Hacker News Reader

Story time! Recently, I've been thinking back to when lack of SSL was a huge, widespread problem on the Internet. This was back in the mid 2009-2010's, and at that point, one company in particular was lagging: Facebook.

So some random person made a browser extension that automatically collected the login credentials of everyone who opened Facebook on whatever public network you were connected to.[0] Then they publicly released it for free. Ironically, the very first comment in the article I link here is, "Okay, it's evil, but how is this news?"

But the Firesheep plugin was a really big influencing factor in forcing not just Facebook, but a number of companies to switch their entire sites to HTTPS.

The point I'm trying to make is not that you should go out and blow up the world to make a statement -- it's that it's possible for there to be a problem that's trivial to exploit, and that is regularly exploited by criminals and businesses, and that is widely known to be exploitable, and for some reason people will still ignore it.

But if it's personal, if your next-door neighbor or your weird coworker can suddenly start doing it, then something clicks and people realize, "Oh, this is actually a real problem."

There's no technical difference between what Superhuman was doing and what every other marketer is still doing, but people are weird about what exactly they're willing to care about, and if the Superhuman controversy can be used to direct some of that anger towards structural, useful goals, then is that really a problem?

I understand that sometimes the specific triggers that make people care are stupid, but my response to that is never to ask people to care less. It's already hard enough to make people care about things.

[0]: https://lifehacker.com/firesheep-sniffs-out-facebook-and-oth...

Fair point, the last thing I want to do is make people care less about privacy. I will say the one difference here is I think there are a lot of people who use this tracking for their day to day job, so its not just a random gray hat who is exploiting ignorance, in this case there are hundreds of thousands of people who are using this daily.

Yeah, people use tracking in their day to day jobs in specific contexts. The reason this generated so much outrage is that it’s not the expected behavior (thank God) for all business emails to contain tracking pixels.

> But if it's personal, if your next-door neighbor or your weird coworker can suddenly start doing it, then something clicks and people realize, "Oh, this is actually a real problem."

What is "it"? Knowing I read an email they sent me? That's not what criminals and businesses are doing; criminals and businesses build extensive personalised profiles of who you are, what you like, what times you're active, where you go, who your friends, family and coworkers are and what your personal trigger points are all for the goal of exploiting you. They use email tracking as a single metric among dozens of others, and the way they evaluate the metric is completely different to how an individual would evaluate it. That data is usually then sold to other groups that do the same thing.

How is that anywhere even close to an individual with email read receipts?

I don't think anyone would say "this is actually a real problem" besides people manufacturing a problem out of nothing. I'm also willing to bet that 99.9% of the people that are outraged are totally willing to establish, work for, or implement an extensive user tracking system for a company that actually acts on malicious grounds (such as monitoring users or for the objectives of making sales).

This includes you - by the way - a quick look through your resume shows that every single company you've worked for heavily participates in tracking and the first personal website of yours I accessed at reset-hard.com includes Google tracking which is dozens of times worse than a "weird coworker" knowing you read an email they sent. This is literally contributing to a global database of user tracking which we know is used for malicious purposes.

> I understand that sometimes the specific triggers that make people care are stupid, but my response to that is never to ask people to care less. It's already hard enough to make people care about things.

When people care about the wrong things is when we end up with homosexuality being criminalized, prohibition or terrorist groups. So hopefully in this case - just like many others - people would focus their energy into things that actually matter. And personal email tracking is not one of them - and will never be.

We could break down each of your personal accusations: some of them are fair and some of them aren't. But you don't really care about any of that. You're not trying to make a point here beyond, "you're hypocritical and therefore your obsession over privacy is unimportant."

The only thing worth saying on that topic is that it matters very little what you (or anyone else) thinks of me, whether it be good or bad. I don't even judge myself that way; I only care about trying to be better tomorrow than I am today. Anything else is a waste of time. And certainly, my response when I encounter hypocrisy is to try and fix the hypocrisy. Not to throw up my hands and say, "well, I guess none of it matters then."

The above out of the way, I want to try and engage with the deeper argument you're making in good faith.

What you're missing here is that all of the business tracking and personalized profiles you bring up as the real problem are using the exact same technology as these read receipts. The point is not that read receipts are the worst thing in the world (although I think they're unhealthy and they show a lack of respect for the person you're communicating with). The point is that they illustrate the broader pattern of tracking in a form that regular people understand and emotionally connect with. That's a good thing.

