Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect up to 1327 disposable email providers with MailChecker

github.com

Post reply on HN
Print view View original

41–46 of 46 posts

Re: Detect up to 1327 disposable email providers with MailChecker

#41

Post by tom_mellior »

brianwawok wrote: post #39
a9entroy wrote: post #8

Earlier quoted context omitted.

Seriously, if any site owner has even a half of a brain, he should stay away from this shit. Disposable email exists for a reason.

That is not true at all. If your site is just a chat forum and you don't mind spammers, sure let people use disposable emails. If your site involves money or auctions or credit cards.. letting disposable emails in can be very costly.

If a quick-and-dirty domain check on an email address is more secure for fraud detection than credit card data, then that says a lot about how broken the whole credit card system is. No surprise, of course. Sad that Bitcoin blew its chance to replace this crap.

Re: Detect up to 1327 disposable email providers with MailChecker

#42

Post by JupiterMoon »

mynamesgeneric wrote: post #18
zrail wrote: post #17

Earlier quoted context omitted.

I built this kind of check into my ecommerce sites for high-value items. They're disproportionally susceptible to fraud and carding for some reason, and implementing a "no free email provider" check has cut fraud on those items to zero.

I work at a financial institution and disposable e-mails are used by fraudsters all of the time. This is certainly better than my current blacklist.

Do you blacklist gmail and hotmail addresses as well? It takes 5 minutes to put a throwaway gmail account together.

Re: Detect up to 1327 disposable email providers with MailChecker

#43

Post by gus_massa »

imglorp wrote: post #16
caf wrote: post #12

Earlier quoted context omitted.

Verification emails serve the purpose of ensuring that people don't sign up other people's email addresses.

And if they do, why is that bad?

People can create fake accounts with other person email. For example, a last year case of a fake account for Linus Torvalds in change.org

https://plus.google.com/+LinusTorvalds/posts/DPY7H4a9Ma5

> Somebody signed a Change.Org petition in my name, and using a really old email address of mine.

> So since I apparently had an "account", I reset the password, and made a petition of my own.

> Change.Org - please change your dickish ways. Ok?

Re: Detect up to 1327 disposable email providers with MailChecker

#44

Post by no1youknowz »

pdkl95 wrote: post #24
imglorp wrote: post #16

Earlier quoted context omitted.

And if they do, why is that bad?

Because of the script that destroys email addresses by signing them up for 5000 mailing lists.

What script is that? Never heard of such a thing.

Re: Detect up to 1327 disposable email providers with MailChecker

#45

Post by pdkl95 »

no1youknowz wrote: post #44
pdkl95 wrote: post #24

Earlier quoted context omitted.

Because of the script that destroys email addresses by signing them up for 5000 mailing lists.

What script is that? Never heard of such a thing.

There were several going around in the "warez" scene in the mid-90s.

It didn't require a script, either. When mailing lists and other automatic email sources let you add destination addresses without closing the confirmation loop by sending a test email, you can denial-of-service email addresses with just an SMTP client.

The really nasty part about this attack is that it's not just bandwidth amplification. Normal amplification attacks go away when the attacker decides to stop sending packets. With mailing subscriptions, the badly-configured mailing lists keep sending the attack on their own.

Re: Detect up to 1327 disposable email providers with MailChecker

#46

Post by brianwawok »

tom_mellior wrote: post #41
brianwawok wrote: post #39

Earlier quoted context omitted.

That is not true at all. If your site is just a chat forum and you don't mind spammers, sure let people use disposable emails. If your site involves money or auctions or credit cards.. letting disposable emails in can be very costly.

If a quick-and-dirty domain check on an email address is more secure for fraud detection than credit card data, then that says a lot about how broken the whole credit card system is. No surprise, of course. Sad that Bitcoin blew its chance to replace this crap.

You don't replace, you use it in addition. Layers of security.

Now if you want to spam 500 million credit cards on my system, you are going to need to at least make them from some common domains, which I can block down the road. If you are using an email hiding service, way easier for you.

Not sure bitcoin matters, if I had users paying with bitcoin in an app I would STILL blacklist certain email domains.

Post reply on HN