3 ms·
Perhaps I’ve missed some obvious reason why the industry still does this. Because if you get a random email from some site you've never signed up for, there ar
by zb 16y ago
Perhaps I’ve missed some obvious reason why the industry still does this.
Because if you get a random email from some site you've never signed up for, there are two possible scenarios that you cannot distinguish between:
1) Somebody has maliciously signed you up to a legitimate site.
2) A malicious site is trying to get you to click a random link.
This proposal suffers from a common flaw, in which people assume they can change just one thing and have everything else in the world stay the same. Systems don't work like that.
- prsimp 16y agoThe author addresses the first issue in the paragraph preceding the one you quoted. As it currently stands, most 'confirmation e-mails' I get also provide an 'if this isn't you' section. All the author is arguing is that we can do away with the confirmation part and keep the 'if this isn't you' part for those edge cases where a person's email address has been used by someone other than said person.
- Tichy 16y agoBut the "if this isn't you" part could be a scam. It would make you click on a link in an email you did not request, which is a bad idea.
- threedaymonk 16y agoThat's already the case, isn't it? All emails contain the "if this isn't you part", so the case of the person who didn't request the email is unchanged.
- mgkimsal 16y agoUsually the 'if this isn't you' section says "don't click the link above" or "do nothing and you won't hear from us again".
- ndl 16y agoCompounding this problem, conventional security wisdom is that you should never acknowledge unsolicited email, because the spammer might be using a fake unsubscribe link to confirm your email address is real. So a system that requires manual unsubscription this way will actually punish accidentally subscribed users for following good protocol. Furthermore, if the "confirmation" email winds up in a spam filter and the user never sees it, subsequent emails will still go out and probably be auto-marked as spam.