Slashdot Log In
Spam Replacing Postal Junk Mail?
Posted by
kdawson
on Sat Apr 11, 2009 01:30 PM
from the connecting-the-dots dept.
from the connecting-the-dots dept.
TheOtherChimeraTwin writes "I've been getting spam from mainstream companies that I do business with, which is odd because I didn't give those companies my email address. It is doubly strange because the address they are using is a special-purpose one that I wouldn't give out to any business. Apparently knotice.com ('Direct Digital Marketing Solutions') and postalconnect.net aka emsnetwork.net (an Equifax Marketing Service Product with the ironic name 'Permission!') are somehow collecting email addresses and connecting them with postal addresses, allowing companies to send email instead of postal mail. Has anyone else encountered this slimy practice or know how they are harvesting email addresses?"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Do you shop online? (Score:5, Interesting)
Re:Do you shop online? (Score:5, Informative)
A given site can only read cookies which have been set by the same site (well, domain). There are various exploits to get around this called Cross Site Scripting (XSS) attacks which involve somehow putting javascript onto someone else's page (such as a slashdot comment). This type of attack can be thwarted by properly escaping any dynamic content.
Allowing access to other site's cookies is a problem because most sites which allow you to log in tell users apart by giving each of them a different cookie. By stealing someone else's cookie you might be recognised as them without having to log in.
Parent
Re:Do you shop online? (Score:5, Informative)
Parent
Re: (Score:3, Informative)
How easy is it for some Javascript or something to poke around for e-mail addresses when you are at a site?
Decent browsers don't expose data not created by the site, aside from the standard browser ID, and even that can be turned off. And if you use a browser with the security profile of swiss cheese, your email adress is not your main problem.
Also, my e-mail providers know my address - i.e. yahoo, google, aol, apple and comcast. Could they be selling that information? I wouldn't be surprised.
That's just about the only thing I trust Google not doing. If you want to know how they get it, try giving out different adresses to different sites and see which ones get what spam.
Re: (Score:2, Funny)
My standard email address for sites I dont wish to give my real details to is bill@microsoft.com
I used to give the local recycling centre as my real address.
have your own domain-get universal forwarding (Score:5, Informative)
I have my own domain- EVERYONE except family gets a different email address
one gets caught by spammers- the address gets killed.
I understand gmail allows using a + in the address line to sort mail in a similar fashion
googleid+identifyingstring@gmail.com and you still get it-- only you know the source.
Re:have your own domain-get universal forwarding (Score:4, Interesting)
Parent
Re:have your own domain-get universal forwarding (Score:5, Informative)
Not so much that they discourage it, they just have badly coded email validators. The allowable characters in an email address is much broader than most systems' valid usernames, but the lazy just assume people will only have a username as their mailbox.
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
You may have a hard time telling where it came from (they could accept address+marker@gmail.com and then scrub the +marker, it isn't exactly a secret).
Re:have your own domain-get universal forwarding (Score:5, Interesting)
Parent
Re: (Score:2)
If Google wants to use email addresses this way, they should submit their own RFC, and maybe change the specification... for the better.
Re:have your own domain-get universal forwarding (Score:4, Informative)
No it doesn't. Using the plus sign in an email address is already specified in the RFC and has been for quite some time.
Parent
Re: (Score:3, Informative)
RFC 5233 [ietf.org] mentions it.
Re:have your own domain-get universal forwarding (Score:5, Informative)
Which RFC, though?
821 (from 1982) does not allow it.
822 (also 1982) does.
2821 and 2822 (2001) also respectively don't and do.
Parent
Re:have your own domain-get universal forwarding (Score:4, Funny)
Ancient relics. It's all about RFCs 5321 and 5322. Don't you get a feed of all the latest RFCs?
I've got it set up as a podcast in iTunes.
Parent
Re:have your own domain-get universal forwarding (Score:4, Informative)
While using the + in this fashion is a great idea, it breaks the specification for email addresses in the RFC.
Wrong, wrong, wrong.
RFC5321 is the relevant RFC.
