On Mon, 2011-01-24 at 10:12 +0000, Peter Lewis wrote:

<dropbox email invitation>

On Monday 24 January 2011 10:06:18 Ray Rashif wrote:

...

Guys..I don't think anyone has to tell you this but such invites are _always_ unintended. E-mail services have a bad tendency to automatically insert contacts into your friends' list, mailing list or not. So please, ignore e-mails like this and keep them reply-free in the future, so that they may just annoy people _once_.

Call me a noob, but I don't understand why these emails get sent. I've seen a few of them around on email lists. It seems to be that either someone uploads their entire addressbook to a random website (doesn't seem like a clever idea) or else gives the website their email password (very bad idea).

What gives?

Pete.

Plenty of the more 'social'-orientated websites are linked in to the popular free emails (gmail especially). You don't give your password to the website itself, it just asks for permission to do something with your contact list (normally spam an invite to itself to everyone there). As I understand it, the website never even sees your addressbook, just uses the google-created api to send an email to everyone in it.

On Mon, 2011-01-24 at 10:36 +0000, Peter Lewis wrote:

On Monday 24 January 2011 10:19:02 Ng Oon-Ee wrote:

...

On Mon, 2011-01-24 at 10:12 +0000, Peter Lewis wrote:

...

<dropbox email invitation>

On Monday 24 January 2011 10:06:18 Ray Rashif wrote:

...

Guys..I don't think anyone has to tell you this but such invites are _always_ unintended. E-mail services have a bad tendency to automatically insert contacts into your friends' list, mailing list or not. So please, ignore e-mails like this and keep them reply-free in the future, so that they may just annoy people _once_.

Call me a noob, but I don't understand why these emails get sent. I've seen a few of them around on email lists. It seems to be that either someone uploads their entire addressbook to a random website (doesn't seem like a clever idea) or else gives the website their email password (very bad idea).

What gives?

Plenty of the more 'social'-orientated websites are linked in to the popular free emails (gmail especially). You don't give your password to the website itself, it just asks for permission to do something with your contact list (normally spam an invite to itself to everyone there). As I understand it, the website never even sees your addressbook, just uses the google-created api to send an email to everyone in it.

Ah, I see. Not using any webmail system I suppose I've never encountered this. I tend to think at least twice before letting something connect to my twitter account! ;-)

Thanks.

Pete.

You're welcome. Unfortunately, that's the way the web works nowadays. Also, at least in dropbox's case I did not remember them allowing selection of emails, its mainly all-or-nothing (which makes sense considering the size of the average gmail user's contact list with its auto-population crap).

On Mon, 24 Jan 2011 10:12:06 +0000 Peter Lewis wrote:

It seems to be that either someone uploads their entire addressbook to a random website (doesn't seem like a clever idea) or else gives the website their email password (very bad idea).

It's probably the easiest way to invite your (legit) email contacts. The real question is: do dropbox/facebook/linkedin/.. not provide a confirmation page with checkboxes per contact or something, before actually sending the mail? Dieter

On Mon, Jan 24, 2011 at 10:19, Dieter Plaetinck wrote:

On Mon, 24 Jan 2011 10:12:06 +0000 Peter Lewis wrote:

...

It seems to be that either someone uploads their entire addressbook to a random website (doesn't seem like a clever idea) or else gives the website their email password (very bad idea).

It's probably the easiest way to invite your (legit) email contacts. The real question is: do dropbox/facebook/linkedin/.. not provide a confirmation page with checkboxes per contact or something, before actually sending the mail?

No, I think that would be completely unworkable from a UI perspective given the size of most peoples' address books. Instead they just spam everyone, assuming that people will have the intelligence to ignore the emails where they don't make sense. ;-) /M -- Magnus Therning                      OpenPGP: 0xAB4DFBA4 email: magnus@therning.org   jabber: magnus@therning.org twitter: magthe               http://therning.org/magnus

On Mon, 24 Jan 2011 10:32:16 +0000 Mauro Santos wrote:

I guess they do (or they should, never tried it myself) and I also believe that they ask for the email's password before they can spam mail everyone. To add insult to injury some sites require (or used to require) an email address and the respective password so "you can keep in touch with your friends" before allowing one to complete the registration process, or keep nagging you afterwards telling you that "you are not keeping in touch with your friends, please give us your email's password and let us mass spam everyone (tm)".

Somebody should write an imap server to pester such services, like, keep connections open a long time, pass data only very slowly, provide lots of random localhost email adresses, etc :P Dieter

On Mon, Jan 24, 2011 at 10:32:16AM +0000, Mauro Santos wrote:

I guess they do (or they should, never tried it myself) and I also believe that they ask for the email's password before they can spam mail everyone. To add insult to injury some sites require (or used to require) an email address and the respective password so "you can keep in touch with your friends" before allowing one to complete the registration process, or keep nagging you afterwards telling you that "you are not keeping in touch with your friends, please give us your email's password and let us mass spam everyone (tm)".

I've never run into a situation like that but I can tell you for sure that I will never give such sites a password to anything! Furthermore, I would drop such a service faster than a hot potatoe. When I 'invite' people to things like linked-in or dropbox, I do it on an individual basis and would hope that the invites be relevant to the persons involved. Like with Linkedin, I like to add a personal note to each invite or request to be linked so the person receiving the request realizes it is me and not some generic spammer out there.