4 ms·
That 'unsubscribe' button may be a scam
- hereme888 1y agoemail aliases are the only real protection I've ever found. Fastmail offers almost unlimited aliases, and throwaway addresses. Others are starting to do it. I doubt gmail will ever offer aliases or similar protections.
- Disposal8433 1y agoIt's sad because all the new "private emails" like Tuta only offer a very limited number of aliases. Legit throwaway addresses offer a good compromise between privacy and security. > try to count how many times you clicked “Delete” on junk or unwanted inbox messages I don't understand that sentence in the article though. I click on "report spam" every time because that's what it is, even if it's a legitimate business that I used in the past. They use dark patterns to make you subscribe, but it's not honest, therefore -> spam.
- reynard_le_faux 1y ago“Spam” as a neologism doesn’t have a widely agreed upon shared definition. The most apt would seem to be “email I don’t want”. But that’s not too helpful when third party gatekeepers are trying to mass assign status to an email. The same email could be unwanted by one person and very gratefully received by the next.
- Rygian 1y agoMy standard definition is "email from a sender not in my whitelist"
- andrewinardeer 1y agoMy employer demands I refer to this now as an "Allow List" and "Deny List', no more white list or black list, master drives or slave drives.
- hiatus 1y agoTuta lets you use a catchall. The alias limitation only applies if you want to send mail as the alias.
- nahkoots 1y agoCan't you use youraddress.servicename@gmail.com? I thought gmail strips whatever comes after the dot. (I don't have a google account, so I could be wrong or maybe it was a different character, but I remember reading about it a couple times on here.)
- edwardbernays 1y agoIt's "+". The dot is, in fact, transparent.
- GrooveSAN 1y agoAfter the +, not the dot
- jussaying2 1y agoYou're thinking of the + character. youremail+servicename@gmail.com will still be delivered to you. Gmail ignores dot characters. y.o.u.r.e.m.a.i.l@gmail.com is equivalent to youremail@gmail.com
- eldridgea 1y agoI believe it strips everything after a "+" so you can use youraddress+servicename@gmail.com. It ignores periods so you could also use your.address@gmail.com or y.ouraddress@gmail.com or whatever. Some sides block plus addressing but that's what I use a lot of the time.
- 2bluesc 1y agoI think you mean yourname+servicename@gmail.com From my experience, many (bad) websites consider "+" an invalid character and prevent you from using the address in this form. Smart spammers can just strip the service name since it works the same for all Gmail users. Really need dedicated addresses like Fastmail's Masked Addresses.
- ryoshu 1y agoGmail has aliases that have a + in them, e.g. foo@gmail.com -> foo+bar@gmail.com. I use them for subscriptions: foo+substack@gmail.com, etc.
- Rygian 1y agoSo if you provide address+suffix@gmail.com, the spammers know that address@gmail.com is a legit address.
- danaris 1y agoYes, but only if they're bothering to do that level of checking. I would guess that that's pretty rare, as not many people know about this trick.
- andrewinardeer 1y agoI thought this was commonly known, particularly in the mass mailing marketing industry.
- bitmasher9 1y agoThis type of pattern is very easy to scrub if you had a list of email addresses. I have an anecdotal evidence inside my own inbox that this behavior is happening. You aren’t buying security from anything but the lazy and ignorant spammers.
- AznHisoka 1y agoAgreed. This tactic is so overused that spammers have caught on for quite awhile
- ProllyInfamous 1y agoI don't use email anymore, but the last few years I did was only possible because I owned a domain name and had a catch-all set up. You can then immediately isolate any bad actors, and don't have to rely upon a `+` sign (easily filtered) to "differentiate" email addresses. More-commonly-used logins can then be preliminarily filtered to separate internal email accounts (e.g. known-junk can be sent to rarely-accessed account; family contacts can be sent to notifications).
