Hacker News Reader

Comment by return_to_monke | Hacker News Reader

I am not sure, but I think the GDPR mandates an unsubscribe link for unwanted automatic emails.

Any spam I get, I never unsubscribe. Too risky to instead get confirmed as active mail. Instead, those get blacklisted/reported as spam (though I recently found out that this can also leak your email address, fun edit: apparently that’s only an issue with the web.de and gmx.de services).

American companies are great of subscribing you to their spam mails without opt-in.

Wait, how reporting spam can leak the address? Asking for gmail of course.

he's probably saying about clicking "unsubscribe" which usually leads to spammer website. in return they know now that this email is active

A website, can just be a URL of, well... nothing. As long a web server is sitting there logging the requests.

spammer.douch.nozzle/collect_request/JoeShmo_1x1-transparent-UUID_0se9a009fjwljwlfl2f.gif

but all the info the douch needs is in the "UUID", the rest is easily obfuscated.

If your email client renders renders images willy nilly, the image is enough to confirm a valid target (clicking "unsubscribe" isn't necessary to become victim but is a hard lock-in mechanism (A human is on the hook...)).

And that's exactly why you don't load random web resources in emails.

> he's probably saying about clicking "unsubscribe"

No. I’m talking about abuse-mails, I’ll reply to the top-level comment

I don't get much spam, so I don't remember the last time I reported it, but IIRC when you do it on Gmail, it shows something to the effect of "thanks for the report, we'll try to unsubscribe you".

I reckon they might be using this: https://www.rfc-editor.org/rfc/rfc8058

This is pure speculation since I have no visibility into their inner workings, but it might just be possible that they would send a POST request on your behalf, at least to domains on some sort of a pre-approved list.

At work, we sometimes got abuse mails (the mails mention FBL: Feedback Loop [0]) which, while they do not contain addresses, contain message-id’s which can then be linked to the original mail.

But looking at the list of addresses we blacklisted because of them, I now realize that those are actually all web.de and gmx.de (crappy German freemailers), so it seems the leaks only happen with them.

[0]: https://en.wikipedia.org/wiki/Feedback_loop_(email)

It tells the adversary someone reads the emails on that mailbox.

Unsubscribe links are for cases where I've signed up willingly and later decided to cancel. If anyone automatically emails me they get reported as spam and blocked, no shot I'm trusting them to unsubscribe me.

Most spammers are still using standard tools with a working unsubscribe button. They just don't understand opt-in etiquette.

Is till prefer marking them as spam in hope that it increases chance that whoever submits spam and their content will be treated as spam in future.

I just do both

Yes it does - unsubscribing should be JUST clicking a button.

It was the CAN-SPAM act from 2003 that mandated unsubscribe links.

https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003

they should also mandate that a reply email with 'unsubscribe' as the first word will unsubscribe the 'sent from' address

Make a new Gmail filter that moves every email that contains word "unsubscribe" to spam.

Reply on news.ycombinator.com