Mailinator.com: Anatomy of a Spammy Campaign
mailinator.blogspot.com
mailinator.blogspot.com
Why does your company consider disposable email addresses abusive?
This is great! You have users who are using your product, how could you not be happy? Find out why they are not converting, perhaps your offer isn't that great for their demographic? Note that even if they didn't pay to your service, they may be your biggest fans who may recommend your product to other people. DEA users are usually tech-savvy types, they are also the kind of people who are the early adopters when it comes to tech (since they were able to figure out how a DEA works & how to use one), and are probably the ones who normal people go to get advice. Don't forget that even if not a paying customer, they are still a customer in the sense that they could review your service or refer others through word of mouth! If you're blocking DEA services, it may end up costing you more.
So don't let people use your services without paying! A trial is only a trial if it locks or stops the user from using it after a trial period. Freemium models that limits number of uses aren't a trial.
Ultimately, my solution was to start requiring a credit card at sign-up. Shockingly, not a single mailinator.com address was used from that point forward and my conversion rate barely changed. But, it sucks I had to do that. There were people that legitimately wanted to try the service out that were put off by requiring a credit card so early. I personally hate providing a credit card for a service I haven't even tried yet.
I appreciate your reply, but I think it's an entirely toxic mentality. My business model isn't freemium because you could game the trial process (and violate the terms of service). And I shouldn't have to grossly restrict the trial to deal with mailinator.com sign-ups. Say what you will about mailinator.com, but it was hands-down the largest source of abuse of my CI-like service. Everyone else played by the rules and enjoyed a liberal trial to get familiar with product.
It's very useful
In other words, there's a big difference between using ikea@ and saastrial1@, saastrial2@, saastrial3@,.. and so on to keep signing up for trials with the same SaaS provider.
[1] -- https://www.fastmail.com/help/receive/addressing.html
Also, it's very easy to mechanically identify all such users because of the + symbol, which, if you are trying to prevent your real email address from revealed means it's not that useful...
Regarding the latter, when they email you directly without the + you can be very strict. You could even apply whitelisting.
A lot of domains have that feature btw. Gmail's specific feature is with the dots functioning as catch-all [1] (though Facebook apparently has the very same feature).
[1] http://www.slate.com/blogs/future_tense/2013/08/01/dots_in_g...
Even worse are the sites that happily accept disposable email addresses and claim to send a verification message, but never actually send it. This wastes my time with rummaging through spam filters and polling my inbox, wastes their time when I contact support to find out wtf is going on, and is generally just (c) a terrible experience.
Your modus operandus means you cannot share your e-mail address whereas my spam filter is so good that the amount of false positives and false negatives is negligible.
> (They also have the side benefit of a little added security when someone hacks Site A's account database and tries to use the email addresses to log in to Site
Using a password manager plus randomly generated, complex passwords mitigates that problem entirely insofar that your accounts can be used on different websites.
Both our solutions do not mitigate the doxing issue. A way to deal with that is removing your personal details whenever they're unnecessary (e.g. changing/removing them after you ordered something). Artifacts might still remain though, and faking them is probably illegal. It can lead to issues as well. My mother always gives a fake DOB akin to her own when she doesn't trust it, or gives a slight variant of her name. Then she knows something is wrong. Pretty clever, esp before this century.
Of course I can. I don't know what you're getting at.
> Using a password manager
Doesn't solve the spam problem (which is what we're discussing here and the focus of my comment), and introduces its own problems.
I was referring to it as an adaptation of the way I do it.
Your way of doing it is introducing another hop/point of failure and either adds a subscription, or having your addressed e-mail public.
> Doesn't solve the spam problem (which is what we're discussing here and the focus of my comment), and introduces its own problems.
I don't have a spam problem. Get an ISP or mail provider with some decent filters. Mine's been stopping spam since the '00 or something. Sometimes the spammers caught up, but only very temporary. I don't have a spam problem. I use the + to figure out how people (ie. marketeers/bots) got my e-mail address.
Also, a password manager does not introduce any meaningful problems.
A service like yours would certainly have no trouble noticing the fact that the MXes all have the same IP address as Mailinator, but, right now, anyone can just do a lookup and simple string comparison themselves, without paying.
This is one of the most pointless anti-abuse measures you could implement, since a Gmail account can be created in about 20 seconds with no identifying information.
Provided Google has a lot of info about me, they can probably tie those accounts to me anyway, but I'd rather not formally associate them with my public identity.
Ended up using Protonmail instead, which allowed me to register with username and password and nothing else.
Google knows who you are by your devices, IP addresses, browser signatures, cookies, and other metrics. They don't need to verify your identity anymore, in fact they could probably tell you things about yourself that you don't even know.
