Hacker News Reader

Yes, I completely agree. This should be standard for all account welcome emails.

For a long time, Uber didn't validate email addresses; lots of people set up accounts using my gmail address. I had no recourse.

For eight years, I've been trying to get my email address out of Xfinity's databases. The customer support team literally can't find my email address in their system and I still get emails. They passed my case on to engineering and they can't find it either. Not only have I never been an Xfinity customer, I've never even lived in an area where I could have be an Xfinity customer. Thankfully, the emails are few and far between now.

Just set up a filter to delete them. I've been doing this for all Facebook emails for years.

Yes, I do have a filter for them. But it's still annoying since it's just shifting the problem -- now I have a growing list of filters to maintain. But I appreciate the suggestion.

> Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $43,280, so non-compliance can be costly.

https://www.ftc.gov/tips-advice/business-center/guidance/can...

From what you said it appears every single one of their emails is a violation.

I don't know how much time it will take you to actually pursue that or whether it will be worth the time, but I'm sure lots of people will be very happy if you make Comcast lose a bunch of money.

I fully agree. A while ago, I registered a domain name consisting of adjacent keyboard letters and set up a catch all email address (huge mistake). Next, I got roughly 1000 mails per week, of which fifty were promotional offers sent to "my" Verizon accounts. Of course it is impossible to reach any human being at Verizon to get this fixed.

What email host are you using? Have you considered blacklisting individual email addresses?

> "If you didn't create this account, use this link and you'll never get another email at this address"

If I get an unsolicited email for a service I don't recognise, that has a link in it and a message asking me to click on it, should I click on it?

Commmon advice is don't click on links in mails you aren't expecting. It just confirms your address is real for spam harvesting.

This is what I've heard as well, although I've never actually confirmed it to be true.

I don't know who gives that advice, but it seems poorly thought out. Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email.

I'm also not sure what you're afraid of. If your account has been in existence for long enough, you already get a lot of spam. It just gets blocked or filtered. The vast majority of your emails that actually get to your inbox are from people trying to do the right thing, not people trying to screw you over.

I think they are afraid of a phishing attack that requires a click to land a remote code exploit.

> Email providers already tell people sending email when an address is real or not.

I don’t think email works the way you seem to think it works.

Email deliverability was part of my job for around 8 years. Providers will absolutely send you a bounce message (via the return path email) if an inbox does not exist. Or even if it is full.

The messaging is not standard so you have to do all sorts of special case parsing because each provider can give a different message. And ignoring these messages will hurt your ability to deliver email.

So if your plan is to hide your address from people, again, I don't see the point.

I believe there's value to marketers to know "this email address somewhat reliably hits a human's eyeballs" as evidenced by a click-to-unsubscribe or click-to-refute action as a stronger signal than "well, we didn't get a bounce".

"Email providers already tell people sending email when an address is real or not." suggests a level of reliability of signal that simply doesn't exist. I have an infinite number of email addresses that you could send to, which would not give you a bounce, and none of which will reliably land in front of a human's eyeballs.

> Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email.

My bad for lack of clarity.

I meant whether the address has a person reading it, making it a more valuable target, perhaps added to a commercially sold database.

I don't know if or how much this happens. But it's obviously an available signal.

> If your account has been in existence for long enough, you already get a lot of spam.

True! I got 6000 spam a day at one point. Thankfully it went down to 1000 a day and has slowed since.

> It just gets blocked or filtered.

Unfortunately not so well. The vast majority is filtered, but that still leaves too much getting through (I got about 80 in the last 45 hours), and in conjunction with such a high level of false positives that good things go to the spam bucket, a problem both as a recipient and a sender.

Gmail is not immune either; I often find critical false positives in my Gmail spam folder.

Spam is not a solved problem, and the solutions are causing other problems.

I don't have solutions, but I don't agree that it's "just" blocked or filtered. If only email was that reliable!

That's illegal. You want me to opt-out in order to stop spamming me?

Nope. I will never click a link in some spam mail I receive. Even if you claim that your service is "legitimate".

If you want to be allowed to email me, you must often a double opt-in. And that is a click to confirm the address.

That's not what I was suggesting at all. If your service actually sends people emails (other than, say, password resets), then you still need them to follow a "verify your email" link before sending them mails other than the single "welcome" message containing that link. I'm just saying that you don't need to wait for email verification before letting people make and use an account, as long as you don't send them any more emails beyond the welcome message.

Many services don't send regular emails, and only ask for an email so that 1) everyone has a unique identifier without having to make up a unique username, and 2) they can do password resets. For such services, the procedure above makes sense to reduce friction.

I still wouldn't want someone else to be able to register for some service using my email. What happens if I want to use the same service in the future?

That happens to me all the time as I have a very generic email address (one of the first users of Gmail). Someone seems to have registered to Facebook with my email and now I can't disassociate it. People searching me by my email address on Facebook end up with that random guy.

Shouldn't you be able to request a password reset, which would send an email to you and then you would delete it?

Already tried that. It asks me that other person's private information (such as date of birth).

How am I going to send you an email asking you to click to confirm if I have to confirm your email before I send you an email?

Far too many websites don't do this. A lot of people seem to think that my Gmail address is their's, so I end up signed up for a lot of email lists.

I'm sure Apple is good about this now, but many years ago someone had used my Gmail address for their Apple ID. I wanted to switch my Apple account to use my Gmail, but couldn't because someone else's account used it. Support told me they couldn't do anything about it. I don't know why it didn't occur to me to do this first, but I just reset their password, changed the email address to something else, and reclaimed my email.

> I just reset their password, changed the email address to something else, and reclaimed my email.

I understand it’s the other user’s fault for using your email address in the first place, but I wonder if you could have contacted them to warn them about the change (since they would lose access to their Apple account instantly, with no recovery option). I’m not blaming you. I’m just wondering how it would be done, if needed.

I assume that user, when signing up with your email, either a) made a mistake b) was being unhelpful c) or didn’t understand he whole email/ID concept.

I've been on the receiving end of a similar thing (but with a gaming website), and there's a flaw with your logic: How would you contact them? The email address they used is yours, it's not like you can just send them an email, you don't have their address.

Apple's obviously not going to revert the previous AppleID to your email but I would bet that address is on some kind of 'might be sketchy' list now.

(in case anybody needs to hear it, this is not a launch requirement)

It only takes one high-profile spamming incident to kill your reputation. This isn't hard to implement.