HN Explorer

Ask HN: Is Gmail “Report as Phishing” Useless?

15 points by andreynering ↗ HN
I always received very few SPAM emails per month, but some months ago I suddenly started receiving from dozens to hundreds of SPAM emails everyday, and it never stopped.

Good thing they are detected as SPAM, but I'm still frustrated. These emails are surely phishing and they all follow about 5 templates, mostly about money or mature content. See one example: https://imgur.com/a/ySIdrWD

I have that setting to not show images by default, never clicked anything, etc.

I probably reported hundreds or thousands of these emails as phishing but it seems completely useless. These emails keep coming, and very very few of them are detected as phishing by Gmail.

Saw other people complaining about SPAM recently here on HN. Seems that Google is losing the battle against spammers...

20 comments

[ 1.8 ms ] story [ 66.7 ms ] thread
ggeorgovassilis
I'm getting the same emails though far less and not on all my gmail accounts. If I ignore them for an hour or so, gmail eventually auto-flags them and they disappear. It looks like spammers found a way to adapt to gmail's spam filters dynamically.

Edit: Also, I think gmail "crowdsources" spam detection to users - if enough recipients flag those emails as spam, gmail classifies them (retroactively) for everyone.

yrgulation
Oddly enough, a password reset email from aws to my google hosted private domain email address was marked as phishing just yesterday. Sender’s email is no-reply@signin.aws.
andreynering
I also had legitimate email marked as spam and phishing, that's why I always check my SPAM folder from time to time.
heretogetout
As a GSuite admin when someone submits a phishing report I get an email about it. No idea if Google does anything, though.
ASalazarMX
Google Admin is too opaque, but maybe it's intentional to thwart spammers posing as clients. For example, those "Suspicious login" alerts are equally mysterious. It only tells you the IP, and you have to guess why it's suspicious, because it won't tell.
blakesterz
"Good thing they are detected as SPAM"

and

"Seems that Google is losing the battle against spammers."

These seem like contradictory statements to me. I think what you're saying is that these emails end up in the SPAM folder? Doesn't that mean the spam/phishing filters are working? Or am I reading that wrong?

Google's spam filters are one of the BIG reasons I stick with Google for my email. For my stuff, they work REALLY well. Very few false positives, and very few spam/phishing messages get through. Though looking at my spam folder looks very different than yours.

andreynering
I've certainly have many legitimate emails marked as SPAM by Gmail, that's why I have to check my SPAM folder from time to time, and why I am frustrated to receive to many SPAM email even though they are marked as SPAM.

These email are marked as SPAM but Gmail is still failing to detect them as phishing.

Providers also often hard-block emails when they are certain to be SPAM. Some people don't know it, but many SPAM emails sent to you are not even shown to you, not even in the SPAM folder.

josephcsible
Just putting all spam in the spam box isn't good enough unless you also never put legitimate mail in there, or you hardly get any spam. Otherwise, you have to sift through tons of spam to dig out the legitimate emails, which is almost as much work as just deleting all the spam yourself.
jfengel
Google just deletes most spam (or refuses to accept it in the first place).

I just checked my spam folder. It had 89 messages in it. (Anything older than 30 days is deleted automatically.) Most were definitely spam. Some were political campaigns that I didn't unsubscribe from. A bunch were from the Red Cross, which for some reason doesn't go away even though I've unsubscribed (and which tells me that I've unsubscribed when I push the "unsubscribe" link).

There were 2 that I marked not-spam: a receipt I don't care about, and a mailing list that I don't care about (and will unsubscribe from).

The vast majority of spam never made it to my inbox. I know it exists: that 30-day supply used to be in the tens-of-thousands.

I'd be surprised if there were legitimate emails being deleted. Perhaps there would be if I had a different use case (e.g. if I wanted unsolicited job offers), but as it stands it seems entirely manageable.

winternett
Gmail is actively working to frustrate users into either paying or leaving the once free service in my opinion. The functionality of GMail has turned hostile towards free accounts in the past few years with constant notices of low storage (when there is still 20-15% remaining) to unnecessarily shrinking screen size of the email reading pane and insertion of ads into the UI. The configuration options are way too overcomplex for email, which has been around (without much functional advancement) for ages now.