The other thing you're missing when you talk about criminalizing homosexuality and prohibition is that pervasive tracking is a tool that allows powerful people to oppress less powerful people. Pervasive tracking outs people's sexual preferences, it allows companies to illegally target individuals based on protected characteristics, to advertise to people at their most vulnerable moments, and to exclude them from opportunities that they would otherwise have. Far from being a nothing issue, privacy is fundamentally tied to people's ability to express themselves without fear and to hide from companies, governments, and even individuals that want to harm them.

Fixing personal email tracking has a pleasant side effect of also fixing the tracking that happens in both phishing and corporate emails as well. Like you quoted:

> I understand that sometimes the specific triggers that make people care are stupid, but my response to that is never to ask people to care less. It's already hard enough to make people care about things.

Yes, sometimes people can be encouraged to care about things that are actually unimportant, or even outright wrong. But privacy isn't unimportant; privacy is an essential tool to help protect individuals and marginalized groups from mobs, governments, companies, and individuals that don't have their best interests in mind.

My point is that this is manufactured outrage from people who don't actually care. They're just caring because it is today's flavor of the day. There are real steps people can take to support user privacy but they don't do them. People happily and voluntarily engage in objectively worse conduct for privacy day-to-day. This includes myself too -- my employer had me add not one but two separate tracking scripts on my company's homepage. I "care" about privacy yet here I am participating in stripping it away from people.

> using the exact same technology as these read receipts

What technology people use doesn't matter, what matters is how they use it. If I were to implement a system that tracked actions users do in a way that was ethical and completely not personally identifiable, then it doesn't matter - there is no problem, regardless of what technology is used to do it.

> Fixing personal email tracking has a pleasant side effect of also fixing the tracking that happens in both phishing and corporate emails as well

I don't think so. At all. This is like banning plastic straws to save the planet.

It is mutating what is basically a porch security camera into a discussion on oppressive government surveillance. The two are not the same. Personal email read receipts have almost no bearing on privacy at all. This is perhaps the point that is being missed by most people.

So, there is a part to this argument I agree with -- which is that getting mad exclusively at Superhuman ultimately accomplishes very, very little. Because you're right, this is absolutely everywhere, and literally every non-personal email you get has these same trackers.

My hope with this whole controversy of the week is that it leads people to disable loading remote images by default, and it leads email providers to change their default settings. I don't want to see people riled up just for angers sake -- I want to see that anger directed towards making changes that help with the entire spectrum of email pixel trackers.

This is where I think we disagree:

> What technology people use doesn't matter, what matters is how they use it.

You make a good point that Superhuman isn't doing anything unique, and you make an (arguable) point that what Superhuman is doing isn't even that bad on its own terms.

But if you have to trust companies or 3rd parties to be responsible with a technology, you're still leaving yourself open to less ethical attackers. The safest fix is to get users onto platforms where no one can track them, even if those trackers are deployed in responsible ways.

Think of it this way -- you make a completely reasonable assertion that including Google Analytics on a web page is a personal violation of privacy[0]. When I get around to removing Analytics from Loop Thesis, that will be an improvement. But I'm not under the illusion that doing so will affect anyone other than my visitors on my site.

There are two steps to this process. One is to be personally responsible about what we do. The other (equally important) step is to empower users such that they don't need to rely on us being responsible -- by encouraging them to install ad blockers, by building browsers that resist fingerprinting, and so on. I want to respect people's privacy, but more than that, I want them to be private regardless of whether or not I'm trustworthy.

Encouraging products like Gmail or Fastmail to block images by default is not the biggest step in the world -- it certainly doesn't fix everything. But it is a step, and it makes things slightly better. There is no short checklist to fix omnipresent surveillance; it's a long, arduous road where we hope that things gradually get better over time. The outrage over Superhuman will be beneficial if it encourages some people to change a setting in their email clients that they didn't know existed.

[0]: https://gitlab.com/danShumway/site/commit/c294dc81ae330ec432...

There’s a big difference between a tracking pixel in a bulk marketing email and read-receipting direct, personal or business emails.

Also this so-called “manufactured outrage” was started by a product VP at InVision. The call is coming from inside the house on this one.

