Hacker News Reader

Comment by civilized | Hacker News Reader

I feel like spammers and cyber criminals are getting better. Stuff is starting to get through Google spam filter by mashing up with elements that seem very real and urgent. Like yesterday I got this spam in my Gmail primary inbox with a subject line like "RE: Department of Education Case #295720186".

It made me wonder if you could autogenerate filter-evading spam using GANs? Train a GAN to generate email that fools a spam filter, feed it your spam prompt, and the neural network camouflages your prompt in filter-evading cruft and misdirection.

View on HN

Gmail's spam protection has been broken for ages. I'm keeping getting obvious spam (pills, eggplants emojis, money from prince kind of stuff) directly into my inbox. At the same time, legitimate email is going to the spam folder.

I seem to have the opposite experience. I've been using the same email address, never hiding it at all even on Usenet, for 25 years. I get >600 spams/day and ~20 non-spam, and at most 1 or 2 spams get through Gmail's filter.

I want to move to Fastmail, but every time I try it out, their spam filter lets through 50-75/day, which is unworkable.

Yup me as well.

A simple Bayesian model seems to be the only thing which works for keeping out obvious fraud, and for more sophisticated fraud it's tough to do it automatically.

The "zoom" spam in Vietnamese just kills me. How does that get through??

On the other hand, I’m seeing more and more legitimate stuff land in Gmail’s spam filter.

Like virtually of San Francisco Marathon’s newsletters. Sure they’re pushy and really really want you to sign up for more races and I definitely need to unsubscribe … but I did subscribe and that means it isn’t spam.

One of the things that I assume happens is that, even when people have explicitly signed up for something or at least not opted out of receiving updates etc., they'll just "report spam" rather than unsubscribe and when enough people do this it gets put in everyone's spam folder unless enough people reclassify it.

There's not much stuff that ends up in my spam folder that I really care about and a fair bit I don't know how I got on some list. But relatively little of it is spam in the usual meaning of the term.

> they'll just "report spam" rather than unsubscribe

I'm guessing this is a major part of it. But then again, if a legitimate service is so spammy that people will just "report as spam" rather than unsubscribing, maybe they should change their behavior.

There's definitely a continuum from I signed up for your newsletter, to I attended your event/downloaded your document and opted in, to I didn't opt out, to random mails typically semi-relevant at best from someone who got my email from some list somewhere, to outright scams/offers to sell mailing lists/etc.

Of course it depends somewhat on frequency etc. as well. I'll still mostly just unsubscribe if there's a link and usually reserve report spam for random crap that doesn't have an automated unsubscribe option.

Pre-Covid, I attended a lot of events and that's probably has led to me getting on a lot of lists. Like it or not, no small part of the event industry is for companies to get leads.

In e-commerce I've noticed that customers that request to be removed from the mailinglist and/or to have their info/account be deleted often forget about ever using the site. Then a few months later they order something and sign up for the newsletter again. When they receive their "first" newsletter they recognize the style and remember that they requested it to be cancelled, which leads to many angry emails and spam reports.

An order form with no pre-selected "join newsletter" option doesn't seem to mitigate this problem. The obvious soloution is to save the customer's email in the mailinglist as unsubscribed, but afaik that's not legal if they request an account deletion.

I'm sure it depends on jurisdiction but that would presumably be saving PII after a removal request.

I find the tabs on my personal Gmail help a lot. Most of the form stuff lands in Promotions or Updates which I glance at now and then. Occasionally there's something I'm actually interested in. I used to keep a separate email for orders and the like but over time I found that just became a black hole that I never looked at.

Saving a SHA-256 of the email address seems like a perfect solution to this problem.

My favorite problem are people who go “Never email me again about anything” then a few months later complain “Why didn’t you tell me about the new version?”

> at least not opted out of receiving updates etc

I still consider that spam; successfully hiding the checkbox from me doesn't mean that I want the emails.

I report them as spam in the hopes that it will force them to switch to an opt-in system.

> I’m seeing more and more legitimate stuff land in […] spam filter.

I use iCloud Mail with a custom domain, after having self-hosted my mail for many years.

