Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browsing your website does not mean I want your spam

medium.com

Post reply on HN
Print view View original

21–30 of 251 posts

Re: Browsing your website does not mean I want your spam

#21

Post by sp332 »

trjordan wrote: post #15

> This transaction breaks a core promise using the internet: just because I visit a website doesn’t mean I consent to getting spam from it. No it doesn't. There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. I'm not condoning this behavior, but we're in territory that we don't have prior art for. It used to be totally fine for one shopkeeper to mention to anoth…

This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. You shouldn't be allowed to pretend that visiting a site is a solicitation.

Edit: I misunderstood the mechanism of collecting the addresses. This isn't skirting "unsolicited mail", but it is circumventing the ban on harvested email addresses.

Re: Browsing your website does not mean I want your spam

#22

Post by jamiesonbecker »

tl;dr: related: Amazon sold (or gave) my secret Amazon email address to third parties without my express consent rather than using their remailers.

I have exactly one email address that I use for Amazon, and I've never used it elsewhere for anything else.

I occasionally receive emails from vendors (through the vendors' mail servers themselves, not remailed through Amazon per mail headers) at Amazon that I have bought things from (via one-click) as gifts and I am 100% sure I never gave them my email address or replied to any email from them.

An example vendor is a large outdoor clothing store that I bought a North Face jacket for a relative from. I'm now on their mailing list. In the ultimate irony, I could just click unsubscribe but it's actually good stuff ;)

Thanks, Amazon.

Re: Browsing your website does not mean I want your spam

#23

Post by jamiesonbecker »

sp332 wrote: post #21
trjordan wrote: post #15

> This transaction breaks a core promise using the internet: just because I visit a website doesn’t mean I consent to getting spam from it. No it doesn't. There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. I'm not condoning this behavior, but we're in territory that we don't have prior art for. It used to be totally fine for one shopkeeper to mention to anoth…

This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. You shouldn't be allowed to pretend that visiting a site is a solicitation. Edit: I misunderstood the mechanism of collecting the addresses. This isn't skirting "unsolicited mail", but it is circumventing the ban on harvested email addresses.

> You're not allowed to send unsolicited emails.

Actually, you ARE allowed to send unsolicited email, even commercial (UCE). It has to be clearly labeled, contain the postal address of the sender, and contain unsubscribe links. Also, CAN-SPAM only applies to senders in the U.S. (unfortunately).

https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicabi...

Re: Browsing your website does not mean I want your spam

#24

Post by [deleted] »

trjordan wrote: post #15

> This transaction breaks a core promise using the internet: just because I visit a website doesn’t mean I consent to getting spam from it. No it doesn't. There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. I'm not condoning this behavior, but we're in territory that we don't have prior art for. It used to be totally fine for one shopkeeper to mention to anoth…

[deleted]

Re: Browsing your website does not mean I want your spam

#25

Post by pdkl95 »

r1ch wrote: post #5

I've had several companies ("data partners" they call themselves) approach us to add these scripts to our websites. All of the ones I've seen use MD5(email) for the "anonymous hashing". I mentioned our privacy policy doesn't allow us to give out user emails, and their marketing guys never seem to understand that MD5(email) is basically the same thing. I even made a video example https://www.youtube.com/watch?v=ViCjzJ…

> video example

Computerphile recently did a similar example of cudahashcat using a variety of strategies to break passwords. Their goal is to scare people into using better passwords, but the principle is identical to de-anonymising emails. Maybe it can help convince stubborn people?

https://www.youtube.com/watch?v=7U-RbOKanYs

If nothing convinces the marketing guys, maybe it's time to pull rank and ask to see the CS degree they are basing their opinion on?

Re: Browsing your website does not mean I want your spam

#26

Post by Bartweiss »

gwbas1c wrote: post #6

This is why I own my own domain and have a catch-all email address. When I give a company my email address, I use (companyname)@domain.com. They all forward to gmail; where it is very easy to filter out (companyname)@domain.com once shenanigans like this happen. It's also easy to track down and shame companies for doing this, too.

Even for Gmail users, the + notation will handle this well. foobar@gmail.com and foobar+SearsSoldMyEmail@gmail.com will both direct to the same location, and relatively few resellers have the sense to strip the extra data.

Re: Browsing your website does not mean I want your spam

#27

Post by jamiesonbecker »

danjc wrote: post #18
joesmo wrote: post #3

I'm not going to wait for legislation to fix problems I can fix myself. You don't want this to happen? Make sure you have ad-blocking and third party tracker blocking on. I go a step further and use 'Quick JS Switcher' for chrome. By default JS is off and I only turn it on for sites I want. The percentage of sites that I turn it on for is minuscule. I'm seriously starting to question why this isn't the default setup…

Surely you must use some SaaS?

I'm just checking out that plugin now (awesome plugin btw) and turning on JS remembers that hostname for the future. I haven't dug into the code yet though so can't vouch for its safety..

Re: Browsing your website does not mean I want your spam

#29

Post by Nadya »

Bartweiss wrote: post #26
gwbas1c wrote: post #6

This is why I own my own domain and have a catch-all email address. When I give a company my email address, I use (companyname)@domain.com. They all forward to gmail; where it is very easy to filter out (companyname)@domain.com once shenanigans like this happen. It's also easy to track down and shame companies for doing this, too.

Even for Gmail users, the + notation will handle this well. foobar@gmail.com and foobar+SearsSoldMyEmail@gmail.com will both direct to the same location, and relatively few resellers have the sense to strip the extra data.

I do this but note that '+' will invalidate your email on some sites and can't be used to begin with. Yay for poor email validation! Gmail ignores `.` in email addresses so you could also try `y.o.u.r.e.m.a.i.l@gmail.com` which will validate in more places - but then you can't pinpoint where exactly unless you start keeping track in a complex spreadsheet. But you will know that somewhere you signed up for sold your email address.

[0] https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

Re: Browsing your website does not mean I want your spam

#30

Post by techsupporter »

Bartweiss wrote: post #26
gwbas1c wrote: post #6

This is why I own my own domain and have a catch-all email address. When I give a company my email address, I use (companyname)@domain.com. They all forward to gmail; where it is very easy to filter out (companyname)@domain.com once shenanigans like this happen. It's also easy to track down and shame companies for doing this, too.

Even for Gmail users, the + notation will handle this well. foobar@gmail.com and foobar+SearsSoldMyEmail@gmail.com will both direct to the same location, and relatively few resellers have the sense to strip the extra data.

The problem with the + notation is twofold: First, not all places accept the + character; second, you've now revealed your actual e-mail address (since foobar@gmail.com is just as valid as foobar+dontspamme@gmail.com).

I use a subdomain with catch-all, like me.example.com. Everybody is fine with subdomains and then I can use companyname@me.example.com. Using that format doesn't expose my actual e-mail address and makes it easy to filter (if match companyname, immediately bin and never tell me).

Post reply on HN