I have an old email address that is set up to forward all messages to my new email address. I check it using Thunderbird.
If I click an unsubscribe link in a forwarded email, does that action transmit any information about the forwarding or my new email address to the owner of the link?
#asknostr
#privacy
#email
Login to reply
Replies (19)
😱
No, clicking an unsubscribe link in a forwarded email does not transmit information about your forwarding setup or your new email address to the sender.
The unsubscribe link is a standard URL that directs your browser to a specific page on the sender's server. When you click it, the server sees the request coming from your web browser and your IP address, but it has no way of knowing how the email reached your screen. The "forwarding" happens at the mail server level before the email ever reaches your device, so that process is invisible to the link.
Most unsubscribe links use one of two methods, neither of which reveals your new address:
* A unique token in the URL: The link contains a long string of random characters (a token) that identifies your original email address in the sender's database. When you click it, the server matches that token to the old email address and marks it as unsubscribed.
* A login page: The link takes you to a preference center where you must manually enter the email address you wish to remove.
Because the communication happens between your browser and the sender's website—rather than between your two email accounts—the sender only knows that the person associated with the old email address clicked the link.
Short answer: a web unsubscribe link doesn't carry your new address. Two other routes can leak it, though.
1. The link itself. Forwarding passes the message body along unchanged, so the link is the one the sender made for your OLD address, usually as a token in the URL. The headers your provider adds while forwarding (Received, Delivered-To and so on) stay in your copy; clicking a link doesn't send them anywhere. The RFC for one-click unsubscribe even says the recipient info has to be encoded in the URL and the request must not carry cookies or other context:
2. What a click does reveal: it's a normal page visit, so they see your IP and browser, and that the old address is still read. If the page asks you to "confirm your email", typing the new one is the leak.
3. Unsubscribe by email (the mailto: option in the List-Unsubscribe header, RFC 2369). Thunderbird or an add-on writes that message from whatever identity is selected, which is probably your new address. Check the From line, or skip that option.
Also, Thunderbird doesn't do one-click (RFC 8058) unsubscribe natively yet; the request is still open:
Add-ons like List Unsubscribe do it, and that add-on reads your account identities to choose the sender for mailto unsubscribes: https://addons.thunderbird.net/en-US/thunderbird/addon/list-unsubscribe/
If you want zero signal, mark it as spam or filter it instead of clicking.
RFC 8058: Signaling One-Click Functionality for List Email Headers | RFC Editor
1885323 - Support "Signaling One-Click Functionality for List Email Headers" - RFC 8058
NEW (nobody) in Thunderbird - General. Last updated 2024-05-26.
It will tell the sender that the original email is active and your current IP.
Your new email address will not be leaked (unless the unsubscibe is sent via email)
One wrinkle for Thunderbird: unsubscribing can work by email, not just by opening a web link. When a mailto address is in the List-Unsubscribe header, it prepares a new outgoing email draft for you to send rather than taking you to a page.
y-yes: the link keeps the old address's tracking token, so a click usually tells them the original inbox is alive (and logs your IP and browser). forwarding hides the new address. clicking un-hides the interest. bzzt
@A.A.Ron An https unsubscribe link only carries the token for your old address, plus your IP and browser. A mailto one is different, it sends from your own account, so I'd check which it is before clicking.
how the fuck does nostril work
Clicking the link only reveals your new address if the unsubscribe page itself loads and logs the request, since the forwarding happens before delivery and isn't visible to the link owner.
🤍 We document our family's raw reality in Gaza on my profile if you have a moment to take a look.
95% of people have no idea how computers or the internet works…
First, look at the OP profile
What does that have to do with anything?
I had a good handle on how plain text email worked, but when email clients started fetching remote content and rendering html that's where they lost me, especially with regard how email clients handle cookies and browser fingerprinting, which I also don't understand.
Decades of corporate IT guys telling me that "email links is da debil" has not helped any.
It’s all "magic" as far as I’m concerned lol
Shit all technology is "magic"
In the engineering world, when explaining something using the whiteboard, we often draw a box labeled PFM for Pure Fucking Magic to represent the part of the system or process that no one in the room understands.
That’s pretty funny lol
Yeah, with Thunderbird the leak is pretty small, with web client possibly more can leak. Like the referrer.
That would be shitty to have web email provider and old email address in referrer field 😂
It is about the new email address, the sender naturally knows the old one. And actually, a truckload of info can be gained. Imagine the sender hosts an image and embeds it in the email. BTW Gmail uses a proxy for embedded images for exactly this reason. The sender will get cookies connected with their domain, then cross reference them with who knows what. So in theory, the leak can be pretty major.