A phishing email with a bad link was partially responsible for the outcome of the 2016 US presidential election.
Such messages are responsible for a large amount of damage at various companies, measured in stolen trade secrets or actual money from accounts, of even company wide shutdowns with destructive malware. Opt-in confirmation or open rates on marketing mail just isn't going to make that cut. The benefits to the individuals or receiving companies of the marketing mail is pretty small compared to the benefits to the senders. Receivers are selling security to their customers, and the customers are receptive. They're spending millions per year on various protections. I think some enterprises would be happy if we blocked all marketing mail to their companies, especially consumer marketing mail. We've had spam escalations related to that from enterprises when we've made changes that went easier on some better reputation marketing mail. Brandon On Tue, Oct 16, 2018, 3:37 PM Luis E. Muñoz <mailop@lem.click wrote: > > > On 16 Oct 2018, at 15:12, Brandon Long wrote: > > > On Tue, Oct 16, 2018 at 3:06 PM Luis E. Muñoz <mailop@lem.click> > > wrote: > >> I can see the value of the datapoint. That said, if the automated > >> filter > >> visits a confirmation link then it would be breaking COI. How are > >> ESPs > >> discerning between those visits and the ones originated by the > >> recipient > >> actually clicking on the confirmation link? > > > > Force the user to click something on the confirmation page? > > Yes. It's not like there are that many options after all. > > > I'm sure that reduces the opt-in rate, but that's the price for > > everything > > being terrible. > > Well, the silver lining is that this will tend to inflate open rate > metrics, specially for questionable ESPs/content which will have more > clicks recorded because their email needs more scrutiny :-) > > >> Hopefully this behavior is restricted to images and collateral, not > >> actual links... but once the line is broken, it's only a matter of > >> time > >> I guess. > > > > I doubt it's restricted in that way, I don't think that would make > > much > > sense. > > Heh. "A request to <destructive operation> was received. If you did not > request this, you can ignore this message. If you want to proceed, click > here". This is a very common formula. Even Google's security > notifications about suspicious account activity seem to work this way. > > It's not too farfetched that someone could use this to get accounts > suspended. > > Just to clarify, I understand the mechanism and its rationale. I just > disagree on the weighting used to drive the implementation decision. > This is clearly a case of "my system, my rules", with the impact > associated with the big boys doing it. > > Best regards > > -lem >
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
