Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs • Hacker News Board

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#251

Post by LoganDark » Wed, Jan 10, 2024, 11:07 PM UTC

93po wrote: post #188

LoganDark wrote: post #67

Earlier quoted context omitted.

Well, I wish my ISP would stop marking ads and promotions as "transactional". Just because they have a system that prohibits unsubscribing, doesn't mean they should be allowed to abuse that system.

I've had a website that sent me no fewer than 6 emails over the course of 10 days for a single transaction, 5 of which were full of ads and links to their website and products. I emailed them and asked them to stop and their response was there was no way to opt out, they were transactional for new accounts.

My ISP constantly sends me emails about "staying safe online" and "the holiday season". At the bottom of the email, it says "THIS IS A SERVICE-RELATED EMAIL", supposedly to excuse the lack of any unsubscribe link.

Unfortunately you are no longer allowed to take them to court over this, as their terms of service simply say you are no longer allowed to sue them :) just like all tech companies that know they're committing lawsuit-worthy offenses.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#252

Post by kragen » Wed, Jan 10, 2024, 11:16 PM UTC

QuadmasterXLII wrote: post #152

kragen wrote: post #87

Earlier quoted context omitted.

the standard approach is that unsubscribing sends an unsubscribe confirmation mail to the subscribed email address, replying to which confirms the unsubscription. nothing about logins or passwords or the web. this has been standard practice for 25–30 years

That’s gonna catch a report spam from me dawg

hopefully people like you won't be able to figure out how to subscribe to the mailing list in the first place

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#253

Post by kragen » Wed, Jan 10, 2024, 11:17 PM UTC

gbalduzzi wrote: post #185

kragen wrote: post #126

Earlier quoted context omitted.

if you think these are unrealistic, i've got news for you; the world is a lot bigger than you think it is

What kind of newsletters are you subscribed to

newsletters are irrelevant to this thread

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#254

Post by EGreg » Thu, Jan 11, 2024, 12:20 AM UTC

hedora wrote: post #248

EGreg wrote: post #241

Earlier quoted context omitted.

The "I'm sure" button is sensible since the session cookie confirms it's you. But that button requires a second click. That would violate the "single-click". According to the "single click" requirement, merely visiting the page by clicking the link in your email should be enough to unsubscribe you. Meaning, the GET request, which normally shouldn't change server state, should change server state. The major issue with…

They could also add an "oops! I didn't mean to unsubscribe; please resubscribe me" button to the landing page after you click. I've seen that before. As for the Apple ITP thing, they implemented a thing that looks for known trackers and strips them from emails. You're saying that this thing is incorrectly breaking the URL parameter for the opt out links? Is there an example of them actually doing that? It sounds like…

Apple has a history of gradually strengthening ITP until it breaks all the tabbos you'd never expect.

Today it strips ?utm=928931823 from abc.com/foo?utm=928931823 but tomorrow it can strip the 928931823 from abc.com/foo/928931823 leaving abc.com/foo ... after all it can just look at all the links arriving in mail, and use an algorithm to deduce the pattern abc.com/foo/:trackingId and simply mangle the URLs.

Think they'll never do it? They already deleted FIRST-PARTY cookies and much more!

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#255

Post by rstuart4133 » Thu, Jan 11, 2024, 12:26 AM UTC

kragen wrote: post #52

TheCycoONE wrote: post #25

DKIM, SPF, and DMARC are old hat and implemented by anyone serious for years. What's buried in this article is the required https://datatracker.ietf.org/doc/html/rfc8058 support for one-click unsubscribe posts. I don't see many messages in my inbox yet with that.

also it violates longstanding security measures against malicious prank unsubscribes; it means that if you forward an email list message to someone else, they can unsubscribe you without your consent as a prank

> it means that if you forward an email list message to someone else, they can unsubscribe you without your consent as a prank

Surely that is a bug in the email client that forwarded the email. It should have replaced the headers, including List-Unsubscribe, with its own.

That looks to be what's happened in the emails I receive. The one exception would be if someone forwarded an email as an attachment, but in practice almost no one does that.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#256

Post by persolb » Thu, Jan 11, 2024, 12:56 AM UTC

plg94 wrote: post #165

stubish wrote: post #59

Earlier quoted context omitted.

Kicking off a chain of emails a user cannot easily opt out of could well be the sort of emails users want to lose. There probably should be a one-click 'stop emailing me' button, for this and future purchases. Which would be a support burden, yes.

