I guess maybe that edge case is not nearly as bad for the advertisers as failing to link the same person, so it's tolerable?
However it appears the IAB UID2 README says to only normalize pluses/periods for gmail.com addresses: https://github.com/IABTechLab/uid2docs/blob/main/api/README....
Periods are more of a Gmail-specific thing, but as you mention merging two people once in a blue moon is not a terrible price to pay for an analytics system, it’s not like it’s going to send mail to these addresses.
This way dropping the suffix drops those e-mails in my spam folder. Them normalizing the address makes my spam filter more efficient - and I would like to thank them for it.
And of course with such a small fine it's basically guaranteed they will continue breaching it since it makes them way more money.
I'm sure there's a lot of "underground" data transactions happening where the source of data is obfuscated.
If you have a Facebook account, and live in GDPR-land, go check which companies illegally passed on your data (https://www.facebook.com/adpreferences/ad_settings -> Audience based advertising) and report them!
These days I host my own mail server and use . as the sseparator, which has been working well for years.
Although a trick could be if you setup your service to run "[email protected]" then depending on how they implement their normalization, they'll chop off the username for you and track themselves.
And it still has the advantage that I can remove an alias and it's not obvious what the main account it leads to is.
And what kind of centralization are you talking about? Sharing it with other companies? I'm as pessimistic about these things as they come but even to me that seems incredibly unlikely.
If you do something obvious like use [email protected] at amazon, you should expect them to add a rule that [email protected] gets cleaned up to "@example.com"
So it doesn't really matter much whether I go with [email protected], or [email protected].
To deal with that for good you'd need a pretty large set of domain names to use for this purpose.
I’ve been using my own domain since the late 90s, and I’ve never run into this.
Which is all kinds of ironic, because I'm old enough to remember when free emails like hotmail.com and gmail.com were rejected by a lot of sites!
It seems like a very error prone thing to do automatically, while reaping little in return for the effort. How much do advertisers stand to gain by adding special case heuristics for "people who might be using an unshared email domain with a per-site local-part?"
If I give my email as [email protected], normalizing it to [email protected] is just applying a bit of common knowledge about how an email service with billion(s?) of users handles the + sign in the local-part of an address. It's a carve out, but it's totally deterministic (for Gmail at least) and applies to a lot of users.
If I give my email as [email protected], normalizing it to @2d0d4809.com involves guesswork about that specific domain. I don't think normalizing away the + sign in the first case implies we should expect the latter to get normalized into a single identity as well.
Of course if you have "@gmail.com" that's not going to have any value vs the identity-validated alternative. But at the bargain bin end of the ad selling universe does "[email protected]" that has never been seen anywhere except amazon have more value than "@2d0d4809.com" that has been seen recently in a handful of other places consistent with use by a single person? It's obviously not an identity-validated ID class, so it's not going to demand identity-validated bids. But having a tracking history might add a tiny bit to the bid. So I wouldn't put it past people to use that rule.
Yep, I've had my youtube account since before Google bought youtube in 2006. Just this week I noticed that I am no longer able to put URLs in the descriptions of videos I upload to youtube. I have to "verify" by giving them my phone number before any clickable URLs are allowed in descriptions. But apparently all URLs are clickable URLs. Additionally, even videos I uploaded in 2008, if I go to edit their descriptions now and I originally included a URL, I cannot submit it.
Phone number "verification" is nasty. I suppose this is the end of my almost 2 decades of using youtube to host videos.
As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great.
> to put URLs in the descriptions [...] Phone number "verification" is nasty
Spam is a huge problem for any large platform with free accounts, and there aren't a lot of good options to prevent it. One set of mitigations is around increasing the cost of an identity. Email addresses are infinite and free, but working phone numbers are limited and usually cost money. So gating spammer-desired activities on phone numbers makes sense from their perspective. They could get a similar effect by requiring a credit card number, but people hate that even more.
If you'd like to work around this, I'd suggest getting another number for just this. Google Voice will give you one for free, and the Burner app will do it for $5/month if you sign up via web. Or in my case, my ISP gives me a free landline number with my internet service, which is great for this sort of thing.
Heck, if I wanted ethical purity, I wouldn't be here contributing free content to YC. But I think the net good outweighs the net harm, so here I am.
In many parts of the world, getting a phone number requires recording your government ID with the carrier (and burners are illegal, though usually for the carrier not the consumer), so the calculus then becomes “to prove you’re not a spammer, give up everything about your identity that was or ever will be known”. Which, no.
(There’s a reason why Russian democracy activists are divided into a “use Signal” camp and a “fuck no, don’t use Signal, doxxing you will be slipping $20 to a random SIM card salesman” camp. But parts of Western Europe are the same, and some are even ahead on e.g. availability of anonymous stored-value cards for transport or mandating testifying against yourself wrt encrypted storage.)