Wikipedia [wikipedia.org] summarizes the permitted characters in a somewhat more human-readable fashion. The "local-part" is the part of the email address to the left of the @:
>The local-part of the e-mail address may use any of these ASCII characters:
>
> * Uppercase and lowercase English letters (a-z, A-Z)
> * Digits 0 through 9
> * Characters ! # $ % & ' * + - / = ? ^ _ ` { | } ~
> * Character . provided that it is not the first nor last character, nor may it appear two or more times consecutively.
A "+" does not break the RFC. It may break some buggy address validators. (Note that there are also other interesting possibilities for breaking non-compliant software, such as case-sensitive addresses.)
Parent
Re:have your own domain-get universal forwarding (Score:5, Informative)
I understand gmail allows using a + in the address line to sort mail in a similar fashion
googleid+identifyingstring@gmail.com and you still get it-- only you know the source.
Only until someone 'helpfully' sends you something from a postcard site, joke list, or lottery draw. Then you'll get spammed at the "root" address (sans "+") and almost never again at any "+" address.
Don't ask me how I know this.
Parent
Re:have your own domain-get universal forwarding (Score:5, Informative)
So do I. I also have * addressing as a catch-all. When I have to provide an email address to register at a dubious site, I make one up that tells me something about where I used it; e.g., to sign up at example.com, it might be examplejunk@mydomain.com. That way, if I ever get anything sent to that email address and not clearly from example.com, I know exactly who sold my email address, and can add a filter deleting everything sent to that address. It hasn't happened, yet, but maybe I've just been lucky.
Parent
Re: (Score:3, Informative)
I used to do this, but can now say that 'catchall' addresses suck.
Firstly, some spammers brute-force addresses, so you will receive spam sent to john@yourdomain, nancy@yourdomain etc.
Secondly, if you ever decide you want to kill your catchall, you'll find it impossible to find all the sites which have their own addresses.
I just use Gmail now.
I had enough (Score:3, Interesting)
I use 2 emails, one for spam and one for private mails.
Now both my emails are full of junk, but while google spam option are working my old yahoo email is beyond saving.
Just keep clicking on "this is spam". It's not worth your time to understand why it's happening, and even if you do understand, you will find out it's impossible to avoid.
Hell, I can't even check my old SMS because it's full of spam.
Re:I had enough (Score:5, Insightful)
I use 2 emails, one for spam and one for private mails. Now both my emails are full of junk...
It should be:
One for email from IT persons.
One for registration confirmation and chainmail-forwarders.
Parent
Mod parent up: +5, Truth (Score:4, Insightful)
Never got that funny, but the spams just starts flooding in.
Now I'm a lot more picky about who gets to see my real address. The rest goes to my temporary catch-all of the month.
Parent
Re:I had enough (Score:5, Funny)
Parent
ISP ? (Score:4, Insightful)
first person I would suspect is the ISP or your webmail
without knowing any details of even the country your in it's kind of hard to guess...
but ISP's use deep packet inspection and even easier I am guessing you fill in your email address for their webmail and they bill you...
regards
john jones
What I do... (Score:5, Funny)
Email honeypot traps (Score:5, Informative)
Re: (Score:3, Insightful)
I use a special domain name which maps all aliases (*) to my mail box. Nearly every email I use for online purchases or registrations is custom for that site so when I receive email from an unexpected source I can trace it back to where I originally used it.
I've been doing this for a few years now, because I thought it was a good idea, and here's what I've discovered: very few companies actually seem to sell my e-mail address to spammers. What I tend to get from them is dumb newsletters that they honour my
Use temporary addresses (Score:2, Informative)
Yahoo lets you create temporary addresses that you can disable at the drop of a hat.
I use those for most of my business correspondence.
Your mail provider may offer something similar.
Re: (Score:3, Informative)
E-mail is Preferable, it can be Filtered (Score:4, Insightful)
Re:E-mail is Preferable, it can be Filtered (Score:5, Funny)
i disagree, with postal spam at least if they provide a pre-paid return envelope i have the satisfaction of putting everything they sent me in that envelope, along w/ a few rusty washers (to add weight), and maybe a sunday paper glossy ad or two (more weight, and thickness) and sending it back to them on their dime.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Not according to what I've read, although I can't locate a cite at the moment. One of the reasons it costs less, BTW, is that much of the Post Office's work has to be done ahead of time, such as sorting out the mailing by zip code. However, just to pick a nit, if bulk mail cost .9944 the cost of first class postage, it would still "cost a fraction of wh
Re: (Score:3, Funny)
i disagree, with postal spam at least if they provide a pre-paid return envelope i have the satisfaction of putting everything they sent me in that envelope, along w/ a few rusty washers (to add weight), and maybe a sunday paper glossy ad or two (more weight, and thickness) and sending it back to them on their dime.