Some of these emails are legally required for online shops. Doesn't matter if the user wants to receive them or not, they _have to_ be sent and actually delivered to the user's inbox.

I'm not sure how the 'actually delivered' would be enforced. Does Google have an affirmative requirement to deliver a 3rd parties message? I hope not.

My gmail address received 35 emails yesterday (which didn't get spam filtered). All but 3 of those got auto-archived by the filters I have in gmail. I would love google to just do this automatically.

Practically I might need another message or two a week that didn't hit my inbox.... but that's fine as long as it's as it is still searchable.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#257

Post by anticorporate » Thu, Jan 11, 2024, 1:28 AM UTC

codalan wrote: post #249

anticorporate wrote: post #215

I find much of the discourse on these changes to be pretty amusing. It's a lot of sales and marketing teams asking how they can tweak things at a technical level so that they can keep doing the same things they've always been doing. You can't. That's the point. Stop. I mark all commercial email as spam. I never asked for it, I don't want it. I don't really care if you carefully constructed a form in such a way to be…

Sometimes I wonder if their mindset is, "Hey, even if only .05% engage w/ the marketing email, that's still > 0%!". Maybe their mindset should really be, "Hey, we're annoying 99.95% of our users who did not consent to these emails, and > 50% will be turned off to our product and will associate our brand to that of a needy, attention-grabbing parasite". If I wanted these emails, I would have opted in. Instead, not onl…

> If your sales and marketing team insist on these tactics, you need to fire them and hire people who get it.

So, full disclosure, in addition to being kind of an anti-spam zealot, my day job is running marketing operations at a big-ish software company. So I get the fun job of telling everyone from the junior intern to the senior VP that no, my team is not going to send that email for you. That no, in fact, I don't care what the old person in my job let you do, or what you did at your old company, or how many levels above me you are in the org chart. We're only going to email people what they asked for, at the frequency they asked for it, on the topics they asked to hear about. These new Gmail/Yahoo rules have helped immensely in making the case to our CMO to have my back.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#258

Post by guiambros » Thu, Jan 11, 2024, 2:57 AM UTC

josephg wrote: post #146

andersa wrote: post #123

Earlier quoted context omitted.

Why would you be receiving transactional emails for an account that isn't yours?

Hah. I have josephg@gmail. I sometimes wake up to threads of 6+ password reset attempts over an hour from someone who doesn’t know their own email address. For a couple years I got pay stubs. And monthly cell phone invoices from India. I think that email address gets more email for other people than email for me at this point.

Same. Flights trips -- including PNR. Invoices. School reports. Tons of telephone bills. Frequent Uber trips (somewhere in Africa, for some reason). The list goes on and on. And my email address is short but not that common, but still get hit a few times per week.

It really drives me crazy that none of them have any type of email confirmation before accepting an email address as valid.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#259

Post by JimDabell » Thu, Jan 11, 2024, 5:17 AM UTC

cj wrote: post #147

JimDabell wrote: post #141

Earlier quoted context omitted.

> you don't think engineers who build web crawlers cannot build email classifiers? Don’t put Google on a pedestal. I’ve seen Google Workspace classify an individual email sent from one colleague to another as spam. Both perfectly legitimate users in the same account / domain. No weird trigger words like Viagra. Just a run-of-the-mill email about work, between two colleagues who had been emailing each other for months…

I don’t disagree with you, but before assuming it’s the fault of gmail classifier I would look at Google Workspace admin configuration. There are a lot of settings that admins can tweak and toggle that can mess with email deliverability. You can even create specific rules that only apply when users within the same workspace are emailing each other. Google Workspace can even be configured to use an external smtp servi…

In this case it was a super-basic setup. Nothing weird going on, just an internal email within the same Google account, sent from the Gmail web interface and going straight to the spam folder for the recipient, no filtering rules or anything like that.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#260

Post by illiac786 » Thu, Jan 11, 2024, 6:04 AM UTC

ryandrake wrote: post #12

As a self-hoster for over a decade, setting up SPF, DKIM, and DMARC are pretty much once-and-done and free, so there's pretty much no downside. I'd be shocked if most self-hosters haven't set these up long ago.

I don't know if self hosted but I regularly get emails from companies where this has not been set up. And not "Joe's Car Detailing" but rather "medium size gas provider" ...