6 ms·

It's interesting that this is missing a lot of major enterprise marketing email providers. The author clearly isn't subscribing to things like Best Buy's weekl

It's interesting that this is missing a lot of major enterprise marketing email providers. The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders.

runlevel1 7y ago
A few years back, one of our (Twilio SendGrid's) developer evangelists created an open source Chrome extension to show the icon of the ESP who sent a message in Gmail. The last big Gmail UI update broke it, but most of the ESP identification strategies probably still work: https://github.com/nquinlan/Email-Intelligence/blob/master/content.js https://github.com/nquinlan/Email-Intelligence/blob/master/c...
- kehers 7y ago
  This is nice. Shows a different approach to getting the ESP from the mail header.
- pingec 7y ago
  This is a brilliant idea, if only it were updated for the latest gmail UI
  - mbrameld 7y ago
    https://www.inboxsdk.com/ https://www.inboxsdk.com/ lets you pretty easily manipulate the Gmail UI if you want to have a crack at it.
    - alooPotato 7y ago
      We (Streak) made the InboxSDK. Great for projects like this because we autoupdate so you can write the extension against our high level api and not have to worry about gmail changes going forward. Let me know if we can help.
  - nquinlan 7y ago
    Chrome extension author here: make a PR and I'll accept it and publish it.
- paulmendoza 7y ago
  OMG, this sounds like a massive security risk. That nice developer could easily siphon off all the email to his backend server with this little extension. I install almost no extensions because they are too risky.
  - fiddlerwoaroof 7y ago
    Chrome sandboxes fetch requests from extensions and tells the user what permissions the app is requesting, so it’s not actually that bad (barring bugs in the sandbox)
    - jannes 7y ago
      What do you mean with "sandboxes fetch requests"? That's not a valid countermeasure at all... The grandparent was worried about the extension stealing his email's contents.
      - iudqnolq 7y ago
        Absolutely. If the extension injects JavaScript into the page to examine the email it can run a fetch in the context of that page. I think the app store should warn that a page can send data to any website if it has permission to modify any page.
        fiddlerwoaroof 7y ago
        It’s been a while, but I’m pretty sure the permissions dialog explicitly calls this out.
  - runlevel1 7y ago
    All Chrome extensions require trust. That should factor into your decision to install any of them. This is no more risky than any other extension whose permissions include `https://mail.google.com/` https://mail.google.com/`. Anecdotally, that probably includes most extensions seeing as how most of the ones I come across request `<all_urls>` whether or not they need it (not that that's okay). In any case it's open source, so you can download it, audit the code, and install it locally to prevent auto-updating.
ragebol 7y ago
> The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders. I don't think that will be interesting for the author given where he's based. (I first assumed Belgium due to the domain's TLD, but it's actually Nigeria)
deleted 7y ago
[deleted]
dubcanada 7y ago
It's missing basically every major email marketing provider. * Salesforce * IBM * Contact Contact * Campaign Monitor * HubSpot * ActiveCampaign etc etc
- kakwa_ 7y ago
  It can be quite hard to detect. A lot of this services will not have an easily recognizable marker. It can be for various reasons: * They can use these services themselves * They can support full customization of domains, including for the "message-id" and the "received" headers. I'm working as SRE in a fairly large marketing provider (not sure in term of %, but we provide services for quite a few large brands sending several millions emails per day), and we do this full customization by default. There are other way to recognize us (other headers in the email or the pattern for the tracked url for example), but the one described in the article will not work. It would also be interesting to be able to detect which MTA is used by these service providers. Is it an in-house one or an off the shelf one? The two off the shelf ones I know for mass sending are Momentum and PowerMTA which are both owned by Sparkpost but they might be others.
tjoff 7y ago
> The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders. Who on earth, that knows how to unsubscribe, would ever subscribe to spam?
Marsymars 7y ago
> The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders. I'm subscribed to some marketing emails, but I delete them after reading them. I save transactional emails.

