Live data from Hacker News

Show HN: An ad free temporary mail service

news.ycombinator.com

31–40 of 96 posts

Re: Show HN: An ad free temporary mail service

#31

how do you know you're following "the" RFC correctly? And which one is that? There are several different standards just for email addresses themselves, which almost everyone gets wrong. Did you know addresses can have quotes and parentheses in them?

I didn't know at first and it was hell as when I first delved into this I thought it would be a simple task as it would be some agreed upon standard like JSON behind the scenes, but from what I understood emails were created a long time ago and some providers did things differently.

The majority of the work was done through testing lots of emails and I must have sent at least a thousands emails to myself from different providers and sites.

I've deleted the bookmarks in an attempt to reduce the PTSD it caused, but I think the main one I visited was RFC 1341 as I had some difficulties understanding the boundaries and encoding.

What was really tricky is getting it to work with all the different types as some emails didn't have boundaries while others had them, some were encoded entirely in base64, some partially, some of them were just plaintext, others were HTML while some were mixed or even offered multiple versions depending on what the email client supported.

Best thing is honestly to try it out and just pick a random address and send a really tricky email to it, would love to see you break the parser and telling me so I can improve it.

Re: Show HN: An ad free temporary mail service

#32
post #29

I'm always a little suspicious of these services. People use them to create throw-away accounts, which they abandon after one use. Those accounts remain active and are useful for botting (vote manipulation, comment spam, etc). Whoever owns the email domain can do a password reset to do an account take over. I'm curious about the privacy policy. The title says that you don't have ads, but there's tons of discussion ab…

There's a whole industry around detecting these and placing them on block lists.

Could you recommend a few solutions or companies? I'm looking for such a solution at the moment. Thanks!

Re: Show HN: An ad free temporary mail service

#33
post #21

Earlier quoted context omitted.

If I'm using a temporary email service, I'm using it specifically because I don't care if the account gets taken over, though.

Oh, the threat isn't to the user. They don't care about accounts they have abandoned. The threat is to services that suffer vote manipulation, spam, etc. The benefit of this approach is that you've got a bunch of abandoned accounts that were organically created (captchas solved, residential IP ranges, etc.)

I don't think there's any value in that though.

You can get all the stuff you mentioned for a fraction of the time and money it would cost to create a disposable email service and then you would also only target the service you wanted instead of sitting around and hoping that a user creates an account at the site you're looking for.

The real value would in the reputation and history of the account (e.g a popular account on a social media site or community) and this isn't a thing that someone would use a disposable email service for as they wouldn't want to risk losing access to the account.

Re: Show HN: An ad free temporary mail service

#34
post #32
post #29

Earlier quoted context omitted.

There's a whole industry around detecting these and placing them on block lists.

Could you recommend a few solutions or companies? I'm looking for such a solution at the moment. Thanks!

This discussion isn't going in the direction I was hoping for, ha ha!

But as a developer of these sites I've used the majority to check my own domains and the most reliable one I've found is https://www.ipqualityscore.com/

I strongly recommend that you take another look at your signup process though and don't require users to give up their email addresses, instead make it optional and present an alternative like a captcha.

Re: Show HN: An ad free temporary mail service

#35
> Made this privacy conscious temporary mail extension

> Enable JavaScript and cookies to continue

It's not privacy conscious. Privacy conscious would mean A) does not use Cloudflare as a CDN B) does not require JavaScript C) does not discriminate against Tor users.

There are a few services like this already, which I'm not going to spoil for cred on HN, but my rating of this site as of now is 0/10, unusable in the literal sense.

Re: Show HN: An ad free temporary mail service

#36

> Made this privacy conscious temporary mail extension > Enable JavaScript and cookies to continue It's not privacy conscious. Privacy conscious would mean A) does not use Cloudflare as a CDN B) does not require JavaScript C) does not discriminate against Tor users. There are a few services like this already, which I'm not going to spoil for cred on HN, but my rating of this site as of now is 0/10, unusable in the li…

A) The connection is fully encrypted.

