Hacker News Reader

Comment by tgb | Hacker News Reader

Why do they do that? Seems great for this use-case but terrible information to give bad actors.

When I've usually clicked the report spam and unsubscribe button after reporting spam in gmail it usually immediately opens a tab with the unsubscribe URL.

I've since stopped doing it since the last thing I want to do is open up some random page belonging to the person who spammed me.

That's strange. I thought the point of that button was to overcome the exact problem you just described.

Tried it again with a different message and they said they'd try to unsubscribe me this time instead of opening a link.

Did try again yesterday with a different spam message and had it open a tab though; Zapier was spamming me with some newsletter so I clicked "Report Spam and Unsubcribe" yesterday and it opened up this in a new tab: https://zapier.com/app/settings/email?payload=REMOVED

Not really sure how it determines that -- I'll probably avoid clicking it just out of precaution and just report spam going forward though.

Using a lot of the privacy and security measures suggested in https://www.privacytools.io/ I sometimes do a gmail search using 'is:unread in:all unsubscribe' and click on most of the links I can find.

In some cases, Gmail automatically detects the unsubscribe link. If you click Gmail's unsubscribe link, it may give you a pop-up or it may automatically write an email to unsubscribe@example.com. The pop-up usually leads to a form that you have to fill to 'update your newsletter preferences'.

What information does this reveal besides your email address, which they clearly already have?

It confirms that the address is valid, and most likely attended by a real person.

But there are gazillion email leaks. Go scrape them all with hashed passwords. Active emails have no value.

You're right that they don't have value but there's still plenty of idiots out there buying and selling useless lists and while they're worthless they have a cost to us as recipients since we have to mark them as spam and delete them.

Leaks may have emails that are defunct, belong to dormant accounts nobody reads, throwaway accounts like mailinator.com, honeypots, etc. This confirms the account belongs to a real human actively reading the email.

It's a feedback signal showing success at passing automated spam filters.

It reveals that their email was detected as spam by an intelligent piece of meat instead of a shard of silicon.

Email lists with verified activity have a higher success rate and sell for more.

Many times when you hit the spam button, gmail ask if you want to "only mark as spam" or "mark as spam & unsubscribe".

Would make sense to prevent themselves to be marked as spam in the future.

idk, I'm trying to find a way a bad actor could take advantage of that information. Kind of helpful for spammers to get a sense of what does and does not get marked, but they can just see how many people clicked the link.

In the past (10+ years ago), clicking the Unsubscribe link in a spam email was a sure way to get your email address sold to every spammer out there.

Most of those bad actors seem to have been weeded out, but some still might try it.

Reply on news.ycombinator.com