8 ms·

> there was no way the website would know my email just by my visit. I'm curious. How did the furniture company get your email address, just from you clicking

> there was no way the website would know my email just by my visit. I'm curious. How did the furniture company get your email address, just from you clicking a link in your email? Anyone?

bittercynic 10y ago
Maybe the wife gave used the "Tell a Friend" feature of the site.
- cyberpunk 10y ago
  Almost certainly..
- RickS 10y ago
  This is one of the saddest and most orwellian aspects of today's marketing. Even if you run a tight ship, your friends are bombarded with just as much force to give up not just their information, but yours as well, undermining your efforts.
  - milkytron 10y ago
    And this is one of the reasons why I have as many email addresses as I do.
- Terretta 10y ago
  He basically says so: "my wife sent me a link"
  - intransigent 10y ago
    A lot of people simply don't understand what little integrity email actually has. People like to think that they can rely the sender address as an unspoofable source of truth, and do not understand that the message is just a text file, and you can make it say anything you want. No one inspects the delivery servers or the message routing, and even that can be sufficiently obfuscated. Using too-big-to-fail services like gmail, that attempt to provide analysis and alert you to suspicious patterns is nice, but it doesn't solve for the actual realities of handling email. Furthermore, if there were one email ring to rule them all, we'd be haunted by a more ominous problem. Still, the level of confusion and misperception about common technology, and what is and is not possible, is clearly as big a problem on its own. It sucks that people are left with such superstitious paranoia, because they don't understand how naked they actually are.
    - cyberpunk 10y ago
      What patterns? This doesn't have any obfuscation it's basic web for.... A long time now. What are email providers supposed to be solving here? The reality is as an individual it's up to you how your mail client behaves and what emails you decide open or not... The hidden reality of the email situation for on the sender side is that it's getting increasingly hard to even send mail as an avg entity instead of outsourcing the problem to google/aws/mailchimp/whoever and that's not an accident. As for your mail: almost every marketing/transactional/non-personal you've had over the last few years will have 'completely unique to you and that /specific/ message' urls for things like the images (if they're not inlined), tracking pixels, and especially the links you can follow from the mail which allows the marketers/esp's to see who has opened it, who clicked, who didn't and so on. If there's html/js allowed then we'll be watching which parts your mouse hovers over, how fast you scrolled, which parts you actually read and so on. Do a tcpdump while you read some mails from amazon or someone and see what you find when you move your mouse around. Hopefully that isn't news to anyone. This has been happening for ages. If a non-transactional mail is going to 100k people then for example the banner image at the top will have 100k urls the webserver will serve it which is how you track that stuff without cookies.. To explain further, mails more often than not today are viewed in a browser (even the 'fat' mail apps like mail.app or I presume outlook use 'embedded browsers/web views' which are the same) these all happily send the cookies you've got kicking around from your normal sessions for those domains on the images, which, are then matched up with whatever else you'll do on said site (or even better, if the tracking is coming from a diff domain and multiple sites use the same provider then we'll be tracking you across a lot of dofferent places (see: omniture, google, etc) -- generally a MSP/tracking provider can't give a client access to what a user in a given segment might be upto on sites that they don't own, but the SP certainly knows and the biggest one also controls a lot of the ads...). What's one email ring? edit: Email providers do have some protections too, though. SPF has been around for ages which if you're not the MX ip and don't have the record for the domain you're FROM'ing gets you on bumped up the process of making the shitlist on the big MX's at least (gmail, hotmail, whoever). Finally getting listed means they won't accept mails from that IP for 24 hours (I assume it's 24 hours simply because it'd be insane to sustain an actual blacklist longer than that on the scale things are today, and that stops people having to request removal after hacks or whatever.. Things are getting better with DKIM and DMARC too...
hlieberman 10y ago
They send a different URL to each person, encoded with an identifier that has the email built into it. Alternately, there are advertising companies that do web page -> email retargeting by buying data from companies that have your email address and correlating it with cookies in your browser.
- sean_patel 10y ago
  Wow. I didn't know people did that. Truly disturbing. Thanks for the explanation.
- MarisaKirisame 10y ago
  I must say the first idea is brilliant... (Despite morally disputable)
draw_down 10y ago
Really? Seems pretty trivial to me
singularity2001 10y ago
"just from you clicking a link in your email" I first thought this was sarcastic. People here genuinely didn't know that whenever you just open(look at) an email, you risk sending a ping to an 'image-content' server?
- klez 10y ago
  The mail clients I use (Thunderbird on desktop and K9 on Android), by default, don't load remote content unless explictly told to. I don't use web clients to access email, so my question is, do web mail clients load remote content automatically?

