Show HN: Startup with no website - GuerillaClick@gmail.com • Hacker News Board

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#141

Post by bacon_waffle » Wed, Feb 06, 2019, 9:13 PM UTC

Semaphor wrote: post #75

nine_k wrote: post #23

This is delightfully crazy. Give some random guys with no website your registration record somewhere, allow them to verify your registration as theirs, and then impersonate you, reset passwords, see any communications, possibly log in as yourself and do anything. All this with no recourse. Nigerian spammers moan from envy for such a brilliant self-propelled gullibility filter.

I have first.last@gmail.com and I've had people play poker and lottery and sign up for dating websites with my e-mail address. I've also received confidential information from insurance and building construction companies. It's hilarious.

Me too! One of the others with the same name signed up for a dating website (match.com IIRC) a few years ago and they sent enough information that I was able to improve his odds and help a bit with his decision making.

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#142

Post by groestl » Wed, Feb 06, 2019, 9:18 PM UTC

ixwt wrote: post #52

ReadyPlayerNone wrote: post #13

Earlier quoted context omitted.

I'd reconsider this change. Lots of people use email aliases to track which sites share their contact details with third parties. I see it all the time in signups for one of my sites - don't mind, of course, because I don't share their data. If you stop people doing this it might send the wrong message.

This is a poor way to track who is selling your contact details. It's trivial to strip + aliases from a list.

But it's a good way to track who accidentially leaked your contact details.

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#143

Post by herogreen » Wed, Feb 06, 2019, 9:20 PM UTC

kodablah wrote: post #53

If something like this becomes popular, one might expect sites concerned about non-human verification to add a captcha to their verification page before the account is considered verified.

Or: ask the user to use the same browser and check that cookies match / "sanitize" gmail adresses

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#144

Post by Dolores12 » Wed, Feb 06, 2019, 9:27 PM UTC

deevin9 wrote: post #120

modzu wrote: post #35

Earlier quoted context omitted.

but the list of mailinator domains is easily looked up and blacklisted by most major sites. the op's insight is that sites won't blacklist gmail

I don't know if it still does it, but mailinator used to have a neat feature where it would "detect" bots trying to scrape its list of domains and start injecting legit ones like hotmail.com/gmail.com

you don't need to scrape anything. you check provided email for mailinator's MX records\IPs.

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#145

Post by naniwaduni » Wed, Feb 06, 2019, 9:28 PM UTC

kodablah wrote: post #11

swongel wrote: post #5

You can use Mailinator to do this already, you can see all of their inboxes on their website and you can use all of their domains to bypass domain restrictions. For example I might use somethingsilly@bobmail.info and it will be redirected to https://www.mailinator.com/v3/index.jsp?zone=public&query=so...

> You can use Mailinator to do this already While I'm a fan of Mailinator and their approach, I think the feature OP has about auto-clicking verify is unique. But yes, to do this right, you need the multi-domain approach of Mailinator instead of just aliases. Maybe Mailinator has an API or supports POP/IMAP that would make this possible, I haven't checked.

Also exists: https://mailnesia.com/

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#146

Post by gpm » Wed, Feb 06, 2019, 9:33 PM UTC

rcfox wrote: post #71

I've always wanted sort of the opposite. I'd sign up to a website, and they wouldn't ask for a password. To login, they would email a link to click and I'd be logged in for however long that cookie lasted. Why don't sites do that? (Is email still considered slow? I remember having wait times in the hours back in the 90s, but I'm not sure I've ever waited anywhere near a minute in the past decade.)

This is basically how steam works these days.

Sure, there is a "password" - but they won't let you log in without also verifying you have access to your email account - and you can reset that "password" only knowing the username and having access to the email account.

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#147

Post by jonathanmoore » Wed, Feb 06, 2019, 9:43 PM UTC

Semaphor wrote: post #75

nine_k wrote: post #23

This is delightfully crazy. Give some random guys with no website your registration record somewhere, allow them to verify your registration as theirs, and then impersonate you, reset passwords, see any communications, possibly log in as yourself and do anything. All this with no recourse. Nigerian spammers moan from envy for such a brilliant self-propelled gullibility filter.

I have first.last@gmail.com and I've had people play poker and lottery and sign up for dating websites with my e-mail address. I've also received confidential information from insurance and building construction companies. It's hilarious.

A while back when Yahoo released inactive email addresses, I grabbed moore@yahoo.com. It was a nightmare. The account would receive 10,000+ emails a day. The inbox was full of insurance claims, social security numbers, mortgage applications, pay stubs, and more. In the end, I deleted the account since I didn't want the possible liability of the account.

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#148

Post by eralpb » Wed, Feb 06, 2019, 9:44 PM UTC

anant90 wrote: post #138

Request for feature: Chrome extension: a shortcut fills in guerillaclick+ @gmail.com

great idea, which also warns about the websites it won't work on.

some require session authentication, so bot needs to login and THEN verify.

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#149

Post by macspoofing » Wed, Feb 06, 2019, 9:49 PM UTC

williamdclt wrote: post #19

ixwt wrote: post #10

Earlier quoted context omitted.

Because it's a gmail address, you can put as many . as you want anywhere in the name. Gmail strips them out when determining the email address.

Not as useful as `firstnamelastname+twitter@gmail.com` for example :/

I never understood why that was useful. If you're a spammer that harvests email address or if you're an unscrupulous service that sells your user email address to spammers, wouldn't you simply remove the '+' suffix from any gmail address before commencing your spamming?

Re: Show HN: Startup with no website - GuerillaClick@gmail.com

#150

Post by dsl » Wed, Feb 06, 2019, 10:04 PM UTC

Semaphor wrote: post #75

nine_k wrote: post #23

This is delightfully crazy. Give some random guys with no website your registration record somewhere, allow them to verify your registration as theirs, and then impersonate you, reset passwords, see any communications, possibly log in as yourself and do anything. All this with no recourse. Nigerian spammers moan from envy for such a brilliant self-propelled gullibility filter.

I have first.last@gmail.com and I've had people play poker and lottery and sign up for dating websites with my e-mail address. I've also received confidential information from insurance and building construction companies. It's hilarious.

I bribed an exchange admin or two and got [firstname]@[really big company].com. This company had a lot of consumer facing stuff, and some of which required an email address. Employees of the company would just put in [customers first name]@[the company].com when they didn't have an email address.

That was fun.