Show HN: IsTempMail – Detect and block disposable email addresses
istempmail.com
istempmail.com
This helps protect me in many ways. If my email is sold or leaked, not a big issue, I can just add that specific email to a blacklist and I never need to get spam from it again. Or if I cancel and keep getting spam about rejoining, blacklisted. It makes it easy to keep my spam and newsletters to a minimal.
It has the built in advantage that I can always sign up for new trials if I want, just do thatdomain.com1@ thatdomain.com2@ and so on. Although I don't do this often, I have had to do it for various reasons.
I've hit on occasion websites that block their domain from being in the email address, likely a poorly implemented security check because their software might say anyone with a "@service.com" email is an admin or something. In that case, I enter some random crap. I never have to remember the emails, since I can just search my email history for the address the service sent the registration confirmation to.
However, the downside is privacy. I use my own domain, which contains my full name, so when I sign up to some services and want to do so without giving my name, I still rely on a disposable email service such as hidemyass.com; and I do this for many online services. I am not a believer that everything I sign up for needs to know my full name, address, and email - often services ask for this information for no reason.
So attempting to block these types of services, that have valid and useful benefits to users, simply harms your users. You can avoid spam users with a captcha, and for trail abusers you already can't do much because @gmail.com already allows for a lot of aliases to work like @googlemail.com, or user.@gmail.com or u.s.e.r@gmail.com etc, or user+whatevertheywant@gmail.com
Don't harm your users with useless validations.
You have no idea the lengths people will go to.
If all you wanted to do was test a product out, create a real email address even if it's full of bogus details.
If you won't try my product without a real address then you're a customer I don't want and don't need.
Some users may value your service so much or their privacy so little that they may pay up, but for the rest of us it's back to the disposable email arms race.
PS: Kudos for being open and considerate enough to defend an unpopular position on here, though it's ironic that you did so using a disposable HN account.
Is that what asking for an email to sign in to create an account to use a service that probably doesn't work well without having an account is now, invasion of privacy?
Where do we put our foots down and stop saying that everything a SaaS does is sacrificing the user's privacy... Soon we're gonna start seeing "Whoa, asking them to pay and input their credit card? You're asking for the sacrifice of your user's privacy."
You are well within your rights as a business to decline potential customers over something like this, but you need them more than they need you.
For a product with a "free tier" that doesn't work where a user needs to sign up several times, the product itself is flawed.
However, disposable emails again are not the problem, as there are tons of ways to get valid, working emails to bypass any unique email requirements. Blocking disposable emails aren't going to help you with that. The only thing you're removing it a user's access to better privacy. Again, if you require knowing who your users are then you are not a free service.
If you don't care about having users unless you know their real email addresses then you should consider validating their identity in other means, besides an email address. Many services use a text message to validate you also have a phone number that works, which is much harder to anonymize (although I personally have four different numbers for this very reason, based on the trust I give a service I decide which number I want to provide them - since to me, my privacy is worth something, I don't share it for free).
Two observations.
1. Prioritise paying customers. Use spare provisioned capacity to provide for the free tier: don't spin up new capacity for free tier customers - or at least do it on your own terms. Now it doesn't matter if people milk your free tier unless you believe, almost certainly incorrectly, that these people would pay if they couldn't sign up for more trials.
2. We had repeat signups from gmail accounts, but almost none from disposable addresses as such. Any service that lets you have multiple email addresses for free is a potential "risk". That obviously includes any self-run email server, or any corporate email server from the perspective of a user allowed to add new addresses to their mailbox.
Too often now sites/app want a login for no benefit other than to SPAM me with newsletters and crap I never wanted. That's why I use disposable email addresses, you're providing me no real value, at least sight unseen, but I must give you something I know is valuable-- my contact information.
If they remove the "+microsoft" portion mailing me, that email is sent to my spambox and reported to spamcop, because I did not sign up with that address; the address I signed up with has the +etc infix.
Eventually I figure companies will get wise to this and I'll have to set up my own server which does the same trick with an underscore instead of the "+" sign.
Related tutorial on how to set that up in Postfix: https://www.stevejenkins.com/blog/2011/03/how-to-use-address...
