Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Receiveee.com - disposable email address

receiveee.com

Post reply on HN
Print view View original

121–127 of 127 posts

Re: Receiveee.com - disposable email address

#121

Post by garrettdimon »

LiveTheDream wrote: post #117
garrettdimon wrote: post #95

Earlier quoted context omitted.

My feelings are that trust is a two-way street. If people don't trust us with their email address, I don't think it's fair for them to expect us to trust them with an account on our service if they provide a fake email address. If they are serious about evaluating our product, they can provide a real email address. If they aren't very serious or inherently don't trust us, then I'm willing to miss the opportunity of h…

Why should a potential customer be willing to trust you with their email address? Perhaps you are very respectful of their privacy, but already their trust has been violated plenty of times by other, less honest companies. "One bitten, twice shy" and all that.

I'm not claiming that they should trust us. I'm only saying that it works both ways, and that we as business owners have a choice about whether to trust potential customers just as much as they have a choice about whether or not to trust us.

It might be anachronistic, but if a potential customer wants to begin a relationship with us with a lie, then of the two of us, I would think we have more reason to mistrust that individual than they have to mistrust us. Their mistrust is based on projecting bad behavior of other companies onto us whereas our mistrust is based on them actively beginning the relationship with a lie.

Of course, this decision may cost us some potential customers, but for now, that's something that we're willing to accept.

Re: Receiveee.com - disposable email address

#122

Post by chockablock »

easy_rider wrote: post #103
vidyesh wrote: post #69

These are the services I use quite often when I need a disposable email id / fake inbox. http://mailinator.com/ http://10minutemail.com/10MinuteMail/index.html https://www.guerrillamail.com/ http://www.dispostable.com/ http://dudmail.com/ http://getairmail.com/ http://mailcatch.com/en/disposable-email http://spambox.us/ http://www.yopmail.com/en/ https://ssl.trashmail.net/ http://www.fakeinbox.com/ http://www.fakemai…

Thanks for the list! I will add them to our blocklist :) Our business values e-mail destinations where we can actually incite the signed up user with interesting offers, or new product features, instead of sending it into a black hole.

From the looks of the replies here, you have quite a knack for 'inciting'.

Whether the offers you send out to users are enticing or not remains to be seen.

Re: Receiveee.com - disposable email address

#123

Post by chockablock »

Sami_Lehtinen wrote: post #93
nwh wrote: post #52

Earlier quoted context omitted.

Yeah, the developer is going to want to fix that quick smart. At a complete guess they are two strings being generated in quick succession from the same seed, and they both happen to be very close. End result is that I can guess your email.

Also email addresses are in really tight set and easily guessable. So that system should be fixed in general. Not just for address / password issue. But also getting proper address distribution.

Addresses and URLs seem to be timestamp strings that change every microsecond, with the URL code being generated just before the email address. This makes it trivial to read someone's mail if you know their address.

You can verify this by repeatedly clicking 'Delete this address', which issues you a new mail box. The address string can be thought of as a number that is always incrementing, with the 'digits' drawn from [0-9a-zA-Z]. (So base 62.)

The URL number is always (sample size ~100) just a little smaller than the email number, but not by a consistent amount. Often about 20-30 steps away, but sometimes as much as 600 steps away (depending on server load?).

The number seems to be generated by a clock rather than a counter, since the rate at which the counter increases is very steady. The 5th digit from the right increments every 15 seconds, suggesting that there are (62^4)/15 ~= 0.99 million unique strings per second. Maybe the counter is just using the time in microseconds, and converting it to a string?

Issues raised:

1 - If I know your address, I can now guess the 'secret' URL to read your mail in a trivial number of guesses (certainly less than 1000). There doesn't seem to be any throttling of attempts on server side (I was able to manually cycle through ~30 invalid URLs fairly quickly).

2 - Email addresses 'leak' the time that they were created. (Not a clear security risk, but could be problematic in some cases)

3 - As Sami_Lehtinen says, addresses are guessable based on signup time, but given that these are disposable addresses, I'm not sure that's a big problem (who cares if a spammer guesses it). Also, even if there is a new user signing up every second, the success rate for guesses will be 1E-6.

Re: Receiveee.com - disposable email address

#124

Post by kornnflake »

mike-cardwell wrote: post #85

Your site seems to display any arbitrary html sent via email. So it will load flash, javascript, honour meta redirects to other sites, etc. Try running it through https://emailprivacytester.com/ E.g: https://receiveee.com/1QQGEpdt/908

Thanks for the hint! Already fixed most of these attacks and looking forward to fix them all.

Btw: This fix only applies to new mails.

Re: Receiveee.com - disposable email address

#125

Post by kornnflake »

chockablock wrote: post #123
Sami_Lehtinen wrote: post #93

Earlier quoted context omitted.

Also email addresses are in really tight set and easily guessable. So that system should be fixed in general. Not just for address / password issue. But also getting proper address distribution.

Addresses and URLs seem to be timestamp strings that change every microsecond, with the URL code being generated just before the email address. This makes it trivial to read someone's mail if you know their address. You can verify this by repeatedly clicking 'Delete this address', which issues you a new mail box. The address string can be thought of as a number that is always incrementing, with the 'digits' drawn fro…

Thanks for the hint! I already took a look into it. There are indeed only 676 options to guess the secret in many cases. We do block brute force attacks, but given that there are only 676 possibilities, you could just run the brute force tool at a very low speed.

Re: Receiveee.com - disposable email address

#126

Post by stevetursi »

easy_rider wrote: post #103
vidyesh wrote: post #69

These are the services I use quite often when I need a disposable email id / fake inbox. http://mailinator.com/ http://10minutemail.com/10MinuteMail/index.html https://www.guerrillamail.com/ http://www.dispostable.com/ http://dudmail.com/ http://getairmail.com/ http://mailcatch.com/en/disposable-email http://spambox.us/ http://www.yopmail.com/en/ https://ssl.trashmail.net/ http://www.fakeinbox.com/ http://www.fakemai…

Thanks for the list! I will add them to our blocklist :) Our business values e-mail destinations where we can actually incite the signed up user with interesting offers, or new product features, instead of sending it into a black hole.

What happens in that case is people just type in RandomDictionaryWord at majoremailprovider.com and then the person who really is at that address gets the pleasure of your interesting offers, even though that person probably never heard of you.

(My old gmail account gets Pizza Hut order confirmations from some guy in Texas. About every other week.)

Post reply on HN