowing recipient up to a paid for tracking subscription service. The problem isn't just making sure the address is valid. You need to ensur…

I still have a gmail address that looks in no way like a name, and that's not stopping me from receiving some really weird misdirected email. Often my random collection of characters with some dots in between (apparently Gmail ignores dots in your name).

Re: Don't verify email addresses by sending spam to them

#40

There is a procedure common in mail sending where you ALMOST do this. You connect to their mail server, tell it you have a message for them, and wait to see if it rejects you or accepts the message. Then you disconnect without actually sending the message. I wonder if this is some kind of confusion among the devs behind this, or some benefit to really sending the message that I can't think of. Does it contain a track…

That's recipient testing based on mailbox name. I don't recommend that for spammers - its so trite and early 2000s.

I wont allow you to test deliverability to my email domains without you sending an email I can analyze and decide to allow or drop mid stream. I also get to drop it before you consider it sent. I obviously drop connections that just establish from and to and go weird after that.

Post reply on HN