Google rival Tuta complains to EU tech regulators about de-ranking | Hacker News Reader

Google rival Tuta complains to EU tech regulators about de-ranking

reuters.com

69 pointsBobFromEnzyte51 comments

It might not just be Google--I tried searching "encrypted email" in DDG and found nothing for pages and pages. Even saw AOL come up before any mention of Tuta. My guess is the name change, combined with prior bad reputation on the tuta.com domain (see http://web.archive.org/web/20190107213809/http://tuta.com/), is causing the issue across search engines.

Tuta is ran by absolute morons.

A few years ago, under their other domain, they accused Microsoft of suppressing them in a ranty blog post.

How?

Because their users couldn't sign up for Microsoft accounts using the tutanuta domain.

But why?

It wasn't Microsoft suppressing them. The fucking morons created an azure tenant validated against the domain. The default setting is to then validate all users with said email against the azure tenant. You can always turn it off but ill advised for security purposes.

I even validated that their tenant exists on azure using that domain.

The devil in the details mean the morons were using the same domain used by public users, for internal corporate usage which is absolutely fucking insecure to the moon.

Nobody should trust these wankers whose first response is to "blame big tech company" instead of understanding basic cybersecurity and internet. Who knows how they even store your emails. There are plenty of other services that I'll trust before the one that runs around for attention like a toddler.

> The devil in the details mean the morons were using the same domain used by public users, for internal corporate usage which is absolutely fucking insecure to the moon.

Care to explain why this is so insecure?

If I get an email from @tuta.com, how do I know if it’s an official staff account, or a member of the public?

That’s a great point, but not the point that GP was making. I’d like to learn more about the inherent domain sharing security problem they ranted about.

Edit: This public issue seems to imply they have a way to mark system/admin emails: https://github.com/tutao/tutanota/issues/6708

If you work at the company, how do you know

IAmTotallyCeo@realcompanydomain.com is real or not?

And if you are an service user, how do you know,

ISwearIAmCustomerService@realcompanydomain.com is real or not?

Everyone else does it properly.

google.com/gmail.com are not mixed.

microsoft.com/(outlook.com,hotmail.com,live.com) are not mixed.

apple.com/icloud.com are not mixed

You claimed it was an issue specific to internal usage?

Ah yes, good reminder, it also causes IT hell.

If you register an AD tenant, you can associate an domain with it, when you do this. It means all your windows accounts are also

something@domain.com

instead of the azure default of

something@tenantname.onmicrosoft.com

It is 100% optional to associate a domain and an explicit action. This to me means they are using the domain on azure for Windows AD.

Now why is this bad?

Well, Microsoft has two types of accounts "Personal" and "Work/School" accounts. You can create "Personal" accounts against any email address/domain. However, once you register an Azure AD Tenant, the default is to disable registering further personal accounts. The goal is to avoid corporate users leaking work documents to personal non-managed accounts. There is also an option to force merge any existing personal accounts at the verified corporate domain into work accounts.

Say tutanota, being the geniuses they are disabled the setting that turns off personal account for their verified domain.

Well those IT guys will now have completely worthless audit logs because there'll be constant failed logins from people accidentally selecting "work/school accounts" in the login screen when asked what type of account it is. Not to mention you'll have the reverse of employees accidentally creating personal accounts because some microsoft prompts are weird and may refuse to offer work/school as a login option.

Would it have been better if they had kept the company name as "tutanota" and called their email service "tuta" on the "tuta.com" domain?

Yea that would been the sane and professional way to do it.

Hmm... Interesting. I tested on Kagi and it appeared at No. 13 for me. Not too bad, but compared to proton, it's quite easy for people to ignore.

The article says March, which coincidences with this:

https://developers.google.com/search/blog/2024/03/core-updat...

It's possible Tuta caught a stray here because they recently changed their name from Tutanota[0], including the domain name. This update has the SEO world up in arms, in fact - the update is still rolling out, nearly two months after it was announced.

I'd love to be a fly on the wall in the Google Search team's offices to learn just how much machine learning is messing with the ability to properly understand intent -> rank content.

E: Semrush shows that they took a nosedive, but not a complete decimation[1].

E2: I take the initial edit back, looks like they got a classifier applied to their site, also known as the "Helpful Content Update":

https://tuta.com/blog/google-search-problem

It's a nasty classifier and not a single site has been reinstated from it[2] since Google began to apply it in Sep 2023.