Obligatory bash.org anecdote:
#127039 +(10530)- [X]
[wolf] 1. Save every Free Credit Card Offer you get, Put it in pile A
[wolf] 2. Save every Free Coupon You get, put that in pile B
[wolf] 3. Now open the credit card mail from pile A and find the Business Reply Mail Envelope.
[wolf] 4. Take the coupons from pile B and stuff them in the envelope you hold in your hand.
[wolf] 5. Drop the stuffed to the brim envelopes in your mail and walk away whistling.
[wolf] I have now received two phone calls from the credit card companies telling me that they received a stuffed envelope with coupons rather then my application. They informed me that it they are not pleased that they footed the bill for the crap I sent them. I reply with "It says Business Reply Mail" I'm suggesting coupons to you to ensure that your business is more successful. They promptly hang up on me.
[wolf] Now, I did this for about a month before it got boring, so I got an added idea! I added exactly 33 cents worth of pennies to the envelope so they paid EXTRA due to the weight. I got a call informing me about the money, I said it was a mistake and I demanded my change back. After yelling at the clerk and then to the supervisor they agreed to my demands and cut me a check for the money. I hold in my hand at this very moment a check from GTE Visa for exactly 33 cents.
Re: (Score:3, Informative)
if they provide a pre-paid return envelope i have the satisfaction of putting everything they sent me in that envelope, along w/ a few rusty washers (to add weight), and maybe a sunday paper glossy ad or two (more weight, and thickness) and sending it back to them on their dime.
Don't bother. Business reply envelopes that are clearly not used for their intended purposes are discarded by the Post Office as waste [straightdope.com]. So now all you've done is annoy your local letter carrier and increase the burden on the postal
Re: (Score:3, Insightful)
Also, at least email is probably more environmentally friendly then manufacturing the paper, the ink, any other chemicals involved, and then shipping the stuff across country. It's really sad, when you think about it-- all that trouble just to deliver trash to my doorstep.
I know, that's not a novel thought; that's why they call it "junk mail". But it still strikes me funny whenever I really think about it. People almost literally manufacture trash and send it to your address against your wishes, just fo
I wish spam replaced postal junk mail (Score:2)
It is a hell of a lot easier to deal with digital spam than the paper kind. The paper kind accumulates in my house and clutters the place up. It wastes dead tree and plastic. At least with the digital kind I can press a button and *poof* it's gone. I can only hope that more businesses will switch to 100% digital spam.
On a related note this is pretty much the same reason I don't get my news from a paper newspaper (well, among others). I got sick of having newspapers piling up in my home. I get 99% of al
Re:I wish spam replaced postal junk mail (Score:5, Interesting)
There is a trash can right next to my mailbox, which enables me to deal with paper spam about as easily as the electronic kind.
I do keep the little response cards with "return postage guaranteed" stamps, though. Those are great for gluing to bricks or other heavy objects you want to dispose of. Drop them in a mail box, and they not only get wind up in a mailbox at the company that spammed you, but that company gets billed for the postage, by weight. The heavier the object, the better!
Parent
I am a database direct & email marketer (Score:4, Informative)
What's happening here is that there are companies that aggregate profile information, and they're able to link your email to your profile information. They then sell append services so the marketing company can add that email to your existing full name and address (FNA).
It is wrong for companies to append an email address and then market to it.
Companies do a lot with their (your?) customer data, including hygienization, appends, completion, profiling, etc. Most of this happends under the sheets, and most customers don't really want to know the details.
However, I advise clients to NEVER use an email append service for a variety of marketing and spam/technical reasons. Most clients will listen, some will choose not to. However, I'm seeing that more stupid companies will forge forward like its nothing, and companies with dwindling budgets are too suckered in by the cost savings.
Its only going to get worse.
