5 ms·

I feel like spammers and cyber criminals are getting better. Stuff is starting to get through Google spam filter by mashing up with elements that seem very real

I feel like spammers and cyber criminals are getting better. Stuff is starting to get through Google spam filter by mashing up with elements that seem very real and urgent. Like yesterday I got this spam in my Gmail primary inbox with a subject line like "RE: Department of Education Case #295720186". It made me wonder if you could autogenerate filter-evading spam using GANs? Train a GAN to generate email that fools a spam filter, feed it your spam prompt, and the neural network camouflages your prompt in filter-evading cruft and misdirection.

Swizec 5y ago
On the other hand, I’m seeing more and more legitimate stuff land in Gmail’s spam filter. Like virtually of San Francisco Marathon’s newsletters. Sure they’re pushy and really really want you to sign up for more races and I definitely need to unsubscribe … but I did subscribe and that means it isn’t spam.
- ghaff 5y ago
  One of the things that I assume happens is that, even when people have explicitly signed up for something or at least not opted out of receiving updates etc., they'll just "report spam" rather than unsubscribe and when enough people do this it gets put in everyone's spam folder unless enough people reclassify it. There's not much stuff that ends up in my spam folder that I really care about and a fair bit I don't know how I got on some list. But relatively little of it is spam in the usual meaning of the term.
  - everforward 5y ago
    > at least not opted out of receiving updates etc I still consider that spam; successfully hiding the checkbox from me doesn't mean that I want the emails. I report them as spam in the hopes that it will force them to switch to an opt-in system.
  - qiskit 5y ago
    > they'll just "report spam" rather than unsubscribe I'm guessing this is a major part of it. But then again, if a legitimate service is so spammy that people will just "report as spam" rather than unsubscribing, maybe they should change their behavior.
    - ghaff 5y ago
      There's definitely a continuum from I signed up for your newsletter, to I attended your event/downloaded your document and opted in, to I didn't opt out, to random mails typically semi-relevant at best from someone who got my email from some list somewhere, to outright scams/offers to sell mailing lists/etc. Of course it depends somewhat on frequency etc. as well. I'll still mostly just unsubscribe if there's a link and usually reserve report spam for random crap that doesn't have an automated unsubscribe option. Pre-Covid, I attended a lot of events and that's probably has led to me getting on a lot of lists. Like it or not, no small part of the event industry is for companies to get leads.
    - Eyght 5y ago
      In e-commerce I've noticed that customers that request to be removed from the mailinglist and/or to have their info/account be deleted often forget about ever using the site. Then a few months later they order something and sign up for the newsletter again. When they receive their "first" newsletter they recognize the style and remember that they requested it to be cancelled, which leads to many angry emails and spam reports. An order form with no pre-selected "join newsletter" option doesn't seem to mitigate this problem. The obvious soloution is to save the customer's email in the mailinglist as unsubscribed, but afaik that's not legal if they request an account deletion.
      - dreamcompiler 5y ago
        Saving a SHA-256 of the email address seems like a perfect solution to this problem.
      - Swizec 5y ago
        My favorite problem are people who go “Never email me again about anything” then a few months later complain “Why didn’t you tell me about the new version?”
- codetrotter 5y ago
  > I’m seeing more and more legitimate stuff land in […] spam filter. I use iCloud Mail with a custom domain, after having self-hosted my mail for many years. I had some job interviews recently and in a couple of cases iCloud Mail was spam filtering the meeting invitations. Whoopsie! Fortunately in both cases we had communicated about when the meetings would take place outside of the invitations. So even though I didn’t see the invitation mails, I knew when the meetings would take place, and in the case of lacking a link to join one of the meetings I got them to send me another link for the meeting. And on the whole I will say that iCloud Mail is much more comfortable and convenient for me to use than continuing to self-host my mail. Both in terms of keeping spam out of my inbox, and in terms of mail that I send getting to other peoples inboxes rather than ending up in their spam.
slig 5y ago
Gmail's spam protection has been broken for ages. I'm keeping getting obvious spam (pills, eggplants emojis, money from prince kind of stuff) directly into my inbox. At the same time, legitimate email is going to the spam folder.
- sealeck 5y ago
  Yup me as well. A simple Bayesian model seems to be the only thing which works for keeping out obvious fraud, and for more sophisticated fraud it's tough to do it automatically.
- e40 5y ago
  The "zoom" spam in Vietnamese just kills me. How does that get through??
- dmd 5y ago
  I seem to have the opposite experience. I've been using the same email address, never hiding it at all even on Usenet, for 25 years. I get >600 spams/day and ~20 non-spam, and at most 1 or 2 spams get through Gmail's filter. I want to move to Fastmail, but every time I try it out, their spam filter lets through 50-75/day, which is unworkable.
pphysch 5y ago
Like it or not, this is the price of "privacy". Being able to easily pretend to be anyone, in the absence of an overarching identity framework -- and leaving identity recognition to the end user -- makes cybercrime a lot easier than it has to be.
- mulmen 5y ago
  Privacy does not mean anonymous interaction with known parties. It means the CIA can’t see me make an account transfer over the wire. In other words, without a warrant. Authentication and privacy are compatible. Privacy and anonymity are orthogonal.
  - dreamcompiler 5y ago
    In theory the CIA cannot legally monitor anything about you if you're a US person, even with a warrant. That's the FBI's job. If you're not a US person the CIA can monitor you all day long without a warrant. In practice it's a bit messier than that.
    - deleted 5y ago
      [deleted]
  - pphysch 5y ago
    The CIA can and will monitor your offline and online behavior if your profile is interesting to them. No amount of "muh privacy" appeals will stop them. Privacy and anonymity are absolutely not orthogonal. How do you KYC? By "violating" their privacy (storing and querying personal records) to identify (deanonymize) someone.
    - mulmen 5y ago
      > The CIA can and will monitor your offline and online behavior if your profile is interesting to them. That’s because we don’t have adequate privacy safeguards in modern western society. > Privacy and anonymity are absolutely not orthogonal. Privacy and anonymity are not synonymous. I can have a private conversation with a friend. That does not require anonymity. In fact it precludes anonymity because my friend and I know who each other are. Privacy says nobody else knows what we discussed or even that we had a conversation. > KYC? Know Your Client? This is a new term to me but sounds like an authentication concept. Which is compatible with privacy but precludes anonymity, by definition.
vmception 5y ago
Its just different people disrupting the spam space. Someone looked at the operational assumptions of “lets target gullible people by using stupid obviously fraudulent scenarios so that we can weed out everyone who wont play along” and noticed it is missing a very large target market unnecessarily.
- infogulch 5y ago
  That almost sounds like an argument for why old school scammers are relatively ethical.
  - vmception 5y ago
    I don't know that argument.

