4 ms·

Could you expand upon this? Do you mean the unsubscribe takes you to somewhere you need to then sign in with credentials to "unsubscribe"?

lucasmullens 10y ago
I've definitely seen websites that require you to login to unsubscribe. It's probably illegal (https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubscribe-from-this-e-mail-annoying-possibly-illegal/ https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubs...) but I still see it from time to time. Usually I just mark them as spam and don't bother logging in.
- gnicholas 10y ago
  It's also super annoying when someone has accidentally entered your email address instead of their own. When you try to unsubscribe, you're asked to log in to an account that you never created.
diminoten 10y ago
They could put whatever is most effective at the destination of that URL. Once you're visiting a URL crafted by the attacker, you're already in deep trouble. Often that's all it takes, merely visiting the URL.
- Dylan16807 10y ago
  If you assume people have the attention span of gnats, I guess. If I'm clicking a link to unsubscribe you're not going to get me to start entering personal information.
  - thraway2016 10y ago
    Crafted-content UAF vulns are still occasionally being found in browsers. To say nothing of unpatched/non-updated browsers.
    - Dylan16807 10y ago
      You don't need a trick URL for those.
      - thraway2016 10y ago
        The point is that simply clicking a dodgy link can, in some cases, own you. No credential acquisition required.
        Dylan16807 10y ago
        Yes but what does that have to do with the article?
        diminoten 10y ago
        Are you asking what a dodgy URL has to do with the article?
        Dylan16807 10y ago
        If they get you to click on a link, it doesn't matter what it looks like in the address bar. So what does a malicious link that could be on any domain have to do with domain spoofing?
        diminoten 10y ago
        If you hover over a link in a browser, the URL of the link will be shown as a tooltip, or in the bottom of your browser window.
Falkon1313 10y ago
On many sites (that have more than a simple newsletter), the email preferences are part of the account settings where you do things like change your password, avatar, possibly manage your billing information and shipping address, etc. You wouldn't want any random anonymous person to be able to access that info, so of course it requires logging in by default. While those systems should ideally have one-click unsubscribe functionality nowadays, there are probably quite a few that don't.

lucasmullens 10y ago

I've definitely seen websites that require you to login to unsubscribe. It's probably illegal (https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubscribe-from-this-e-mail-annoying-possibly-illegal/ https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubs...) but I still see it from time to time. Usually I just mark them as spam and don't bother logging in.

gnicholas 10y ago
It's also super annoying when someone has accidentally entered your email address instead of their own. When you try to unsubscribe, you're asked to log in to an account that you never created.

diminoten 10y ago

They could put whatever is most effective at the destination of that URL. Once you're visiting a URL crafted by the attacker, you're already in deep trouble. Often that's all it takes, merely visiting the URL.

Dylan16807 10y ago
If you assume people have the attention span of gnats, I guess. If I'm clicking a link to unsubscribe you're not going to get me to start entering personal information.
- thraway2016 10y ago
  Crafted-content UAF vulns are still occasionally being found in browsers. To say nothing of unpatched/non-updated browsers.
  - Dylan16807 10y ago
    You don't need a trick URL for those.
    - thraway2016 10y ago
      The point is that simply clicking a dodgy link can, in some cases, own you. No credential acquisition required.
      - Dylan16807 10y ago
        Yes but what does that have to do with the article?
        diminoten 10y ago
        Are you asking what a dodgy URL has to do with the article?
        Dylan16807 10y ago
        If they get you to click on a link, it doesn't matter what it looks like in the address bar. So what does a malicious link that could be on any domain have to do with domain spoofing?
        diminoten 10y ago
        If you hover over a link in a browser, the URL of the link will be shown as a tooltip, or in the bottom of your browser window.

Falkon1313 10y ago

On many sites (that have more than a simple newsletter), the email preferences are part of the account settings where you do things like change your password, avatar, possibly manage your billing information and shipping address, etc. You wouldn't want any random anonymous person to be able to access that info, so of course it requires logging in by default. While those systems should ideally have one-click unsubscribe functionality nowadays, there are probably quite a few that don't.