- rockbruno 1y agoYou can have aliases on Gmail if you use Google Workspace (for custom domains), but there's a limit and no support for wildcards. Wish they had those, because then it's very easy to find out who sold your data
- cobbzilla 1y agoI primarily use a @duck.com alias that forwards to my gmail account. It's easy to generate random new @duck.com aliases for the primary. I have a browser plugin (mobile and desktop) that recognizes email form fields and offers to generate a new random @duck.com alias for the field. When an alias starts to receive spam, I disable it.
- CoastalCoder 1y agoI always assumed that the unsubscribe link in email/SMS spam was part of the scam. I.e., they didn't know if the spam ever reached an actual inbox until you followed the unsubscribe link.
- snowwrestler 1y agoThis is less true than it used to be. Email inbox providers return a hard bounce if the email does not exist. Most load images by default, which returns a positive signal. Same thing with SMS: if the number can’t receive SMS, the system returns an error. If you’re not sure, using the client-provided unsubscribe link (usually up near the “from” address or subject line) is better than the one in the footer. Inbox providers like Gmail, Microsoft, Yahoo etc log these clicks and use them to adjust their filters.
- hyperjeff 1y agofirst thing i do on any email setup is turn off autoloading images to kill that positive signal. just doing this has cut down spam considerably.
- grugagag 1y agoYes. Once you hit unsubscribe you signal you care about that mailbox. At that point they start autosubscribing a lot of garbage to you.
- williamdclt 1y agoFWIW I use unsubscribe all the time and it’s quite effective, i don’t get the sort of garbage you describe. The only unwanted emails I get are after signing up for a new service and they start sending me marketing emails (which I almost certainly didn’t consent to so I’d say that’s spam, but at least I know where it’s from and these are the ones I unsubscribe from) Edit: maybe it’s just that gmail spam filters work well?
- arp242 1y ago
- ProllyInfamous 1y agoIs this missing the (2001) tag? /s
- Groxx 1y agoJust another reason to report literally anything from a business that you don't desire as spam. Auto-checking that "send me spam emails" box should hurt their spam score enough to make them stop doing it.
- snowwrestler 1y agoMy general approach is: if I recognize that it is something I signed up for, I usually use the unsubscribe link (either in the email client or the email footer). If I get another email from them after about a week, I mark that as spam. Same idea with text messages. If I know why I’m getting it, I use the “reply STOP” feature. If I don’t recognize the sender of an email or text, I mark it as spam or junk. Apple Messages has a nice “delete and report as junk” feature for unwanted text messages.
- linsomniac 1y agoAgreed. Gmail has a handy "block and report as spam", but if there's a "unsubscribe" link it will often ask if you are SURE you don't want to just unsubscribe. A nice feature because I've seen all too many times over the decades people report spam on messages from lists I'm quite confident they signed up for.
- venusenvy47 1y agoGmail has at least two options to choose from: "Report as spam" and "Report as phishing". I sometimes can't decide which to use.
- ndsipa_pomu 1y agoPhishing emails are pretending to be someone else (e.g. PayPal, DHL etc) to get you to put in your account details.
- Molitor5901 1y agoIf only "delete and report as spam" actually worked. For years I've gotten spam text messages and the report as spam doesn't seem to work. Maybe it's different with other carriers.
- saintfire 1y ago> A good rule of thumb is knowing that no legitimate business will request your username and password after clicking their email’s unsubscription button. Just FAANG and fintech. Pretty lousy rule of thumb.
- athenot 1y agoI've seen legitimate businesses outside those areas use that as a dark pattern. Basically you go to unsubscribe from the mailing list and they throw another hurdle at you, hoping you'll give up.
- w3ll_w3ll_w3ll 1y agoBut this is against the "One click unsubscribe" policy that many mail provider have implemented, so they risk being labeled SPAM anyway. https://www.valimail.com/blog/one-click-unsubscribe/ https://www.valimail.com/blog/one-click-unsubscribe/
- RandomBacon 1y agoThat's because anything other than "one click unsubscribe" violates the U.S. CAN-SPAM Act.