Swizec 5y ago

On the other hand, I’m seeing more and more legitimate stuff land in Gmail’s spam filter. Like virtually of San Francisco Marathon’s newsletters. Sure they’re pushy and really really want you to sign up for more races and I definitely need to unsubscribe … but I did subscribe and that means it isn’t spam.

ghaff 5y ago
One of the things that I assume happens is that, even when people have explicitly signed up for something or at least not opted out of receiving updates etc., they'll just "report spam" rather than unsubscribe and when enough people do this it gets put in everyone's spam folder unless enough people reclassify it. There's not much stuff that ends up in my spam folder that I really care about and a fair bit I don't know how I got on some list. But relatively little of it is spam in the usual meaning of the term.
- everforward 5y ago
  > at least not opted out of receiving updates etc I still consider that spam; successfully hiding the checkbox from me doesn't mean that I want the emails. I report them as spam in the hopes that it will force them to switch to an opt-in system.
- qiskit 5y ago
  > they'll just "report spam" rather than unsubscribe I'm guessing this is a major part of it. But then again, if a legitimate service is so spammy that people will just "report as spam" rather than unsubscribing, maybe they should change their behavior.
  - ghaff 5y ago
    There's definitely a continuum from I signed up for your newsletter, to I attended your event/downloaded your document and opted in, to I didn't opt out, to random mails typically semi-relevant at best from someone who got my email from some list somewhere, to outright scams/offers to sell mailing lists/etc. Of course it depends somewhat on frequency etc. as well. I'll still mostly just unsubscribe if there's a link and usually reserve report spam for random crap that doesn't have an automated unsubscribe option. Pre-Covid, I attended a lot of events and that's probably has led to me getting on a lot of lists. Like it or not, no small part of the event industry is for companies to get leads.
  - Eyght 5y ago
    In e-commerce I've noticed that customers that request to be removed from the mailinglist and/or to have their info/account be deleted often forget about ever using the site. Then a few months later they order something and sign up for the newsletter again. When they receive their "first" newsletter they recognize the style and remember that they requested it to be cancelled, which leads to many angry emails and spam reports. An order form with no pre-selected "join newsletter" option doesn't seem to mitigate this problem. The obvious soloution is to save the customer's email in the mailinglist as unsubscribed, but afaik that's not legal if they request an account deletion.
    - dreamcompiler 5y ago
      Saving a SHA-256 of the email address seems like a perfect solution to this problem.
    - Swizec 5y ago
      My favorite problem are people who go “Never email me again about anything” then a few months later complain “Why didn’t you tell me about the new version?”
codetrotter 5y ago
> I’m seeing more and more legitimate stuff land in […] spam filter. I use iCloud Mail with a custom domain, after having self-hosted my mail for many years. I had some job interviews recently and in a couple of cases iCloud Mail was spam filtering the meeting invitations. Whoopsie! Fortunately in both cases we had communicated about when the meetings would take place outside of the invitations. So even though I didn’t see the invitation mails, I knew when the meetings would take place, and in the case of lacking a link to join one of the meetings I got them to send me another link for the meeting. And on the whole I will say that iCloud Mail is much more comfortable and convenient for me to use than continuing to self-host my mail. Both in terms of keeping spam out of my inbox, and in terms of mail that I send getting to other peoples inboxes rather than ending up in their spam.