[0]: https://tuta.com/blog/tutanota-is-now-tuta

[1]: https://i.imgur.com/E9ybteL.png

[2]: https://twitter.com/glenngabe/status/1781679769735545280

> It's possible Tuta caught a stray here because they recently changed their name from Tutanota[0], including the domain name.

I was wondering about the similarity when I saw the headline; I can't imagine why would they do it. Why would they voluntarily destroy their own brand recognition?

> I'd love to be a fly on the wall in the Google Search team's offices to learn just how much machine learning is messing with the ability to properly understand intent -> rank content.

I'm not normally the fan of ML (ab)use, but I think it's unavoidable here: ML worsening result is an unfortunate consequence of them operating in strongly adversarial environment. After all, SEO is just a polite way of calling actively poisoning the search engine rankings.

(Yes, SEO is also making your website legible to crawlers - in the same way advertising is about informing the customers about your offering. That's part of it, but not the part sought by customers of such services, or that makes most money.)

https://tuta.com/blog/google-search-problem

This article goes into much more detail about the issue.

Not so much detail about the key issue: "We have no idea why Google is no longer showing our website for thousands of keywords that we used to rank for in the past."

https://developers.google.com/search/blog/2022/08/helpful-co... makes it sound (to my ears)as if they try to distinguish between sites with a single or a few topics and sites that try to match lots of searches.

So... What are the thousands of keywords for which Tuta should rank high?

I see someone downvoted me, so let me try differently: what does "keywords" even mean, if Tuta has thousands of the things?

Changing the domain name should not affect ranking, as long as a 301 redirect is applied server-side to all pages. This way, pages indexed in Google won't 404. That is what could damage the ranking.

Off-topic: I am immensely happy with latest google update, because now if I search for something that is too obscure, google simply shows me an empty page with no results found, which tells me that I need to refine my search query. Previously, if such thing happened, I'd get a list of spam sites which does not include the query at all, or simply uses the query somewhere not visible on the page.

Used to be able to just use quotes to find exact matches

https://news.ycombinator.com/item?id=30130535

That was always a lie. Always. Exact quotes were often disregarded, and even sometimes still aliased. What exists for precision is "verbatim", which was added after some bonehead a Google decided that the + operator, such as +needthisprecisely, was conflicting with "Google Plus" searches.

So they deprecated the + operator, and started blathering on about how quotes did "the same thing", which it never did, and never has!

If you want terms to appear as typed, the closest thing to the old + is "verbatim" under "tools" after a search. Verbatim was added back in, after people howled at the loss of the + operator.

Note the + referenced:

https://web.archive.org/web/20040202021515/http://www.google...

You can see that in 2004, Google never aliased terms, the ~ operator was for that.

(Everyone used + for "always include this", for any needed word, for almost 15 years before Google removed it.)

now that google+ is long gone they could reinstate the + modifier

I feel the opposite. Often I'm searching some obscure error message or function name from an open source project; I'd expect Google to at the very least provide a result linking to the Github page where the thing is defined, but nope, nothing. Bing on the other hand gives me exactly what I'm looking for in the first few results.

This has been my experience. Google can now not even find substrings from source code found in thousands of GitHub repos. It's rapidly getting useless for programming.

Google doesn't seem to index all of github, which is very frustrating when looking for code strings or error messages that you know are included in some opensource project.

I'd be with you here, if not that I've long learned to associate an empty results page with the search engine timeouting or otherwise breaking. Refreshing the page would usually fix it.

My understanding is that DMA prevents tech companies considered to be too big from sharing data internally in certain ways without opt-in (among other things). When this comes into effect, a website stops ranking as well.

Is one explanation of this just that search was using a data source for relevance that benefitted this website, and now they are not using that? That seems possible, and doesn't require an assumption of malicious intent.

Disclaimer, I work at Google, but not on anything related to this. This is just armchair speculation of an explanation that might fit.

The post from Tuta did speculate that given the timing, the issue may be related to DMA changes. The issue is that they can't even reach a human at Google with authority in the associated systems to understand the issue.

Their speculation seems to be that there is some maliciousness or intent here, rather than a natural result of the DMA changes. My point is that it could be the latter.

As for reaching a human, my understanding is that Google does not discuss ranking reasons with companies on purpose, in order to prevent bias and gaming of the system.

Reuters literally can't bring itself to type out three extra characters and fully name the competitor to Google. Interesting.