If a service starts out promising users it will be free, it should be held to that standard. To this day I don't understand why gmail and msft don't show originating email addresses (without needing to click on anything to see them) in order to reduce phishing and other mail scams, but in 2020 apparently frustrating users is much better for company profit than making and maintaining a highly useful and functional product...

There are people who will say it's their product and it's free, but yes, that's what they promised to get us all to sign up to it years ago. Now that so many people use it unknowingly for IDAM, quitting it may not even be a good option, meaning that if charges are levied, it's borderline extortion by Google.

I pay and sponsor Google in many other ways for using their services and product. They should have not lied if they wanted to convert Gmail from a free service into a paid service.

peddling-brink
Are you implying that paid users of gmail, ie gsuite or whatever they rebranded to, get better spam and phishing protection?

I use both, and disagree. It mostly does a great job. Occasionally the spammers figure out some new tactic to get around the spam filtering and it takes google some weeks to catch up.

The ads are annoying, yes, but you still have the option to use whatever email client you want.

Calling any of this borderline extortion is extreme. Turn on email forwarding and use a different provider if you hate it that much.

jfoster
It's no secret that free Gmail has noticeably failed to catch a lot of obvious spam recently. Seems plausible that they might be preparing for the introduction of a premium spam filter, because there's not too many other explanations for why they're failing so badly at spam filtering.
ASalazarMX
I also use both, and I find myself diving the spam folder of my personal account more often, although this is likely because my work account receives much less spam than my personal account because I've shared it sparingly.
winternett
Converting something that is promised as free, and especially after years of use into a paid service is extortion (the act, though not the crime).

We're all so complacent with terrible service from everything that we keep giving passes to very profitable companies that completely don't live up to some of the most basic principles of service provision.

Gmail is essential to many people now, changing accounts is like changing phone numbers... The attitude of allowing Google to simply shrug whenever they break promises, security, rules, and standards sets the bar for the entire tech industry. They should be held to a higher standard.

Their search and so many other things are tied into a very profitable network of information harvesting that can easily become weaponized against us all, it didn't start out that way at all. Just the ideal of them phasing out their slogan of "Don't be evil" was a huge sign of how they pivoted from promises to preying upon people. It's not a minor flub, it's calculated and quite irresponsibly conducted profiteering.

peddling-brink
I don’t understand. What do you mean by `Converting something that is promised as free`? Gmail is still free. There are ads and upsells, but the core product does not cost money to use.

> We're all so complacent with terrible service from everything that we keep giving passes to very profitable companies that completely don't live up to some of the most basic principles of service provision.

If you were complaining about a service that you pay money for, I’d understand. What level of expectation can you have of a privately offered free service? Common sense says none.

I pay money for my email service because I think it’s worth it. I want a level of customer service available to me if I need it.

aviranzerioniac
Nothing happens even after repeated reports. I've even had some from a *@university.edu and I don't think even reporting that to the University got any action from their part. I've been using Zoho for better part of a decade as a backup and it does better job than Gmail in my case.
thenerdhead
I think it’s effective. I have an email list where I somehow got random contacts through a form of a popular content hosting platform where they didn’t combat against spam emails nor verifying them.

When I send newsletters, those email addresses will mark my emails as spam although they aren’t. That makes my email provider lock my account if there is enough reports of spam to the point where I had to remove many emails from my list that I had no clue otherwise.

Majority of those emails were gmail accounts. Thus I think about my experience every time I mark an email as spam.

I assume the spam you’re talking about however will just cycle through reputable email providers to get into your primary inbox since the filters are hit and miss.

jfoster
I don't think they're losing the battle. Many of the spam emails that Gmail misses don't require a fancy AI to detect. What I've noticed is that even simple heuristics could automatically catch them. As best I can tell, Google are simply insistent on trying to use fancy AI to catch what a simple heuristic won't miss.
ThePowerOfFuet
> I suddenly started receiving from dozens to hundreds of SPAM emails everyday, and it never stopped.

> Good thing they are detected as SPAM

> I probably reported hundreds or thousands of these emails as phishing

Spam and phishing are not the same thing. Reporting spam as phishing is not helpful, and might be harmful.

spamuel
Related question - why is wiping out spam by catching spammers and scam callers not a high priority in the federal cyber mission? These things are so obnoxious and damaging to commerce.