I had some job interviews recently and in a couple of cases iCloud Mail was spam filtering the meeting invitations. Whoopsie!

Fortunately in both cases we had communicated about when the meetings would take place outside of the invitations. So even though I didn’t see the invitation mails, I knew when the meetings would take place, and in the case of lacking a link to join one of the meetings I got them to send me another link for the meeting.

And on the whole I will say that iCloud Mail is much more comfortable and convenient for me to use than continuing to self-host my mail. Both in terms of keeping spam out of my inbox, and in terms of mail that I send getting to other peoples inboxes rather than ending up in their spam.

Its just different people disrupting the spam space.

Someone looked at the operational assumptions of “lets target gullible people by using stupid obviously fraudulent scenarios so that we can weed out everyone who wont play along” and noticed it is missing a very large target market unnecessarily.

That almost sounds like an argument for why old school scammers are relatively ethical.

I don't know that argument.

Like it or not, this is the price of "privacy". Being able to easily pretend to be anyone, in the absence of an overarching identity framework -- and leaving identity recognition to the end user -- makes cybercrime a lot easier than it has to be.

Privacy does not mean anonymous interaction with known parties. It means the CIA can’t see me make an account transfer over the wire. In other words, without a warrant. Authentication and privacy are compatible. Privacy and anonymity are orthogonal.

The CIA can and will monitor your offline and online behavior if your profile is interesting to them. No amount of "muh privacy" appeals will stop them.

Privacy and anonymity are absolutely not orthogonal. How do you KYC? By "violating" their privacy (storing and querying personal records) to identify (deanonymize) someone.

> The CIA can and will monitor your offline and online behavior if your profile is interesting to them.

That’s because we don’t have adequate privacy safeguards in modern western society.

> Privacy and anonymity are absolutely not orthogonal.

Privacy and anonymity are not synonymous. I can have a private conversation with a friend. That does not require anonymity. In fact it precludes anonymity because my friend and I know who each other are. Privacy says nobody else knows what we discussed or even that we had a conversation.

> KYC?

Know Your Client? This is a new term to me but sounds like an authentication concept. Which is compatible with privacy but precludes anonymity, by definition.

Know Your Customer, a vital concept in financial services, which basically makes it much easier to track down and prevent money laundering and fraud.

I can privately communicate with my bank. But I cannot do so anonymously. LEO can’t see what I am doing on the wire. But with due process they can compel my bank to reveal what I have been doing with my money.

In theory the CIA cannot legally monitor anything about you if you're a US person, even with a warrant. That's the FBI's job. If you're not a US person the CIA can monitor you all day long without a warrant.

In practice it's a bit messier than that.

This is a really upsidedown take. Spam was rampant prior to better safeguards around privacy, for one. It almost took down the internet iirc.

"Better safeguards around privacy"? How is Google or Cloudflare or NSA or whoever peeking at your incoming emails to determine what gets through good for "privacy"? That is upside down and backwards.

Please explain.

E2e encryption to prevent that peaking didn't really debut until the 2000's, as that's right when the crypto wars ended. Spam was actively fought in 1990's, and then improved measurably into 2000. See projects like Hashcash in 1997, anti-spam tool.

So your premise doensn't make sense with that timeline. Right when consumer privacy measurably improved via encryption availability and the end of related legal challenges is right around the time spam improved as well.

Which is to say, there is no correlation that's logical b/t the two in my mind, but if anything the timeline invalidates privacy improvements -> worsening spam without more evidence.

Html enabled email can easily contain tracking. Even without JavaScript, you could insert an img tag pointing at a uniquely generated address and log the query...

It becomes a question of who you trust more: the service you've chosen for handling your email (and spam protection), or the people sending spam emails. If you don't trust your provider, you should find another provider.

Most email clients have the option to not autoload images.

I set my client to not autoload, it is easy enough to click to load an image if I think I want to see it. In most cases I do not!

And Google auto downloads embedded images when they receive the email, they show you the cached version and there is no information provided to the sender.

The bank account and the bank that the funds were misdirected to both have government-issued identities attached, so exactly what "privacy" are you talking about?

I agree with the easier part, but maybe not the "than it has to be" part.

Reply on news.ycombinator.com