- snowwrestler 1y agoThe one-click policy is actually about sending the list-unsubscribe header so the email client can render an opt-out button. An unsubscribe link in the body of an email can have a confirm step. In fact if you are serving a B2B audience it is essential that you do, since an increasing number of security services like Barracuda, Fortra, etc. auto-click every link in the email body to check for phishing. If you have one-click unsubscribe links in your email body, those people will be constantly unsubscribed without their knowledge.
- natpalmer1776 1y agoRealistically, even in B2B how many people legitimately want marketing emails or mailing lists at all?
- boothby 1y agoMy favorite is my alma mater, the University of Washington. They break their communications into categories, and opting out of everything opts out of each category at the backend. For years, I've opted out of "everything" every few months, because any time they add a category, they default me into it and I get an email.
- anonym29 1y agoReport them to spamhaus and get their mail servers added to spam blacklists. It's a great source of motivation for negligent mailers to get their **** together.
- dpkirchner 1y agoThey do the same thing with physical mail, sending out difficult to recycle slick mailers. I doubt they care at all.
- gammarator 1y agoFor UW specifically, it is possible that this can be explained by incompetence rather than malice.
- Jaygles 1y agoI unsubscribe from mailing lists 20x more often than I knowingly subscribe to them. It should be illegal to sign someone up to a mailing list without explicit consent. If I create an account with my email, or provide it as a part of a checkout process, you should not have the ability to sign me up to a mailing list without me explicitly opting in via a dedicated checkbox or button (and it should initialize as un-checked of course). Breaking the mailing lists into 30 different categories is w/e, but auto opting people in to new categories should also be illegal. Such a scummy dark pattern
- arp242 1y agoI used to run a mailing list for my blog. I've gotten some pretty hostile responses to people who were adamant they never subscribed to my mailing list. I have no idea how this happened; I just coded a simple form with a basic Turing test ("please enter the number 9 here" works well enough for small sites). Did they forget they subscribe? Did someone else use their email? Did someone typo the email address? Bots? No way for me to know.
- Chalbroth 1y agoI always consider the unsubscribe button to be a trap when it is not accessible through Tor.
- jfengel 1y agoDNSFilter estimates that 1 in every 644 email unsubscribe links is liable to send a user to possibly malicious sites. And while that might seem like a low percentage at first glance, try to count how many times you clicked “Delete” on junk or unwanted inbox messages in the last week alone. Not many, these days. Google does a good job of separating out the actual spam. The vast majority doesn't even go to the spam folder; they just delete it. Dunno what criteria they use but I'd bet most of it is really really obviously bad. I see some legal commercial email, and if I did in fact do some kind of business with them, I hit unsubscribe and they stop. No harm, no foul. I see some legal commercial email in my spam folder. I never want it, but I unsubscribe, and again, no harm no foul. My spam folder is down to about one per day. (Plus untold thousands that I never see at all.) It's surely not perfect and perhaps once or twice a year something genuinely dangerous gets into my inbox. Given the wild wild West that email was until recently I take that calmly. Email was rapidly approaching unusable a decade ago.
- b0a04gl 1y ago[dead]
- MilnerRoute 1y agoEven the article's own statistics concede "scam" unsubscribe links are very, very rare... "DNSFilter estimates that 1 in every 644 email unsubscribe links is liable to send a user to possibly malicious sites."
- thom 1y agoFastmail adds a header to every email with any sort of unsubscribe link. I send those to their own folder (except ones I add to contacts). My main inbox is basically 100% things I expect to see there at this point. I view the mailing list stuff less regularly and unsubscribe anything I don’t want there. If it keeps coming (or if the unsubscribe process requires more faff than doing it through my mail client) I delete it and mark as spam. In 30 years I don’t think I’ve ever felt more in control of my email.
- Molitor5901 1y agoI've always felt this way, any indication that you are there and receiving the email is just a system somewhere a long the line opting you into something else. My general rule for some time now is to report it as spam, and block the domain. Never respond, never acknowledge. Same with telephones, if I don't recognize the number I just don't answer.
- xnx 1y ago"!" key to report spam in GMail. Even faster than an unsubscribe link.