Which competitor are they not fully naming?

Huh? I don't understand the question. Certainly!

Oh, you said Reuters couldn't type out the full name of Google's competitor. Were you thinking of Tutanota? If so, they officially shortened their name to just Tuta and moved their site to tuta.com.

kingspact seems to be a poorly behaving bot (look at it's word soup history). Interesting it replied though.. Eliza style.

Google's competitor, that the "journalist" failed to name, is Tutanoa. Not Tuta. It's fascintating that bots like you and the other bot which replied to me don't have access to this fact in your training data.

The parent asked if you meant Tutanota (8 characters) and pointed out that's no longer the legal name (perhaps you haven't caught up). Are you still suggesting that Tuta + 3 characters = Tutanota?

> Tuta fomerly Tutanota https://en.wikipedia.org/wiki/Tuta_(email)

Forgive my misspelling, I have a cold.

https://archive.is/Gthb2

bing.com doesnt rank them either.

They’ve been de-ranked because their website hits all the “SEO optimized” red flags that Google are now downranking for.

Pages like “Outlook vs Tuta Mail” “Gmail vs Tuta mail”, “Yahoo vs Tuta Mail”. All with the same rephrased taking points about their product. Then each of those talking points has its own dedicated page, just saying the same thing over and over again.

Want a better rank? Remove all this SEO crap, leave up the parts customers actually want.

Zapier, LucidChart and about a million other SaaS companies do this as well, because it's something people would search for. There's nothing in the Google blog that suggests they're turning the screws of SEO-optimized content.

https://blog.google/products/search/google-search-update-mar...

Explicitly mentioned on that blogpost:

“…or feel like they were created for search engines instead of people. This could include sites created primarily to match very specific search queries.”

The numerous “Tuta vs …” that all reword the same information clearly meet the “designed for search engines instead of people” standard imo.

How is that not designed for people? Don't you think people are searching for comparisons between two different products?

Here's Zapier for instance, comparing their tool to a Microsoft substitute:

https://zapier.com/l/microsoft-power-automate-vs-zapier

People are searching for comparisons, but these pages have been designed to seem highly relevant to the search engine. Not to be highly useful for readers. That page from Zapier is another example of the same issue. When Google rolls out their new ranking algorithm to zapier.com, I'd expect it will also be de-ranked.

The words "Power Automate" only appear 3x in the page. The title, subtitle, and a link to the same page. Nothing else on the page is relevant to "Power Automate", it's just the same marketing copy from the rest of their website. As a user looking for actual details on how the products capabilities compare to Power Automate this page is useless to me.

Google have been completely transparent about this. They have explained exactly what kinds of pages would be de-ranked under the latest changes.

So this means that anyone can now downrank pages by publishing "X vs Y" webpages?

You can downrank your own pages and website by hosting low quality SEO focused content. Spammy content written by others, on their own domain, doesn’t affect your ranking.

This is an interesting page:

https://tuta.com/email-comparison

Whereupon we find the following comparisons:

>"Protonmail vs Tuta Mail

Fastmail vs Tuta Mail

Mailbox.org vs Tuta Mail

Posteo vs Tuta Mail

Hushmail vs Tuta Mail

Startmail vs Tuta Mail

Riseup vs Tuta Mail"

...in other words, there's no shortage of email providers...

These pages, and more on the Tuta website, are a blatant example of SEO spam. Thousands of words long, all rephrasing the same talking points and SEO keywords. No real customer is going to read thousands of words of rephrased crap.

They even admit as much in the blogpost: “We have no idea why Google is no longer showing our website for thousands of keywords that we used to rank for in the past.” Juicing your ranking with SEO spam littered with “keywords” is now penalized in Google ranking. They would rank better by removing 90% of “content” on their website.

And no shortage of SEO keywords.

Holy cow the blatant SEO on that page. Trying to get all the versus searches that users might try while also stuffing all the other email providers names in as many times as possible.

Yeah I felt kinda hoodwinked. I read their blog post and felt quite outraged. Google stepping on the little guy, “they provided no explanation” etc.

Then I scroll to the bottom of the thread on hacker news, saw this comment, and “oh, that’s why”. They didn’t even take down the SEO spam before complaining about being caught.

I really don’t think I could trust any “privacy focused” email provider that relies on such deceptive tactics to promote their business.

Reply on news.ycombinator.com