There's less of a clear line between bulk and "business" email than you might think, particularly prospecting email. Looks 1:1 in terms of content, but is sent in bulk and has tracking pixels.

But other than that, I agree. From a privacy perspective, there's some advantage to just being one row of millions in the marketing database; it's the aggregate behavior that they care about, not individual.

Exactly. And it's not just marketing emails.

The dichotomy between "marketing tracks, 1-to-1 emails don't" is false. There are hundreds of millions if not a billion installs of people using tracking for 1-to-1 email.

Sales people use dozens prospecting tools like Outreach.io, Salesloft, etc for tracking.

Likewise, millions of individual consumers use tools like Gmelius, Mixmax, Streak, etc.

This feels like either manufactured outrage or willful ignorance by a community of supposedly technology-savvy people who should know better.

That’s disingenuous on a lot of levels.

First, tools like Streak have been criticized for years. And something like MixMax which is sold as an email marketing platform thing is scuzzy and gross, but it’s fairly clear to the person signing up what it’s for and that it’s for people who send out bulk email for marketing purposes.

Superhuman sells itself as an email client for professionals — it sells itself in similar ways to how Mailbox was presented before the Dropbox acquisition.

The investors and sycophants defending this product might say that it’s clear to everyone that this is just an email tool for marketers, but that’s not how its own webpage sells it. If anything, this is selling itself as an email tool for VCs or people doing biz dev.

And maybe every person doing M&A uses tracking pixels, but that seems like a stretch. And for there to not be an ability to turn the feature off (until the outrage), says a lot to me about the core values that went into designing this product.

I would never pay for something like this or for Streak. I understand that emails I get from a marketing company or a newsletter have tracking pixels. I’m savvy enough to know others might send them too. But I will absolutely push back on the idea that it’s the expected behavior for all or even most emails, let alone willful ignorance.

Email tracking is wrong, and personally I have gone through many steps to try and keep myself safe from it. That being said you are incorrect if you think this is limited to Marketing and Sales. Literally every E-mail in my inbox when I wrote my initial comment had a tracking pixel. GitHub uses tracking pixels when they send you notification of Pull Requests. Square sends tracking pixels for receipts. Every notification I had in my inbox was accompanied by a tracking pixel. Superhuman isn't even the first client to do this. I know that Nylas and Mailbird both had it and I couldn't even figure out how to disable them in Newton Mail on Android. To say this is somehow about Superhuman is to deny the problem, this is an industry wide problem that everyone is culpable for

You’re talking about transactional emails —- Superhuman isn’t a client for sending transactional mail (that’s automated anyway), it’s a normal email client.

It’s disingenuous to conflate transactional or marketing email tracking with a manual, non-automated email one person sends to another. Yes, I’m sure plenty of people track those emails, that doesn’t make it common or the expectation from a sender. The fact that there is this much upset about this proves that this isn’t the expectation.

> this didn't know this was going on with almost every email > tool out there.

Which email tool was doing this? If I install cloudHQ email tracker, mixmax, streak, Gmelius tracking, Cloud hq autobcc to Salesforce, then I do this for marketing or sales. So these are CRM utilities...

But I do not expect that my email client which is promoted as "THE FASTEST EMAIL EXPERIENCE EVER MADE" has this creepy feature enabled by default.

Anyway, Superhuman seems to a CRM (maybe a good one - I'm not sure) and it is not an email client. That is the difference.

A lot of people genuinely didn't know about pixel tracking in emails until they read about it in recent coverage. I agree that Superhuman is being somewhat unfairly singled out here, but that doesn't make the outrage "manufactured"

Everybody knows that the government, three letter agencies, shady marketers and unscrupulous businesses will try to track them or do what would be considered as nasty and evil.

I think the distinction here is that Superhuman put that power (with location information) in literally everybody's hands by default (the wrong default, if one could even consider this as a switch). So someone who normally would be paranoid about a stalking ex would've taken other precautions but wouldn't have guessed that this would be so easy (yes, there are many ways people can personally track others, including using phishing and other covert methods).

So the "manufactured outrage" here is more akin to, if I may be completely hyperbolic for a moment, making it easy for anyone to buy assault weapons or nuclear weapons, when everybody knows that those with evil intentions for the masses (like terrorists) would be able to get them easily anyway.