Subscription bombing and how to mitigate it • Hacker News Board

Re: Subscription bombing and how to mitigate it

#51

Post by Gigachad » Thu, Apr 02, 2026, 6:53 AM UTC

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

Because confirming the email introduces friction. And everyone is optimising for low friction even if it risks private data leaks, which you can always blame on the user for typing their email wrong.

Re: Subscription bombing and how to mitigate it

#52

Post by RobotToaster » Thu, Apr 02, 2026, 6:54 AM UTC

colesantiago wrote: post #20

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

And your solution is assume everyone on the internet is a good actor? How would you solve this at scale?

Op basically said that the firewall rules and email confirmation alone would've mostly mitigated this.

But also Anubis is a good alternative to slow bots.

Re: Subscription bombing and how to mitigate it

#53

Post by pprotas » Thu, Apr 02, 2026, 6:55 AM UTC

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

This is intentional. Email verification is friction, so it gives users a chance to reconsider whether their purchase is really necessary. This is bad for business, because they’d prefer if you were impulsive.

Also, people usually type their emails correctly, especially these days with auto-fill. So not sending confirmation emails is optimizing for the happy path.

Re: Subscription bombing and how to mitigate it

#54

Post by SebastianKra » Thu, Apr 02, 2026, 6:55 AM UTC

cuu508 wrote: post #3

> If a bot creates an account with someone else’s email, the victim gets one email, if they ignore it that’s the end of it. The welcome email and everything after it only fires once the user verifies. As a user, I would prefer no welcome email at all.

I suspect everyone feels that way except SaaS providers. They could just give you a checkbox to turn the newsletter off, but they don't.

Re: Subscription bombing and how to mitigate it

#55

Post by grufkork » Thu, Apr 02, 2026, 6:56 AM UTC

cuu508 wrote: post #26

colesantiago wrote: post #20

Earlier quoted context omitted.

And your solution is assume everyone on the internet is a good actor? How would you solve this at scale?

How about a signup flow where the user sends the first email? They send an email to signups@example.com (or to a generated unique address), and receive a one-time sign-in link in the reply. The service would have to be careful not to process spoofed emails though. Another approach is to not ask for an email address at all, like here on HN.

Amidst all the age verification and bot spam going on, anonymous private/public key proof of identity could work: the newly signed up service must pass a challenge from the mail server to prove the user actually intended to sign up. Though I guess that would be basically the same thing as the users server initiating the communication. Really, just an aggressive whitelist/spam filter that only shows known senders solves it too, but as I understand part of the attack is having already compromised the mail service of the target. Having a third decoupled identity provider would resolve that, but then that becomes a single point of failure…

Re: Subscription bombing and how to mitigate it

#56

Post by Gigachad » Thu, Apr 02, 2026, 6:56 AM UTC

chw9e wrote: post #48

This happened to me several years ago. I got signed up to probably 700 newsletters overnight. In the middle of all of the sign ups there was activity on my airbnb account where my notification settings were changed. when i checked my airbnb i noticed that someone had created a fake listing under my account and disabled booking notifications for it. a real multi-layer scam where the hacker would be making money off a…

I’d be probably safe against this because I have an email filter set so anything with an unsubscribe link gets moved to spam.

Account notification emails don’t have unsubscribes while pretty much all junk does.

Re: Subscription bombing and how to mitigate it

#57

Post by plagiarist » Thu, Apr 02, 2026, 6:56 AM UTC

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

I am dismayed that it is legal to create an account attached to an email without validation of that email. It should be straight-up massive fine illegal to send any email other than account confirmation until validated. Validation emails should have a "do not contact me again" that works with a single click and a massive fine if it does not.

Re: Subscription bombing and how to mitigate it

#58

Post by wodenokoto » Thu, Apr 02, 2026, 6:57 AM UTC

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

I know e-mail has a faster round-trip, but they also don't ask you to confirm snail mail.

I think it would be quite annoying to have to verify my purchase everywhere, just like how I don't wanna sign up to every single merchant online. Let me purchase as guest without having to enter OTPs.

Re: Subscription bombing and how to mitigate it

#59

Post by nobodywillobsrv » Thu, Apr 02, 2026, 6:57 AM UTC

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

Yes it is insane. I am in same boat and have received mortgage applications, police details, applications for police jobs, massage receipts you name it. Many would be considered important leaks of customer data.

I have even had founder level emails that presumably are confidential sent to me because I share the name of someone operating in tech.

I respond or report when it's obviously some real person running a small group but for large monoliths there is very little to do except quickly reply to corporate email.

Really wish there was some kind of high level discussion about building something for this specific problem of non malicious wrong person same name errors.

Google could do it it's just not something that is monetizable at a scale they care about IMO and I have not been able to think of a way to make this work operating outside of email monoliths.

Would love to hear if anyone has ideas.

Re: Subscription bombing and how to mitigate it

#60

Post by RobotToaster » Thu, Apr 02, 2026, 6:58 AM UTC

snowe2010 wrote: post #33

znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

Then you’re also blocking legitimate users that don’t want to be tracked and use services like iCloud Hide my Emails

> that don’t want to be tracked

>iCloud

Except by apple I guess...