You can make addresses on the fly like microsoft@cryptarch.fastmail.com (which will automatically be resolved and sent to cryptarch+microsoft@fastmail.com) and you'll save the hassle of having to run and maintain your own mail server.
You don't use a '+' at all in the fastmail email addresses you give out.
For example, say with gmail you have name+stuff@gmail.com, with fastmail you could use that if you wanted, but you can also use stuff@name.fastmail.com
If fastmail receives mail on that address, it converts it for you as if it had been sent to name+stuff@fastmail.com instead.
This happens entirely on the fly so you can make 'proper looking' emails without a '+'
I use mynamemicrosoft@mydomain.tld for each service, and i catch every email regardless of mail address.
Sure they can manually fool me or use more sophisticated regex to find their service name (and i can obfuscate it), but in practically all cases i know which service has leaked my address if i get spam against a certain address that's not the service i signed up for.
I recommend using a personal domain and a mail service that offers catch-all filters. Stuff regex on that and you can also filter all emails of this type into a specific folder.
If it's just a Regex check then you can just use dslfkjsdlfj@fdsjfs.com. If it requires you to click on a verification link in the email then that is quite a high bar for you to go through to obtain something of `no value`.
If it's a walled garden, which more are becoming because it's the path to VC money, you have no way to know until you're inside.
Most organizations who do this crap also require you click a link in the email to activate the account.
No need to block the temporary email, but you might use that information for other purposes, like having it be some weight to a fraud detection system. Note, not calling it out as fraud outright, but using it as one data point among others.
I just provide the tool for those in need.
Please by all means explain this to me.
My point is, if you can't be bothered to create an extra email address for this purpose, then you probably aren't that concerned about it.
But I'm subject to being wrong.
But not really :/
2017-03-30@tmp.grepular.com
I didn't have to click a button or anything to create it. It just exists, thanks to the pattern. Here's how I did it:
https://www.grepular.com/Automatically_Expiring_Email_Addres...
It has a public API, no registration required, accepts up to 10 checks per minute. A WordPress plugin and a simple PHP library are also included.
Check it out :-)
Sure if it's some throw away service that doesn't have such sensitive information, that's fine, but there's many reasons to use such a service.
The user's fault; they are knowingly trading that risk for protection of their privacy. That says a lot for how they regard the service in question.
What about rejecting ISP-issued e-mail addresses? Those are also ephemeral, for those who use them.
What about Yahoo! / Outlook.com / Gmail addresses? in the vast majority of cases people using those have no 'hold' on them and their accounts can be suspended at whim.
Domain-related addresses can be lost if the registry decides to hike the domain prices beyond affordability, such as with the 1000% increase in Uniregistry gTLDs later this year.
Where to draw the line? All e-mail addresses are temporary.
https://flow.microsoft.com/providers/Internal.User/users/joe...
https://flow.microsoft.com/providers/Internal.User/users/joe...
It classifies things like gmail, yahoo mail, hotmail as "Consumer" addresses.
So, there might be some additional markets for you if you can identify "consumer" emails vs "business". Also, some niche areas like isEduEmail(), for things like student discounts (fyi, not as simple as it seems at first glance).
Gets the job done.
But, I hope this doesn't take off because there are valid reasons for using fake email addresses. E.g. I don't trust the site not to sell my email, or leak it inadvertently through a security exposure.
I don't want Best Buy Rewards, etc. having my email to sell.
Seems also like a user-hostile escalation in this kind of arms race that will eventually be overcome anyway.
E.g. you register an actual account with temp-mail, this makes anybody able to reset the password.
I totally agree though that this service is user-hostile.
I'd argue that those emails aren't disposable. I use ThrottleHQ to track when service providers resell my email to other lists.
Is that acronym even a thing?
Gloves are a tool for criminals! Knives are a tool for murderers! Cameras are a tool for terrorists and pedophiles!
Like these other tools, email addresses have legitimate uses. If you find yourself getting a lot of disposable addresses, there are other ways to ensure you get a valid email address, like only asking for one when your users are actually going to want to receive your emails.
You take a quick quiz of stuff you personally consider unacceptable from a site (such as blocking disposable emails), and then it comes up with an autoupdated blocklist.
Does this exist?
It would not hurt my feelings if the developer of this "service" became allergic to pizza. And if the service were to close... The allergy is reversed, gradually.