B) That would make the UX horrible.

C) I had Tor enabled in the beginning, but when I got complaints from people on Tor doing really shady stuff with it I had to disable it.

Re: Show HN: An ad free temporary mail service

#37
How about redefining the problem a little bit so that it is something else than what others are doing?

For example, the platform approach? Allow people to easily set up a temporary email service with their own domain. That would go around the problem needing changing domains all the time. You could make it easy for people to search and buy their temp email domain through you.

Or if that is too much, work, allow people to self-host your service by open sourcing it and creating Docker compose configurations etc.

I would personally also write a spec for one-click account delete link that can be recognized automatically, sent with the email. If that takes traction, then it would benefit everybody. It just might, as it benefits the service provider the most.

Re: Show HN: An ad free temporary mail service

#38

Earlier quoted context omitted.

Yes, just like all other email providers nothing is encrypted and you could totally look at the emails. The difference here is though that there's nothing of value. If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon. I like that you bring this stuff up though as it could perhaps be good to mention this on the site down at the FAQ so p…

> If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon Or spinning up hundreds of accounts on a website so you can perform card testing. Or creating accounts so you can put all of the inventory for an e-commerce site into carts to reserve it for yourself. Or running sneakerbots. Or any other malicious intent where the victim is the webs…

Again, wouldn't it be easier for the attacker to just buy a domain and use that completely undetected instead of having to use a rate-limited disposable email service?

Re: Show HN: An ad free temporary mail service

#39

Earlier quoted context omitted.

I don't agree with this and I think the right approach is to simply not require visitors to give up their email accounts if they don't want to. If you want to block a malicious attacker, then you can use a captcha. A serious malicious attacker wouldn't have a problem paying a few dollars to buy a domain, creating a catch-all address and if he wants to take it one step further he can even have it look like a legitimat…

Aliases you can discard are ad blockers for emails, disposable services are for bots, scams, and fraud. If you know the space, you'll be aware CAPTCHAs are trivially defeated today, regardless of the provider. I certainly agree people shouldn't be asked to provide an email if it's unnecessary, but again for the issue of bots, scams, and fraud, you generally need some sort of unique relatively hard to get many of iden…

>Aliases you can discard are ad blockers for emails, disposable services are for bots, scams, and fraud.

What is the difference between the two though?

This kind of reasoning is why people can't run their own email servers anymore and instead have to rely on the big services.

>If you know the space, you'll be aware CAPTCHAs are trivially defeated today, regardless of the provider.

They are a lot more reliable than an email which is basically just a domain that anyone can buy and setup within mere minutes giving them access to endless email addresses.

>you generally need some sort of unique relatively hard to get many of identifier

Why not use phone numbers instead if the issue is truly important to them? This would cost spammers and bots way more money than emails.

Perhaps it's due to the fact that they won't be able to use the phone number to send their spam (or they could I guess, but it would cost them some money).

Re: Show HN: An ad free temporary mail service

#40

> Made this privacy conscious temporary mail extension > Enable JavaScript and cookies to continue It's not privacy conscious. Privacy conscious would mean A) does not use Cloudflare as a CDN B) does not require JavaScript C) does not discriminate against Tor users. There are a few services like this already, which I'm not going to spoil for cred on HN, but my rating of this site as of now is 0/10, unusable in the li…

A) The connection is fully encrypted. B) That would make the UX horrible. C) I had Tor enabled in the beginning, but when I got complaints from people on Tor doing really shady stuff with it I had to disable it.

The woes of supporting an "I don't want to leave any crumbs" threat model. There are countless of pro-privacy projects who call themselves that simply because their service can be used to increase privacy, but they do not actually do much to protect privacy beyond that. Many even use Google Analytics.

For B, simply support both. This site is popular enough for there to be no risk sharing: Guerrilla Mail.

Post reply on HN