GMail (Score:5, Insightful)
Once again, GMail is my solution to this. Prior to GMail, I used spamgourmet to keep my inbox clean. The oldest email I have used to get 30,000 emails per month that were all SPAM. Right now, it's getting about 11,000. (I haven't really used that address in a long time.
I have had maybe 10 SPAM emails in the last year make it to that inbox. (It's hosted under Google Apps.)
So once I found out how well Google's SPAM filters work, I quit caring about giving out my main email address. I give it to everything now, and if a company SPAMs me, I just mark it as SPAM. When enough people do that, it seriously hinders their ability to contact their legit customers, and they learn a valuable lesson.
There's a little bit of fallout from people who use the SPAM button incorrectly, but I think Google does its best to account for that, too.
Re: (Score:3, Interesting)
One more reason (Score:2)
Like any other scumbags, they will exploit it for all it's worth until enough peo
Email Append (Score:3, Informative)
It's a service called an "email append", offered by the major credit reporting companies. The purchaser gives them a list of names and addresses, and the credit reporting company finds matches with email addresses. They send an opt-out mailing, and the email addresses of everyone who doesn't opt-out are returned to the purchaser.
Re:Email Append - BINGO! (Score:5, Interesting)
Yes, I think you've hit the nail on the head. Experian eMail Append [experian.com] overlays deliverable email addresses onto your active customer file and contacts customers via email on your behalf to obtain permission to communicate with them online.
By "permission" they mean they send you email until you complain. If they happen to pick an email address that is normally not read by a person, they don't get any complaints. (Not that I opt-out of spam; I block it.)
Further on, they state Retain your customers by keeping your brand top-of-mind through consistent, relevant and interactive email communications. Yeah, good luck with that. I know four companies that have just lost my repeat business.
Thanks to all for an excellent discussion.
Parent
An interesting change (Score:3, Interesting)
If that switched en-masse to email, those contracts would expire, meaning snail mail prices would increase. The Royal Mail don't have any way to transfer delivery from paper to email, so they couldn't recoup those loses. Since email is free, nobody would make any money from these mass email contracts.
On the other hand it would cut down on a LOT of wasted paper, which 99.99999999999999% people take from door to bin, bypassing the eyeballs, some people do recycle but not enough.
While email is great for most communications, snail mail is sometimes required so it can't be allowed to die. I doubt it would die if they lost the junk mail contracts.
For me, the worst offenders are the magazines and newspapers you have to pinch at the spine and shake over a bin before opening, to release all the leaflets stuffed inside. Is it not enough that for every 5 pages of a publication, 3 pages worth are adverts? If that's the state of the magazine industry, maybe it deserves to die too. The internet has already steamrolled over many business models, what's another one to add to the list?
Perhaps a solution would be a commercial / personal email distinction at an ISP level with a legal backing. Personal email is always free, commercial email costs say 1p per email. Charities / schools etc would be exempt from charge too. Make it something you have to declare with your ISP and legally stand by. Spammers using botnets wouldn't be affected since they operate illegally anyway, but it'd regulate the "normal" "legal" marketing companies. Make it a legally enforceable requirement to ONLY email people who have opted in, and fine them for ALL breaches.
Egham is "spam capital" of UK (Score:5, Funny)
Email filtering company MessageLabs reports that Egham, Surrey, on the suburban outskirts of London, is the town that receives the most spam in Britain [today.com].
"It's not like there's much else to do," said Boris Busybody, 77 (IQ), of Egham Hythe, idly whirling his four-foot penis around his head in a desultory fashion. "Expanding your manhood, growing your breasts, increasing your sperm ... the Lib Dem phone calls get a bit much. That's Doctor Busybody, by the way. My Ph.D arrived last week."
Spam has revitalised the local economy. Mr Busybody has given up cab driving and is now working a lucrative job processing payments from home after he sent them his bank details in response to an urgent security message. "I had that King Otumfuo Opoku Ware II in the back of my cab once. Very generous and helpful fellow."
The Egham Tourist Board has seized the day, with plans for a 50 foot tall penis sculpture at Junction 13 of the M25 on the exit ramp to the town. The sculpture will be encircled by a genuine imitation Rolex and spray a fountain of Spermamax, obtained at a very reasonable rate from a Canadian pharmacy. "You will search an hour for your underwear in the ocean of our spam!" is to become the new town motto.
