This morning, I received a marketing email from Cloudflare (through one of our mailing groups), being militant about these kinds of emails, I immediately go to unsubscribe.

Dark pattern one: You must login to manage your marketing preferences. There's no security related emails here, so this is completely unnecessary.

Dark pattern two: "...confirm your email address to save your communication preferences.". I've no idea how we have a several-year old account without a confirmed email, but it should not have to confirm an email to remove old marketing preferences - or if cloudflare is so careful about this, why did it end up opted-in ion the first place?

Dark pattern two-point-five is that the email somehow became unverified - something it seems is only necessary to adjust marketing emails.

Okay, so I hit the "Resend verification email" link and check my inbox, nothing just yet. I wait a little longer. It's odd that I immediately got a security email about the login from a new IP, but I've not received this verification email yet.

10 minutes later, and I've still not got anything. I know these things can take longer, but I don't have the patience, especially since Cloudflare are clearly trying to make this hard.

Going to the preferences page, I hit that verify link again - still nothing. Okay, F12, I switch to the network inspector and click the link again.

To my surprise: Absolutely nothing. There's no network requests being initiated by this link. Maybe it's websockets, or maybe there's a script that failed to load? The UI does respond when I hit the link, but nothing else. I opened up the element inspector to find a click handler:

  function () {
      return a.setState({
          toast: 'verificationResent'
      })
  }

That is certainly less than I was expecting. If that's just a react setState... this link is literally doing nothing other changing the UI when I press it. Perhaps some silly frontend developer reads that `toast` state elsewhere to trigger the real behaviour? Nope the only other reference to verificationResent is a ternary statement in the render function.

Dark pattern three: Just break unsubscribe. The cynic in me says this was intentional. Hanlon's razor tells me perhaps it is just a mistake, in which case dark pattern three is the overengineering of the unsubscribe function so you can get as much dropoff as possible and it's most convenient if it just breaks.

So wtf Cloudflare?

Oh, and to supplement dark pattern two: The verification check is only on the frontend. In the end, I was able to use the debugger to skip the verified check and edit & submit my email preferences anyway.

1.	Worrying confessions: A look at data safety labels on Android(datarequests.org) 2 points by cactusbee 3 years ago \| 0 comments
2.	Epic launches anti-cheat support for Linux, Mac, and Steam Deck(dev.epicgames.com) 333 points by cactusbee 4 years ago \| 316 comments
3.	Mozilla's Facebook Container adds warning to every email input(github.com) 22 points by cactusbee 5 years ago \| 2 comments

user:	cactusbee
created:	November 3, 2020
karma:	163