It's interesting that this is missing a lot of major enterprise marketing email providers. The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders.

runlevel1 7y ago

A few years back, one of our (Twilio SendGrid's) developer evangelists created an open source Chrome extension to show the icon of the ESP who sent a message in Gmail. The last big Gmail UI update broke it, but most of the ESP identification strategies probably still work: https://github.com/nquinlan/Email-Intelligence/blob/master/content.js https://github.com/nquinlan/Email-Intelligence/blob/master/c...

kehers 7y ago
This is nice. Shows a different approach to getting the ESP from the mail header.
pingec 7y ago
This is a brilliant idea, if only it were updated for the latest gmail UI
- mbrameld 7y ago
  https://www.inboxsdk.com/ https://www.inboxsdk.com/ lets you pretty easily manipulate the Gmail UI if you want to have a crack at it.
  - alooPotato 7y ago
    We (Streak) made the InboxSDK. Great for projects like this because we autoupdate so you can write the extension against our high level api and not have to worry about gmail changes going forward. Let me know if we can help.
- nquinlan 7y ago
  Chrome extension author here: make a PR and I'll accept it and publish it.
paulmendoza 7y ago
OMG, this sounds like a massive security risk. That nice developer could easily siphon off all the email to his backend server with this little extension. I install almost no extensions because they are too risky.
- fiddlerwoaroof 7y ago
  Chrome sandboxes fetch requests from extensions and tells the user what permissions the app is requesting, so it’s not actually that bad (barring bugs in the sandbox)
  - jannes 7y ago
    What do you mean with "sandboxes fetch requests"? That's not a valid countermeasure at all... The grandparent was worried about the extension stealing his email's contents.
    - iudqnolq 7y ago
      Absolutely. If the extension injects JavaScript into the page to examine the email it can run a fetch in the context of that page. I think the app store should warn that a page can send data to any website if it has permission to modify any page.
      - fiddlerwoaroof 7y ago
        It’s been a while, but I’m pretty sure the permissions dialog explicitly calls this out.
- runlevel1 7y ago
  All Chrome extensions require trust. That should factor into your decision to install any of them. This is no more risky than any other extension whose permissions include `https://mail.google.com/` https://mail.google.com/`. Anecdotally, that probably includes most extensions seeing as how most of the ones I come across request `<all_urls>` whether or not they need it (not that that's okay). In any case it's open source, so you can download it, audit the code, and install it locally to prevent auto-updating.

ragebol 7y ago

> The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders. I don't think that will be interesting for the author given where he's based. (I first assumed Belgium due to the domain's TLD, but it's actually Nigeria)

deleted 7y ago

[deleted]

dubcanada 7y ago

It's missing basically every major email marketing provider. * Salesforce * IBM * Contact Contact * Campaign Monitor * HubSpot * ActiveCampaign etc etc

kakwa_ 7y ago
It can be quite hard to detect. A lot of this services will not have an easily recognizable marker. It can be for various reasons: * They can use these services themselves * They can support full customization of domains, including for the "message-id" and the "received" headers. I'm working as SRE in a fairly large marketing provider (not sure in term of %, but we provide services for quite a few large brands sending several millions emails per day), and we do this full customization by default. There are other way to recognize us (other headers in the email or the pattern for the tracked url for example), but the one described in the article will not work. It would also be interesting to be able to detect which MTA is used by these service providers. Is it an in-house one or an off the shelf one? The two off the shelf ones I know for mass sending are Momentum and PowerMTA which are both owned by Sparkpost but they might be others.

tjoff 7y ago

> The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders. Who on earth, that knows how to unsubscribe, would ever subscribe to spam?

Marsymars 7y ago

> The author clearly isn't subscribing to things like Best Buy's weekly deal email, or Target cart reminders. I'm subscribed to some marketing emails, but I delete them after reading them. I save transactional emails.