Hacker News Reader

Comment by jcomis | Hacker News Reader

Some places check for these types of services though

They do, but they're not very effective. They might have an up-to-date list of domains belonging to the big services (i.e. Mailinator), but you can always just google "Disposable e-mail", open the 10th page and pick the first one, and it's pretty much always guaranteed to work.

I beg to differ. I use this blacklist and not much gets by. Anything that does, I blacklist manually.

https://github.com/martenson/disposable-email-domains/blob/m...

A lot of sites I've come across lately are going back to the old-school way of only whitelisting email addresses from .edu domains or ISP accounts ("@comcast.net").

That's an absolutely ridiculous idea and a good way to destroy the amount of users you're getting. Do you whitelist Gmail? Then it's piss simple to sign up to multiple accounts. Do you not? Good luck a massive portion of the internet to sign up...

I don't want the sort of users who are signing up to perform financial transactions using services like mailinator and guerrillamail. It's always fraudulent.

Gmail itself is allowed, but the addresses are normalized. I'm well aware of its potential for abuse.

I think what the parent meant was that creating multiple gmail accounts is also piss-simple.

I personally own over 100 from a couple years back when recapta was easily automateable and the phone-number requirement wasn't there.

I have infinity. I use Gmail for business with a catchall rule that forwards to the one address in my domain.

I have an email address for every site I sign up for.

Helps you figure out who sells your email.

How do you handle this? Or do you not?

I guess you could do a DNS lookup of the mail exchange records and see if it points back to gmail and compile a list of domains to allow one account from... but then that would break many companies emails. That’s no fun.

I use Fastmail in exactly the same manner (catch-all, I use "yourdomain.example@mydomain.example" as the email address for signups). Also, anyone could put a cheap domain name on Migadu with a catch-all for this purpose.

Services need a better way to figure out fraudulent or abusive behaviour than guessing based on the email account's domain name.

> only whitelisting email addresses from .edu domains or ISP accounts ("@comcast.net").

I haven't seen ISPs give out emails addresses like that in years (I now my last couple of ISPs have no such thing).

So you're basically limiting yourself to people from universities, or who've had an old-school ISP for a while.

I've yet to see a fixed ISP that doesn't give out email addresses; though I very rarely meet anybody who used them as anything other than a fallback for their webmail addresses.

Mobile carriers even still seem to, though they are optional and require an additional setup step.

Reply on news.ycombinator.com