Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hey developers, stop forcing me to login to unsubscribe

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 137 posts

Re: Hey developers, stop forcing me to login to unsubscribe

#71

Post by mmahemoff »

bryanh wrote: post #69
mmahemoff wrote: post #67

Earlier quoted context omitted.

I'd be interested if you have details on handling single-click login as securely as possible.

Sure! Basically, reuse a lot of signing functions that you might find in a library (IE: Django's https://docs.djangoproject.com/en/dev/topics/signing/ ), don't roll your own. Then, keep track of last login IP address and block auto-logins when they mismatch. Then, set a max age for the login links to work (for example, 24 hours). There are a few other things we do as well, but those are the major ones. Those three co…

Thanks. You said "last login IP". If it's a single IP, I guess you're talking about transactional mails the user has triggered. If it was marketing mails, you'd surely want to compare against a list of recent IPs, not just the very last, wouldn't you?

Re: Hey developers, stop forcing me to login to unsubscribe

#73

Post by sourc3 »

camus2 wrote: post #10

Easy for me , no direct "unsubscribing" => spam box. If you provide a newsletter the last thing you want is to be flagged as spam, so think about it.

This is exactly what I do. I believe that developers (or site owners) need to think about the state of mind of the user. If they are trying to unsubscribe, they must think that they should not be contacted by you or want not much to do with your site. If you ask them to log in to your site to complete their "do not bother me" action, they will take more drastic measures such as marking it as spam. UX is important, even when users leave your service.

Re: Hey developers, stop forcing me to login to unsubscribe

#74

Post by stephen_g »

dreese wrote: post #33

Yes. Especially when someone else mistyped their email address, you did not ask for confirmation, and now I get endless emails without the ability to sign out. So I just mark everything as spam, which I know isn't what you were hoping for. :)

One of my email addresses is very generic, and I get the same thing all the time - at least one random signup a week... Please, please, please - anybody who has sites that has a signup, the very first thing after saying "Thanks for signing up for [service]" should be "If you didn't create this account, click here" with a link to disassociate the email from the account and never email me again!

It's ridiculous how hard some services make it. Especially banks - I had someone in the US sign up for a bank account with my email, and I was getting fairly important sounding emails (like "your account had insufficient funds to pay [automatic bill payment]" and stuff), and there was almost nothing I could do - to contact the bank, you had to log into your account and use the "secure contact form" or phone them (which would be an international call, annoying time zones, etc.). I stopped getting emails eventually so they must have figured it out eventually!

Re: Hey developers, stop forcing me to login to unsubscribe

#75

Post by georgemcbay »

sker wrote: post #21

Companies like LinkedIn are training users (at least me) to report as spam instead of unsubscribing because it's an exercise in futility to try to opt-out of their spam.

I've been doing this for years and don't feel the least bit bad about it, and I think everyone should adopt this practice.

If marking as spam or unsubscribing are approximately equal effort, I will unsubscribe; if unsubscribing is even slightly more difficult than marking as spam, I mark as spam with no regrets. Even if you don't force me to login but make me do some monkey trick like type "CANCEL" into a box => spam! One click is the only acceptable method, and don't hide the link in a bunch of small print legalese, because I'm not going to expend much effort looking for it while the nice, inviting "Mark as Spam" button is just sitting there waiting for me to click it.

Re: Hey developers, stop forcing me to login to unsubscribe

#76

Post by AYBABTME »

Cyranix wrote: post #24

Hear, hear. If you're worried about legit customers getting unsubscribed against their will (because that is TOTALLY a significant occurrence...), you can have a dual approach. Unsubscribing without authentication sends one final message which has an undo link; unsubscribing while authenticated shows a confirmation on the site instead of the inbox. I know, the "Here's an email to confirm that you hate our emails" mes…

Do you have an example in mind of what makes that a significant occurrence?

Re: Hey developers, stop forcing me to login to unsubscribe

#78

Post by chilldream »

http://xkcd.com/1279/

This happens to me about twice a year (not a firstname.lastname, but a commonword.commonword. It's like a stupidity-driven dictionary attack). The worst companies I've had to deal with:

Steam - took me multiple emails over the course of weeks, and they actually made me send them screenshots to prove the account was mine. I only went to this much trouble because I have a legit Steam account. Especially funny since I casually told them that I was a hair trigger away from just resetting the idiot's password and hijacking his account.

AT&T - Flat-out refused to unsub me from someone else's phone bills. After several calls to AT&T I finally gave up and called the customer. An AT&T rep actually had the balls to tell me that making me do this was for the customer's protection.

Re: Hey developers, stop forcing me to login to unsubscribe

#79

Post by dgabriel »

chilldream wrote: post #78

http://xkcd.com/1279/ This happens to me about twice a year (not a firstname.lastname, but a commonword.commonword. It's like a stupidity-driven dictionary attack). The worst companies I've had to deal with: Steam - took me multiple emails over the course of weeks, and they actually made me send them screenshots to prove the account was mine. I only went to this much trouble because I have a legit Steam account. Espe…

For real. Today alone, I got someone else's golf course information (twice) and Valvoline receipt. I hate golf, and am deliberately car-free. I just mark it as spam now.

Re: Hey developers, stop forcing me to login to unsubscribe

#80

Post by jamesbritt »

chilldream wrote: post #78

http://xkcd.com/1279/ This happens to me about twice a year (not a firstname.lastname, but a commonword.commonword. It's like a stupidity-driven dictionary attack). The worst companies I've had to deal with: Steam - took me multiple emails over the course of weeks, and they actually made me send them screenshots to prove the account was mine. I only went to this much trouble because I have a legit Steam account. Espe…

I get these as well, roughly once a month.

Getting that first E-mail is not too bad; having to sign in to a service I never signed up for in order to stop the e-mail is the pain-point.

I wish more companies would require e-mail verification before activating accounts and sending out a flood of messages. It would also protect their customers, because it is quite easy to request a password reset and then, say, go dick with someone's data-populated chat-app settings.

Post reply on HN