Spam unsubscribe links no longer considered harmful | Hacker News Reader

Spam unsubscribe links no longer considered harmful

essays.dayah.com

79 pointsblasdel25 comments

I just read the first 100 messages in my Gmail spam box. Five had unsubscribe links that were highly suspicious -- misleading .ru domains and GET parameters that could not possibly identify me. Four had links that were paired with US addresses and worked. Three had seemingly legitimate links that led to broken forms. The other 88 had no unsubscribe link in the body of the email.

I think the author's claim is correct. For emails that aren't patently absurd and contain a mailing address, clicking unsubscribe links seems like a good idea. Unfortunately for me, I'm stuck with the other 96%.

  Unfortunately for me, I'm stuck with the other 96%.

I would say "Fortunately for me, Google is stuck with the rest."

About once a year, spammers find a way around Google's spam filters for 3-4 weeks, which means I might see a non-flagged spam message show up in my mailbox every couple of days. Beyond that, I don't even think about spam anymore (including worrying about false positives, which I haven't seen in years [if at all]).

Above and beyond everything else positive or negative about Google, this one thing will cause me to always have a warm place in my heart for Google.

Ironically, I looked in my spam folder today just to see what percentage were the ".ru" type and...found a message from Twitter that got delivered yesterday saying how they are going to switch to OAuth on 8/31 (Really, twitter, a month late? [and it wasn't Google, since I got the message for two accounts for two email addresses yesterday]).

I'll bet soldiers don't get spam [snail] mail either.

Not suggesting that Google staff are reading all your mail but they're getting something out of the content there aren't they?

Do they parse it for trend words and use those advertising to you?

(Half-baked thinking, so may or may not work.)

Anyone else wonder if unsubscribe links couldn't be shifted to the mail client somehow? That way, they could be positioned in a uniform place and handled in a simple way so that you didn't have to scrounge through an email footer looking for the 5px unsub link, and then go through that horrible 'You need a password to unsubscribe' process half the time.

I'm imagining an 'unsubscribe' button up near the top of the email, maybe based on mail headers or something else, that just worked. You clicked it and you were off the list. (Might need ways to verify the identity of the subscriber, but I'd hope this could be handled better than it is now.)

Gmail already does this - if you have the List-Unsubscribe header set up, when someone clicks on the "Spam" button, it asks them whether they want to unsubscribe as well. If they say "yes", an email gets sent to the unsubscribe address with "Unsubscribe" as the subject.

I think I've seen that once (not a big Gmail user yet).

Would love to see it in all mail clients, and useful for all subscriptions. A 1998 RFC and a basic attempt from one webmail provider is a bit depressing in 2010 when most of us get hammered by these sorts of messages.

The people who would comply with that header are the sort of people who probably already had a very easy to find unsubscribe link.

I take your point, but that link is still down the bottom of a long newsletter (that I already don't want to read), in small, faint type. And then half the time, the unsubscribe process will involve a password, verification of the email sent to (which often could be one of a few), or waiting for an 'are you sure' link to be emailed.

I don't think I'm alone in refusing to believe that the processes here (and all around email) couldn't be improved!

Yup, that's fair. I think best practice in email design is to put the unsubscribe at the top and bottom.

And I would point out that requiring a password or a verification email is almost certainly a violation of CAN-SPAM.

Gmail sometimes does this when a message is reported as spam. It will ask if you want gmail to attempt to automatically unsubscribe you. I assume that the emailer provides some sort of header info to gmail that allows it to do that, perhaps to receive a higher likelihood of not getting put in the spam folder to begin with, but I do not know. See:

http://mail.google.com/support/bin/answer.py?hl=en&ctx=m...

It already exists: RFC2369 http://www.faqs.org/rfcs/rfc2369.html

I would like to see a longer term test before I start doing this.

If the spam picks back up, it might not be worth the time.

Right, because any anti-spam measures need to be measured over a longer time frame to see if they have significantly reduced the spam.

That said, for me, spam is hardly a problem with the SpamBayes plugin for Outlook. It does get a few false positives, but none that badly. A check every few days catches anything. It also flags a lot of subscribed-for spam, which is OK by me as I don't see why I need a monthly update on my frequent flyer miles, something I can always go looking for.

For all the many faults with CAN-SPAM, up to $16,000 per-message penalties for failure to comply with an opt-out isn't such a terrible idea.

Problem is, you can send mail to the US from outside of the US.

(Spam isn't about being relevant, it's about volume. Even if you can't actually buy the product being advertised, you still have to delete the mail. So while this is a little helpful, it's doesn't really make much difference in spam volume.)

And you can send mail from the US to outside the US. CAN-SPAM is irrelevant to most of the World. I actually have a score in my spam filter for email bodys matching /\bCAN-SPAM\b/i as emails claiming to be "CAN-SPAM compliant" are almost always junk.

Unfortunately, since the messages sent by spammers that "came into the light" (good spammers?) and by those who did not are so similar, even legitimate unsubscribe links are effectively too risky.

Just like with the failure micropayments (see http://openp2p.com/pub/a/p2p/2000/12/19/micropayments.html), it just requires too much mental analysis to make an educated guess about whether an unsubscribe link is legit, versus confirming my address as "working" and increasing its use by other spammers (e.g., inclusion in sold lists of "verified working email accounts").

Due to the confusion, I have to fall back on the KISS rule: When in doubt, do not provide my email address, or the fact that my email address is a working one, to someone I don't know (or who just spammed me, no matter how much "in the light" they may seem to be).

Since forcing me to sign up and give my credit card info to download free apps, Apple has been regularly sending me spam. The opt-out link is a 404.

So little spam makes it through to my inbox that it seems like this approach would take more time than it is going to save. Interesting observation though.

They never were, it was a myth.

Edit: Site's back up.

Works fine for me.

Yup, works now.

groupon has become spammy to me

Reply on news.ycombinator.com