"I did get a good one the other day," says Busybody. "Barrister Matthew Sergeant Busybody of MessageLabs said we could promote our town to millions of people just by sending them an advance fee to process our incoming email. The stuff they try! 'Scuse me, V!k@grk@ kicking in, got to go have sex again. Sorry."
Re:E-Stamps, the only way to reduce spam (Score:5, Funny)
Your post advocates a
( ) technical ( ) legislative (X) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(X) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
(X) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
(X) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Parent
Re:E-Stamps, the only way to reduce spam (Score:5, Informative)
To understand why this won't work you have to understand how e-mail works. We start from when you hit 'send' in outlook.
Your message first goes to your ISP's or company's outgoing mail server. Let's ignore that for a moment.
That outgoing mail server looks at the recipient- user@domain.com. So it uses DNS (the thing that converts a name like www.google.com into an IP like 74.125.93.147) and asks what the MX (mail exchanger) servers are for domain.com. Domain.com has those listed in its DNS.
The outgoing mail server then connects to the domain.com MX server. It says "i have a message from person@company.com for user@domain.com". If the MX agrees to take it, your outgoing mail server transmits the message, and the MX sends a confirmation that it is accepted. They then disconnect.
If you're running your own mail server, or are using a company mail server, or a different email system, your ISP has nothing to do with this other than moving your packets around.
The point is that email is not a single system that can be changed like raising the fare on the subway. If you're the city and you want higher subway fares, you just reprogram a few thousand turnstiles (all of which you own) and you're done. Email/SMTP isn't like that, SMTP is an agreement, a protocol which millions of networks and servers have chosen to implement. Email is just another internet protocol, no different than AIM, skype, HTTP/wwww, FTP, etc. It's just one of the most widely used protocols.
There is no central authority to enforce anything like e-stamps. For this to be enforced, the domain.com MX would have to say 'please give me a tenth of a cent before I deliver your mail'. The only useful way to handle that would probably be with a 3rd-party clearinghouse for exchanging the 'stamps', so your mail server would say 'i give you stamp ID (long stamp id number)', the destination MX looks that up with the clearinghouse, approves it, then accepts the message for delivery.
For that to happen, both your SMTP server and the recipient's MX would have to be modified to deal with these payments, and optionally require them for mail delivery. There are many different mail server programs out there, this would require all of them to be updated to support payments, and then (heres the hard part) all the people who run them would have to install those updates. Then anybody who runs a mail server would have to do some financial setup to let them accept payments and send payments for email. IE, every random geek and company and IT department and ISP that runs a mail server now has to jump through a financial hoop. If I run my own mail server, does that mean i get 2/3 of the payment (the recipient fee and the ISP fee)? Does my ISP get it even though I'm not using their servers? There will be great resistance to this.
The main issue is, it would *NOT* be transparent, not to anybody. This would be a large, time-consuming and very expensive implementation.
Now let's say best case scenario, lets say you get all the major isps and webmail providers on board (msn, aol, yahoo, google, comcast, timewarner, verizon, cablevision/optimum, charter, adelphia, etc).
Let's say they immediately set up their system to start dealing with these micropayments.
What happens to the (literally) millions of companies in the US and abroad who run thier own mail servers, but whos systems are NOT updated? Can they no longer send mail to all of the above networks, or is there a break in period? If the payments are optional, what incentive does anybody have to adopt them?
Also you say approved senders can send for free. Who is an approved sender? What is the qualification? If it's difficult and expensive, some of the large bulk-mailing companies will try it anyway, and the smaller legit companies are shut out. If it's easy to get one even for a small biz, then the spammers will get them too. If extensive investigation is performed on the applicants, that money has to come from somewhere, so it'll be expensive.
Parent
Optimstic but Wrong (Score:3, Informative)
I'm assuming you didn't see the humor in Matt Perry's [slashdot.org] post [slashdot.org]. I hate to sound like such a pessimist, but your solution and response is naively optimistic. Let's examine why.
ISPs already have a lot on their plate insofar as legislation and (potential) filtration goes. Forcing them to operate as a collection agency simply won't work. I also doubt anyone would