1. Despite this, spam thrives on Google.
2. What happened to using AI to fight spam? Trained and intelligent humans can discern spam without knowing identity.
3. This still won’t prevent other email providers sending spam to Gmail.
4. Safety is often used as justification for more $$$.
Because there are two independent components to such a system: {increase cost of identity} + {protect privacy of identity}
When it's offered/justified to combat spam... the implication is that the solution will deliver both promises.
In reality, the first (concept of identity) gets built, marketing/sales realizes they can abuse the hell out of it for their ends, the second (privacy protection) gets overruled at the VP/C* level, and any privacy protections are quietly never implemented.
This happens again. And again. And again.
Google is probably the best case ethical scenario here, in regards to having standards around privacy data stewardship, and even they abuse it frequently when the profit is too large to ignore.
The only reasonable takeaway is that any system that permits mass tracking is too dangerous to privacy to allow to exist, and all should be opposed.
Or, as GDPR does, render companies liable for omissions from a privacy perspective.
The most ridiculous part of this phone-verification BS is that many companies (e.g. Twitter, Discord) let you create an account without it but will then demand a number at some point later. This only hurts real users because spammers can just switch IPs and create a new account that they can use for a while.
> Google Voice will give you one for free
And what information do you have to give Google for that number so that you can avoid giving your phone number to Google?
Youtube pivoted from "just" hosting videos to a community though, to the point where you won't get any views unless you are on youtube and play by their rules and network effects.
Where it gets hairy is when you want to do live streaming…
linux?
a $5 vps running any webserver and an sftp client on your phone will do.
You can have all the bandwidth in the world, but the magic that Youtube does is mainly dealing with the users' bandwidth, for example, it switches video resolution on the fly when it notices that frames are going to have to be dropped soon.
> 1. Some people do not own phones, or do not wish to provide you with their telephone number when asked. Do not require a user to provide a phone number unless it is essential, and whenever possible try to provide a fallback to accommodate these users.
What a bunch of hypocrites.
And note that a phone number is the number for calling a telephone, not some jumped-up pager. They want a mobile number so they can send you SMS messages. I hate SMS, and I deplore it's use as a part of any kind of security protocol.
If you don't intend to speak to me, you don't need my phone number. If you do, then my (VOIP) landline will serve you fine.
I would amend that just a little: If I don't intend to have you speak to me, you don't need my phone number.
Is "your policies must be fully consistent with any advice given in any of your open source repos" really a standard we should hold big companies to? Because if we treat open-sourcing a text file of recommendations as the company making a statement or commitment to that effect, companies will be way more limited in what they allow their engineers to make public this way. With chilling effects that go beyond semi-humorous recommendations. ("Do you really want to try to open-source this library? You know how frustrating Legal and PR can be to deal with...")
I don't think that term means what you think it means.
What I'm trying to say is that there is a thing that is positive and we'd like to see more of (companies releasing things as open source) and there is an adjacent thing that we are considering pushing back against (companies including things in their repos which conflict with their actions). While it should be possible to discourage only the latter, in practice the effect would spill over to the former.
As a user I can only hope that more people do stop using YouTube, preferrably choosing something that serves video files directly instead.
> As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great.
This works but only because running your own mail server is too uncommon for anyone to care about. If it was more common, the advertisers or other privacy violators would specifically check for catch-all domains and then strip the entire local part of the email for your user id.
That it also prevents ad tracking is even better.
The problem with most of those tricks is that they can be countered in some way, so I feel this is one of the areas where your security has to rely to some extent on obscurity (or the fact that it's too rare in the wild to be worth countering).
But I do have a question, have you found a programmatic way to create aliases / a provider that offers an API for that? Because that seems like one of the main usability downsides to your approach.
I’ve had quite a lot of third party junk mail with this kind of stuff on it over the years.
We do support your own catch-all subdomain, but that is just to cover the use case of having to come up with an email mask on-the-spot. If you are filling in a web form, best to use an email address that looks exactly like the email addresses of other Relay users.
Some clients will display the "raw, as received" email if you ask them too. GMail has a "Show Original" menu item for example. In there, you will find "Received: ... for <[email protected]>". The exact form does vary between systems, but it's almost always there.
I have a throwaway SIM for that
I was expecting to see that, too but in more than 15 years of running my own mailserver i don't think i have had an attacker that has removed the suffix when trying to phish me. These attacks are automated. Your address is just one of many that is being harvested and sold to someone else who conducts the phishing campaign.
It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed.
So I don't use it and just keep on making completely new aliases. So amazon gets [email protected]. If I'm not going to pay for anything on this account it also gets a random name from a random piece of well known media, like "Donald Duck", and all the data filled in randomly to ensure that it's not googleable, and doesn't correlate with any accounts anywhere else.
The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal.