Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

mailgun.com

Post reply on HN
Print view View original

241–250 of 279 posts

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#241

Post by EGreg »

hedora wrote: post #226
EGreg wrote: post #192

Unsubscribe HAS to require an authenticated session. What do they mean by “single click”? Otherwise anyone who receives a forwarded email can unsubscribe you! Right? At least we can email the peson to say they’ve been unsubscribed, as a transactional email? And give them a chance to resubscribe and prevent such unsubscriptions — or what? Enable easy unsubscription: Senders will need to implement a single-click unsubs…

It certainly does not require authentication. Have you used unsubscribe flows? Normally, you click once, it goes to a web page that displays your email address, and has an "I'm sure" button, and maybe some checkboxes to only partially unsubscribe. If you really care about people being maliciously unsubscribed from marketing materials they forwarded around, then you can be one of the sites that sends a final "you have…

The "I'm sure" button is sensible since the session cookie confirms it's you. But that button requires a second click. That would violate the "single-click".

According to the "single click" requirement, merely visiting the page by clicking the link in your email should be enough to unsubscribe you. Meaning, the GET request, which normally shouldn't change server state, should change server state.

The major issue with that is, if you forward the email, you are giving the capability to anyone else to act as you. It's a horribly insecure model, it also breaks HTTP semantics, but at least you can limit it to the "unsubscribe" action, I guess. Could be worse. Google could require other "single click" actions that may modify your profile or withdraw money from your bank account.

The only mitigation I can see is that the "you've been unsubscribed" email is a transactional email, and can inform the user that "if it wasn't you, then click here to restore your subscription to this newsletter, and don't forward your emails anymore, because Google says someone can unsubscribe you anytime and we can't do anything about it."

PS: Ironically, Apple's newest ITP scrubs information from tracking links in emails, so in theory it would make it impossible to even track whose account to unsubscribe from. "It will do this by automatically detecting user-identifiable tracking parameters in URLs and removing them." Apple ITP anti-tracking requires you to explicitly log in before doing stuff as you. Google now requires the opposite. It's impossible to satisfy both. https://www.peelinsights.com/post/ios-17-disrupts-link-track...

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#242

Post by djbusby »

gsharma wrote: post #213
dexwiz wrote: post #68

Earlier quoted context omitted.

Its 5000/day for marketing, and if you are sending 5000 emails a day, you probably should have unsubscribe links. https://support.google.com/mail/answer/81126#requirements-5k You also need a link, not just list-unsubscribe, and it is specifically for marketing emails. In my experience, Google is pretty accurate in figuring out transactional versus marketing. They don't tell their heuristics, but you don't think engin…

> but you don't think engineers who build web crawlers cannot build email classifiers? I’ve seen Gmail put legit update emails coming from Google itself in spam.

And yet obviously fake Drive shares from "Wells Fargo" or "Chase" get delivered to Inbox

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#243

Post by atesti »

zie wrote: post #178
atesti wrote: post #140

Earlier quoted context omitted.

I have seen Outlook and other systems click on every link in our mailings. Using a sandboxed browser. How can one click unsubscribe work here? Mail scanners, virus scanners and even Microsoft's own spam filters would probably click these links!

The unsubscribe links are POST, not GET's. That's basically the entire safety net.

Really? I have not seen a html element in an email in decades! Do you mean a list-unsubscribe header? I mean the hyperlink at the end of an email with "unsubscribe". I think it would be good if that unsubscribe link opens a page where one would need to press one more button to prove that it is not automatically involved by url scanners. But this would not be "one click" unsubscribe anymore. So how can this be solved? Why is not everybody constantly auto-unsubscribed who uses office 365 or hotmail?

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#244

Post by zie »

atesti wrote: post #243
zie wrote: post #178

Earlier quoted context omitted.

The unsubscribe links are POST, not GET's. That's basically the entire safety net.

Really? I have not seen a html element in an email in decades! Do you mean a list-unsubscribe header? I mean the hyperlink at the end of an email with "unsubscribe". I think it would be good if that unsubscribe link opens a page where one would need to press one more button to prove that it is not automatically involved by url scanners. But this would not be "one click" unsubscribe anymore. So how can this be solved?…

I was talking about https://datatracker.ietf.org/doc/html/rfc8058. Where the URL is in the headers as List-Unsubscribe:

A 2 page overview is here: https://certified-senders.org/wp-content/uploads/2017/07/CSA...

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#245

Post by jdhawk »

ubermonkey wrote: post #168

Mailgun is a spammer, so, like, cry me a river? I have them blocked at the server level because of how much spam they were sending me. They clearly do zero enforcement of opt-in.

how are they supposed to enforce it?

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#246

Post by [deleted] »

sylware wrote: post #239
chuckadams wrote: post #237

Earlier quoted context omitted.

I'd ask you to show me the relevant section in RFC4408 that backs up your claims about header fields, but honestly I don't care to read any more incoherent rambling screeds on the topic. Cheers.

chatgpt?

[deleted]

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#248

Post by hedora »

EGreg wrote: post #241
hedora wrote: post #226

Earlier quoted context omitted.

It certainly does not require authentication. Have you used unsubscribe flows? Normally, you click once, it goes to a web page that displays your email address, and has an "I'm sure" button, and maybe some checkboxes to only partially unsubscribe. If you really care about people being maliciously unsubscribed from marketing materials they forwarded around, then you can be one of the sites that sends a final "you have…

The "I'm sure" button is sensible since the session cookie confirms it's you. But that button requires a second click. That would violate the "single-click". According to the "single click" requirement, merely visiting the page by clicking the link in your email should be enough to unsubscribe you. Meaning, the GET request, which normally shouldn't change server state, should change server state. The major issue with…

They could also add an "oops! I didn't mean to unsubscribe; please resubscribe me" button to the landing page after you click. I've seen that before.

As for the Apple ITP thing, they implemented a thing that looks for known trackers and strips them from emails. You're saying that this thing is incorrectly breaking the URL parameter for the opt out links? Is there an example of them actually doing that? It sounds like it would be a bug if it is happening.

I've also noticed that many places interpret "one click opt out link" to mean you have to click once on the resulting page, technically making it two clicks, but also preserving HTTP get vs post semantics.

I suppose they could also make it two clicks for people that are using text-only mail clients and will therefore send a get, but to use HTML to arrange for it to be a post for everyone else.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#249

Post by codalan »

anticorporate wrote: post #215

I find much of the discourse on these changes to be pretty amusing. It's a lot of sales and marketing teams asking how they can tweak things at a technical level so that they can keep doing the same things they've always been doing. You can't. That's the point. Stop. I mark all commercial email as spam. I never asked for it, I don't want it. I don't really care if you carefully constructed a form in such a way to be…

Sometimes I wonder if their mindset is, "Hey, even if only .05% engage w/ the marketing email, that's still > 0%!".

Maybe their mindset should really be, "Hey, we're annoying 99.95% of our users who did not consent to these emails, and > 50% will be turned off to our product and will associate our brand to that of a needy, attention-grabbing parasite".

If I wanted these emails, I would have opted in.

Instead, not only do they automatically opt you in, but they'll re-opt you in after you've unsubscribed. I've had it happen a year or two later; suddenly, I'm back on their spam list.

It's become so bad now that I can't even let a shopping cart sit anymore without getting a nagmail saying "HEY YOU NEED TO FINISH CHECKING OUT NOW1!!!".

That email is the reminder to empty my cart and never do business with them again.

Seriously, STFU and leave me alone. If your sales and marketing team insist on these tactics, you need to fire them and hire people who get it.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#250

Post by stubish »

kragen wrote: post #127
stubish wrote: post #70

Earlier quoted context omitted.

Forwarding an email should strip this header, probably along with most of the other irrelevant ones potentially containing sensitive information the user isn't aware of. Forwarding an email with GMail only keeps the From, To, Date and Subject headers.

i feel like if we're talking about a header the user isn't aware of, most users probably won't be able to use it to unsubscribe either

End users won't use the header. Email clients will use the header when you hit the report spam or unsubscribe buttons they will display.
Post reply on HN