> there was no way the website would know my email just by my visit. I'm curious. How did the furniture company get your email address, just from you clicking a link in your email? Anyone?

bittercynic 10y ago

Maybe the wife gave used the "Tell a Friend" feature of the site.

cyberpunk 10y ago
Almost certainly..
RickS 10y ago
This is one of the saddest and most orwellian aspects of today's marketing. Even if you run a tight ship, your friends are bombarded with just as much force to give up not just their information, but yours as well, undermining your efforts.
- milkytron 10y ago
  And this is one of the reasons why I have as many email addresses as I do.
Terretta 10y ago
He basically says so: "my wife sent me a link"
- intransigent 10y ago
  A lot of people simply don't understand what little integrity email actually has. People like to think that they can rely the sender address as an unspoofable source of truth, and do not understand that the message is just a text file, and you can make it say anything you want. No one inspects the delivery servers or the message routing, and even that can be sufficiently obfuscated. Using too-big-to-fail services like gmail, that attempt to provide analysis and alert you to suspicious patterns is nice, but it doesn't solve for the actual realities of handling email. Furthermore, if there were one email ring to rule them all, we'd be haunted by a more ominous problem. Still, the level of confusion and misperception about common technology, and what is and is not possible, is clearly as big a problem on its own. It sucks that people are left with such superstitious paranoia, because they don't understand how naked they actually are.
  - cyberpunk 10y ago
    What patterns? This doesn't have any obfuscation it's basic web for.... A long time now. What are email providers supposed to be solving here? The reality is as an individual it's up to you how your mail client behaves and what emails you decide open or not... The hidden reality of the email situation for on the sender side is that it's getting increasingly hard to even send mail as an avg entity instead of outsourcing the problem to google/aws/mailchimp/whoever and that's not an accident. As for your mail: almost every marketing/transactional/non-personal you've had over the last few years will have 'completely unique to you and that /specific/ message' urls for things like the images (if they're not inlined), tracking pixels, and especially the links you can follow from the mail which allows the marketers/esp's to see who has opened it, who clicked, who didn't and so on. If there's html/js allowed then we'll be watching which parts your mouse hovers over, how fast you scrolled, which parts you actually read and so on. Do a tcpdump while you read some mails from amazon or someone and see what you find when you move your mouse around. Hopefully that isn't news to anyone. This has been happening for ages. If a non-transactional mail is going to 100k people then for example the banner image at the top will have 100k urls the webserver will serve it which is how you track that stuff without cookies.. To explain further, mails more often than not today are viewed in a browser (even the 'fat' mail apps like mail.app or I presume outlook use 'embedded browsers/web views' which are the same) these all happily send the cookies you've got kicking around from your normal sessions for those domains on the images, which, are then matched up with whatever else you'll do on said site (or even better, if the tracking is coming from a diff domain and multiple sites use the same provider then we'll be tracking you across a lot of dofferent places (see: omniture, google, etc) -- generally a MSP/tracking provider can't give a client access to what a user in a given segment might be upto on sites that they don't own, but the SP certainly knows and the biggest one also controls a lot of the ads...). What's one email ring? edit: Email providers do have some protections too, though. SPF has been around for ages which if you're not the MX ip and don't have the record for the domain you're FROM'ing gets you on bumped up the process of making the shitlist on the big MX's at least (gmail, hotmail, whoever). Finally getting listed means they won't accept mails from that IP for 24 hours (I assume it's 24 hours simply because it'd be insane to sustain an actual blacklist longer than that on the scale things are today, and that stops people having to request removal after hacks or whatever.. Things are getting better with DKIM and DMARC too...

hlieberman 10y ago

They send a different URL to each person, encoded with an identifier that has the email built into it. Alternately, there are advertising companies that do web page -> email retargeting by buying data from companies that have your email address and correlating it with cookies in your browser.

sean_patel 10y ago
Wow. I didn't know people did that. Truly disturbing. Thanks for the explanation.
MarisaKirisame 10y ago
I must say the first idea is brilliant... (Despite morally disputable)

draw_down 10y ago

Really? Seems pretty trivial to me

singularity2001 10y ago

"just from you clicking a link in your email" I first thought this was sarcastic. People here genuinely didn't know that whenever you just open(look at) an email, you risk sending a ping to an 'image-content' server?

klez 10y ago
The mail clients I use (Thunderbird on desktop and K9 on Android), by default, don't load remote content unless explictly told to. I don't use web clients to access email, so my question is, do web mail clients load remote content automatically?