Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open-source disposable email service

sorry.idont.date

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Open-source disposable email service

#52

Post by voytec »

hannob wrote: post #43

There's a security problem with this and many other such services. Writing this here hoping that this increases knowledge about this: I would be able to get a TLS certificate for this host. Why? Some TLS certificate providers allow verifying the domain via access to one of the privileged aliases like postmaster. So I could receive the verification token URL by looking at the postmaster inbox. Every service offering a…

RFC 2142: Mailbox Names for Common Services, Roles and Functions [1]

    MAILBOX        SERVICE             SPECIFICATIONS
    -----------    ----------------    ---------------------------
    POSTMASTER     SMTP                [RFC821], [RFC822]
    HOSTMASTER     DNS                 [RFC1033-RFC1035]
    USENET         NNTP                [RFC977]
    NEWS           NNTP                Synonym for USENET
    WEBMASTER      HTTP                [RFC 2068]
    WWW            HTTP                Synonym for WEBMASTER
    UUCP           UUCP                [RFC976]
    FTP            FTP                 [RFC959]
[1] https://www.rfc-editor.org/rfc/rfc2142

Re: Open-source disposable email service

#54

Post by blowski »

solatic wrote: post #48

I imagine this domain will quickly end up on lists like this one: https://knowledge.hubspot.com/forms/what-domains-are-blocked... The real value here is the opening of the source code. Set up a cheap domain, set up a cheap VPS, use Tailscale or similar to keep the web UI private, then you're good.

What a fascinating list. It’s effectively guessing whether something is a business email, given that it’s blocking domains like gmail.com, outlook.com, fastmail.com, and yahoo.com.

Re: Open-source disposable email service

#55

Post by usr1106 »

ipaddr wrote: post #42
usr1106 wrote: post #38

For incoming mail this is easy to do yourself if you have a little root server with a decent subdomain (the domain does not even need to be owned by you) But for outgoing mail that requires real work / knowledge / full control over your DNS records. Recently gmail has stopped to accept any email without SPF/DKIM.

So not having SPF/DKIM setup could be considered a privacy feature if gmail is going to reject those outright.

Well, yes. But if I send an email to a gmail address I know what I am doing and want it delivered.

When I send such email to a custom domain used by a Google office customer it's even worse. Then their admin gets to see my mail (not sure how much detail of it) in the admin interface.

Re: Open-source disposable email service

#57

Post by sigio »

hannob wrote: post #43

There's a security problem with this and many other such services. Writing this here hoping that this increases knowledge about this: I would be able to get a TLS certificate for this host. Why? Some TLS certificate providers allow verifying the domain via access to one of the privileged aliases like postmaster. So I could receive the verification token URL by looking at the postmaster inbox. Every service offering a…

A CAA dns record will most likely prevent tbat, just set it to your preferred CA tgat doesn't do mail-based validation.

Re: Open-source disposable email service

#60

Post by KomoD »

rvz wrote: post #26

Just like the other disposable email providers, this one will eventually get blocked pretty quickly. Instead, use a forwarding email from Gmail, Hey.com, Outlook or ProtonMail.

I use temp-mail.org, I rarely have issues with blocking because they rotate domains
Post reply on HN