Authorsteve

I know your customers' passwords

Go to your ESP customer login page and use “View Source” to look at the HTML (under “Page” on Internet Explorer, “Tools->Web Developer” on Firefox, and “View” on Safari). Go on, I’ll wait. Search for the word autocomplete. If it says something like autocomplete=”off” then your web developers have already thought about this...

Rancid Slime and Email Marketing

Despite what some email marketers may tell you there are times when it’s really not appropriate to try and add someones email address to your list. I just opened a pot of yogurt and instead of a smooth, creamy dessert there was a sticky brown slurry dotted with firm white chunks – looking like hot-and-sour soup, and not in a good way. No, this isn’t an email marketing metaphor...

Don't spam filter your role accounts

A variety of “amazon.com order confirmations” showed up in my inbox this morning. They were quite well done, looking pretty close to real Amazon branding, so quite a few people will click on them. And they funnel people who do click to websites that contain hostile flash apps that’ll compromise their machines (and steal their private data, login and banking credentials then add...

Cyber Monday

There seemed to be a surge of email marketing trumpting Cyber Monday Sales in big, glossy lettering in the week before Cyber Monday – so much so that I was bored of the whole thing long before the sales actually started. I wondered whether there actually was a big increase in volume of mail, or whether it was just louder, pushier and more noticeable. So I went through my inbox and...

About that Junk Folder

I use a pretty standard mail filtering setup – a fairly vanilla SpamAssassin setup on the front end, combined with naive bayesian content filters in my mail client. So I don’t reject any mail, it just ends up in one of my inboxes or a junk folder. And I have a mix of normal consumer mail – facebook, twitter, lots of commercial newsletters, mail from friends and colleagues and...

Does it look like you're spamming?

There are lots of terribly complicated rules in email marketing and retention. “Only send email to people who opted-in”, “Never use a pink background”[1], “Have a working unsubscription link”, “Don’t put FREE in the subject line”[1]. Another one should be “How does what you’re doing look to a typical recipient?”. I’ve...

The Social Side of Advertising

Most of the time when you’re sending bulk email you’re sending to a fairly anonymous list of email addresses. If you’re a good email marketer you’ve got a fairly good idea of their demographics, where the email addresses came from and maybe that they’ve purchased things from you in the past. But they’re still strangers – a “pre-existing business...

DKIM is Done

This was posted to the IETF DKIM Working Group mailing list this morning: The dkim working group has completed its primary charter items, and is officially closing. The mailing list will be retained for future discussions involving dkim. The list archive will also be retained. The dkim working group was primarily focused on DomainKeys Identified Mail (DKIM) Signatures and DomainKeys Identified...

How to respond to an abuse complaint

There’s a lot of variation in how ESPs respond to a report of one of their customers sending spam. Almost all ESPs will suppress future email to the recipient. Most will also note that there was a complaint about the sender, and use a count of those complaints for reporting, triage and escalation of problems. Beyond that, though, there’s little consistency. I sent a spam report to...

Evil weasels and random monkeys

I’m doing testing on a new release of Abacus at the moment, so I’m in a software QA (Quality Assurance) frame of mind. One of the tenets of software QA is “Assume users are malicious”. That’s also one of the tenets of security engineering, but in a completely different way. A security engineer treats users as malicious, as the users he or she is most concerned about...

Recent Posts

Archives

Follow Us