Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

281–290 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#281

Post by lopis »

sleepyhead wrote: post #174
tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

This is exactly why GDPR exists. What you are describing is illegal in the EU. Sending marketing communication requires clear opt in consent.

Even European Websites do this. I know that in principle I never check the "I want to receive spam" but I still do and still have to unsubscribe later.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#282

Post by cookiengineer »

If you are running your own postfix MTA and those mass email providers keep spamming you even when you write their abuse@ teams: I created a simple anti spam tool/blocklist generator that can be integrated with postfix's postmap format, because spamhaus was totally useless for those providers. [1]

It's trying to be dead-simple, and also blocks the alternative ASNs these spam providers have in reserve. Haven't found a fully automated way yet because whois protocol is kinda broken, but I'm working on it.

[1] https://github.com/cookiengineer/postfix-spamdb

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#283

Post by greyface- »

somehnguy wrote: post #234
ACow_Adonis wrote: post #218

Earlier quoted context omitted.

i can't be the only oldskool person on hacker news who knows not to click on unsubscribe buttons because it just identifies you as a legitimate email/mark... these are spammers, not cases where you ever actually signed up to some kind of legitimate newsletter or discussion group. to pretend good faith is your first mistake...

That's the case for spam sent by illegitimate parties (actual spammers), but any real company (what OP is referring to) will respect the unsubscribe button because they're at risk of being sued otherwise. Clicking unsubscribe in those cases actually does work & doesn't put you at risk of anything.

> they're at risk of being sued

I think this risk is overstated. Individual spam recipients in the United States have no standing to sue under CAN-SPAM; only the FTC does, and there's a high bar to get their attention.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#284

Post by JoshTriplett »

aqfamnzc wrote: post #272
kevin_thibedeau wrote: post #259

Earlier quoted context omitted.

It gets better when you have your own domain and you can register with throwaways using spamco@mydomain.

I've started doing this about a year ago, but I haven't nailed down an easy way to blacklist addresses from my catch-all. Do you know of a painless way to do that?

Don't use a catch-all. List specific allowed addresses, and remove them (after reporting) if they become spam sources.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#285

Post by appplication »

pests wrote: post #243
tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

NextDoor is the absolute fucking worst with this. They sign you up to 10+ lists each in over 9+ categories that results in what feels like 100 different "notification types". Unsubscribing from an email just unsubscribes from that one list. They don't show any other lists or categories (or imply there are more) during this process. Once you login you are greeted with a multi-page disaster to manually untoggle each of…

Yes I ran into this the other day when I tried Nextdoor out for the first time. I was actually so in awe of the insane and sociopathic dark pattern that is their email/notification subscription system that I immediately deleted the app. I don’t want to be a user on a platform that treats its users with so little respect.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#286

Post by JoshTriplett »

thaumasiotes wrote: post #190
starttoaster wrote: post #154

Earlier quoted context omitted.

Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself that you put down when you don't want to put your own email in? I just cannot fathom any reason for you doing this that isn't just malice. Surely nobody is just so _lazy_ that they intend to screw over their friends over a minute or two process making an account.

> Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself Have you tried doing this recently? Creating an email address has become a fairly draconian process.

If you want an account for legitimate mail, fastmail and gandi both make it trivial to add another email alias.

If you want an account for random garbage that demands an email address, use mailinator.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#287

Post by cuu508 »

kijin wrote: post #273
robocat wrote: post #267

Earlier quoted context omitted.

I think you are mostly wrong. OP is complaining they sometimes have to enter their email address - that is absolutely unnecessary make-work. The page can prompt the email address, and have a simple unsubscribe button. Not perfect, but okay. Even better, one-click unsubscribe features (e.g. Gmail's App) are presumably set up to work for the current recipient (not the original sender) so the problem is resolved for any…

Not everyone uses Gmail or a modern email client that understands the one-click List-Unsubscribe protocol, so senders must include an HTML unsubscribe link in the body of the email in order to comply with relevant rules in all jurisdictions. That link, unfortunately, can fall prey to the shenanigans I mentioned above. I understand the parent's sentiment because we all want to unsubscribe from unwanted emails. But tec…

> Imagine that you silently unsubscribed an open-source maintainer from all github notifications!)

Do open-source maintainers forward around their unsubscribe links in practice?

The other problem with email scanners clicking links automatically can be solved without prompting for the email address. One simple solution is: if the link is clicked within a minute or so after sending the email there's a chance the clicker is an automated system. Instead of unsubscribing right away, serve a HTTP POST form with a single "Confirm Unsubscribe" button. Normal users will rarely see the form, automated systems will hesitate to fire off HTTP POST requests.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#288

Post by nirvdrum »

figassis wrote: post #219
sph wrote: post #195

Earlier quoted context omitted.

If I'm certain I don't know the company, or I know the company but there is no unsubscribe button, it goes straight to Spam, no questions asked. A decade ago I went to my country's embassy to renew my passport, and they now use my email to subscribe me to the newsletters of any new political party. All unsubscribe links just 404s. Shameful behaviour. Anything I receive from any of their political candidates goes stra…

There's worse. An unsubscribe link that asks you to submit your email. Few things anger me more, because they went through the trouble of pretending to comply, and a decision was made to make my day more difficult.

Hulu did (does?) this and the form rejected my email address as invalid because the domain portion had three parts to it. Of course, they were able to continue sending me emails so some system knew it was valid. It was likely a bad assumption an engineer made somewhere, but all the more reason to use unsubscribe links that are already tied to the email address.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#289

Post by charcircuit »

gsich wrote: post #205
starttoaster wrote: post #200

Earlier quoted context omitted.

Yeah, I just made a new google account today. It takes about 2 minutes. You need a birth date (easily lied about), a phone number (it's google, they have your phone number already, no reason to lie) where they will send you an 8 digit code for you to confirm, then type in your desired email address and your password. Hardly draconian. Viola, you have a gmail account. You can do more to ensure you're the only one that…

Phone number is draconian.

Google doesn't require a phone number if your ip / whatever they are doing to profile you has good reputation

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#290

Post by janosdebugs »

legitster wrote: post #204
janosdebugs wrote: post #152

Earlier quoted context omitted.

What was the legal reasoning behind this?

If someone gets forwarded the email and they take action based on another person, or erroneously get unsubscribed by an email scanning tool, those are no-no events according to our lawyers. Keep in mind our webforms you can put whatever email you want in them. But something to do with the fact that we are knowingly storing the information and it crosses to another system.

That shouldn't stop you from including such a link in the header and keep the non-oneclick link in the footer. Nowadays, emails are forwarded embedded, not as EML attachments, so the header link wouldn't be included. You have to jump through hoops to forward as EML.
Post reply on HN