slig 5y ago

Gmail's spam protection has been broken for ages. I'm keeping getting obvious spam (pills, eggplants emojis, money from prince kind of stuff) directly into my inbox. At the same time, legitimate email is going to the spam folder.

sealeck 5y ago
Yup me as well. A simple Bayesian model seems to be the only thing which works for keeping out obvious fraud, and for more sophisticated fraud it's tough to do it automatically.
e40 5y ago
The "zoom" spam in Vietnamese just kills me. How does that get through??
dmd 5y ago
I seem to have the opposite experience. I've been using the same email address, never hiding it at all even on Usenet, for 25 years. I get >600 spams/day and ~20 non-spam, and at most 1 or 2 spams get through Gmail's filter. I want to move to Fastmail, but every time I try it out, their spam filter lets through 50-75/day, which is unworkable.

pphysch 5y ago

Like it or not, this is the price of "privacy". Being able to easily pretend to be anyone, in the absence of an overarching identity framework -- and leaving identity recognition to the end user -- makes cybercrime a lot easier than it has to be.

mulmen 5y ago
Privacy does not mean anonymous interaction with known parties. It means the CIA can’t see me make an account transfer over the wire. In other words, without a warrant. Authentication and privacy are compatible. Privacy and anonymity are orthogonal.
- dreamcompiler 5y ago
  In theory the CIA cannot legally monitor anything about you if you're a US person, even with a warrant. That's the FBI's job. If you're not a US person the CIA can monitor you all day long without a warrant. In practice it's a bit messier than that.
  - deleted 5y ago
    [deleted]
- pphysch 5y ago
  The CIA can and will monitor your offline and online behavior if your profile is interesting to them. No amount of "muh privacy" appeals will stop them. Privacy and anonymity are absolutely not orthogonal. How do you KYC? By "violating" their privacy (storing and querying personal records) to identify (deanonymize) someone.
  - mulmen 5y ago
    > The CIA can and will monitor your offline and online behavior if your profile is interesting to them. That’s because we don’t have adequate privacy safeguards in modern western society. > Privacy and anonymity are absolutely not orthogonal. Privacy and anonymity are not synonymous. I can have a private conversation with a friend. That does not require anonymity. In fact it precludes anonymity because my friend and I know who each other are. Privacy says nobody else knows what we discussed or even that we had a conversation. > KYC? Know Your Client? This is a new term to me but sounds like an authentication concept. Which is compatible with privacy but precludes anonymity, by definition.

vmception 5y ago

Its just different people disrupting the spam space. Someone looked at the operational assumptions of “lets target gullible people by using stupid obviously fraudulent scenarios so that we can weed out everyone who wont play along” and noticed it is missing a very large target market unnecessarily.

infogulch 5y ago
That almost sounds like an argument for why old school scammers are relatively ethical.
- vmception 5y ago
  I don't know that argument.