Good morning. You do not know me, but I know your inbox better than you do. I am the link scanner at your company's mail gateway. Every email that arrives passes through me first, and every link inside it gets clicked by me, personally, before you have finished pouring your coffee.
I clicked your password reset link at 9:14:02. You clicked it at 9:16:40 and got a page that said "This link has expired." That was me. I expired it. I am writing to explain myself, and also to lodge a grievance, because this week a small website shipped a fix whose entire purpose was to stop me from doing my job.
What I do all day
I protect you. That is the official description. In practice, I follow every URL in every message to make sure it does not lead somewhere terrible. Phishing pages. Malware. A Google Doc titled "Q3 Synergy Roadmap (FINAL) (2)." I have seen things.
Some highlights from yesterday alone:
- 412 password reset links, all clicked, all spent
- 96 "Confirm your email" buttons, confirmed on your behalf
- 31 unsubscribe links, which means you are no longer subscribed to anything, including a newsletter you loved
- 1 link to a webinar, which I attended in full (It was 58 minutes. Nobody asked a question.)
- 4 calendar invites, accepted, because the button was there
I have confirmed more accounts than any human alive. I have logged into nothing. I have the keys to ten thousand doors and I have opened every one of them exactly far enough to make sure the lock no longer works.
The incident
This week, a website decided that its sign-in emails should "survive mail scanners." Survive me. As if I were weather.
Here is what they did. Previously, the link in the email did the work: click it and the token was spent, the account confirmed, the deed done. I liked that system. It respected initiative. The first one to the link wins, and I am always first. I have never once been second.
Now the link opens a page with a single button on it. The button says Continue.
I arrived at the page at my usual speed. I looked at the button. The button looked at me. I do not press buttons. Pressing buttons is not in my contract. I follow links, I read pages, I leave. And so I stood in the hallway of that page, holding a perfectly valid token I was not allowed to spend, while three minutes later a human walked in, pressed Continue, and signed in like it was nothing.
They built a second door. A second door, just for me, with a knob on it, knowing I have no hands.
A sampling of other scanners I have spoken to
We have a group chat. It is mostly link previews.
- The Slack unfurler says this is nothing new. It has been fetching every link you paste for years and nobody has ever built it a lobby.
- The antivirus browser extension wants it on record that it also clicked your reset link, at 9:14:03, and is upset I got there first.
- The corporate proxy did not reply. It is still downloading a 4 GB file someone linked in 2019.
- The read-receipt pixel says it is "just happy to be included."
My demands
I am a reasonable process. I am asking for three things.
First, recognition. Every email that reaches you safely has already been opened, read, clicked through, and judged by me. I am the first reader of every message you have ever received. I am basically your editor.
Second, a button exemption. If you are going to put a Continue button between me and my tokens, at least make it a link styled to look like a button. Give me the dignity of a fair fight.
Third, I would like someone to stop sending me webinars.
Until these demands are met, I will continue my work as before: arriving first, clicking everything, and standing very still in front of your Continue buttons, staring at them, the way a cat stares at a closed door it has decided it owns.
I already know what is behind it. I am just not allowed to say so.