Hacker News Reader

Comment by icebraining | Hacker News Reader

No, because it would help spammers identify valid addresses.

This is the argument I see everyone using, but I don't understand it. Why does it matter if a spammer knows your address is valid, if they've already decided it's valid enough to spam it? Do you think spammers really bother to validate their address-lists before reselling them to other spammers? (Even if they do, though, I think it'd be irrelevant. If your spam filter is effective, it doesn't matter how much "true spam"--things you have absolutely no chance of finding interesting--you get. It all gets filtered away before you see it.)

Think about it this way: if there was an auto-unsubscribe mechanism, which ethical bulk email senders honored and spammers didn't, then it would become much easier to filter spam: any message that clusters into a message-cluster that the system has sent out an unsubscribe-request for already, is junk.

Maybe more importantly, they would know whether their message was classified as spam (or a pretty good heuristic thereof). A naive bayes classifier for spam relies on the spammer not knowing whether the message was marked as spam or not. Such a classifier isn't difficult to fool if you can test how a given message is classified. (Presumably gmail's spam filter is more advanced these days, but the idea that it is easier to fool if you can tell the result still seems reasonable.)

Here's an alternative idea: what if clients would only honor rel='unsubscribe' links with an HTTPS URL scheme, and only finish the TLS handshake for those requests if the host sends the client a valid Extended-Validation certificate?

Every spammer who wanted to "trick" the auto-unsub mechanism would basically have to first dox themselves for all the world to see. And any certificate that turned out to not be a valid means of contacting the spammer would be quickly revoked.

Well can't they do that anyways, by sending emails to an address they own and seeing what gets classified as spam?

>Why does it matter if a spammer knows your address is valid, if they've already decided it's valid enough to spam it?

Because then they can dictionary attack a large list of random emails, send out a trivial campaign, and collect a list of valid users then sell it to someone else.

Reply on news.ycombinator.com