Sending legitimate email becomes increasingly frustrating, yet spammers still to find their way to our mailbox.
Mailinator is a hack to workaround the spam flood. But for trustable business, the anonymity of the disposable addresses is a big problem because it is not possible to start a marketing process (if you register for a trial, for example, you should be "paying" with your email to let the company start a marketing process. Marketing for a service you have registered is not spam...). More and more companies deny registration from Disposable Email Addresses. Because these users are worthless.
Spam is a plague that hurts good users and trustable business.
Sympathetic customer fallacy. Figuring out how to get new paying customers through the door is not the problem of everyone who considers trying your product. Expectations that trial users should "pay" by taking on the burden of having to tell your marketing department to go away if they aren't interested enough to buy it on their own initiative is reality denial. Obviously people aren't going to do that, and spending effort trying to "disposable-email-proof" your trial system is a bottomless pit into which you will pour money for all eternity. People are actually paying money to the disposable email companies to have them actively combat you. You will never complete that project and you will never be able to stop spending on it.
Ideally your trial is persuasive enough to have a steady trickle of people decide to buy the full product, but not so generous they feel that they'll get the full experience by cycling disposable email addresses. Finding that balance is the responsibility of your business, no one else will change their behavior to do it for you. If you can't find it, maybe that's a sign that you've made a product that maps poorly to sustaining a business. One might call this the "bittorrent inc" strategic mistake.
Always remember to stay grounded in reality.
In this case, certain norms of conduct in business do exist, and they do often serve all market participants, and businesses have every right, and often succeed, in enforcing them.
I’m not sure about the specific example here, as I happen to live in a jurisdiction where it’s illegal to follow up on a trial subscription with endless marketing emails. But, as just one example, cancelling an appointment you can’t kept us not just “sympathetic”. It’s basic manners, it improves life for everyone (including you), and nobody would be surprised that not following the norm could get you banned.
Rejected. You don't get to declare norms by fiat, sorry.
>It’s basic manners, it improves life for everyone (including you), and nobody would be surprised that not following the norm could get you banned.
Manners are for humans to humans. I don't feel the need to be polite to a trial subscription system. It's a piece of software, it won't feel bad if I don't respond to its mails later on.
One of the things that I think people have a hard time grasping is that for a lot of software, the marginal cost of a user is approximately zero. People get stuck in a scarcity mindset and get really upset at the notion of freeloaders getting away with something.
This is in sharp contrast to the abundance mindset you see in most open-source software. How many people are Linux freeloaders or Mozilla freeloaders or Gnu freeloaders? Hundreds of millions, and once you count devices, maybe billions. But as long as those outfits can pay the bills, they don't care.
The funny part to me is that so many people trapped in scarcity thinking only care about getting paid, not paying others. How many of those people trying to capture every dollar of generated value are using open-source tools in what they're selling without giving back? Most of them, I'm sure.
From a legal standpoint, this is broadly true, but I'd say from a user's perspective, this is only very narrowly true.
For example, if I'm receiving an advertisement for a product that I "freely" trialed but subsequently rejected, I perceive it as spam.
Reputable companies provide an "unsubscribe" feature that actually works, but it's impossible to determine a priori which companies those are, and, more importantly, if they'll still be that way when that first e-mail arrives.
Really, the most trustworthy behavior would be to assume I'm consenting to precisely one follow-up email regarding my free trial, rather than an open-ended subscription. Until that's either industry standard or regulated (in a way where individuals can easily recover money damages), then I'm still using disposables at first contact.
> More and more companies deny registration from Disposable Email Addresses. Because these users are worthless.
Encountering a company like that, I assume they believe the second assertion to be true because the sole value of the users is as advertising eyeballs due to the product trial itself demonstrating no value. In that case, I don't bother.
I will, however, usually make at least a modest effort to try a few non-Mailinator disposables.
Although Mailinator has alternate domains, they've made themselves very easy to block, because a simple DNS query reveals the MX to be mail.mailinator.com. Just one more level of obfuscation (e.g. making the MX for streetwisemail.com be mail.streetwisemail.com and just have the same IP as mail.mailinator.com) strikes me as a good Pareto-principled step.
Agreed. I understand that marketing people perceive getting an email address once as permanent consent to basically anything. But I think this is pathological. People who behave like this in any other context are obviously abusive. That even includes some marketing contexts. If you try a free sample at Costco, nobody follows you around the store badgering you until you explicitly tell them to leave you alone.
I get lots of email about things I don't want -- vendor spam from AWS conferences, etc. I even call it "spam" when I talk about it. However, it feels _really disingenuous_ to also want it to be classified as spam. Sure, it's unwanted, but _I did sign up for it_. That's pretty much an implicit agreement when you go to a trade show. ("Let us spam you, and get a T-shirt!" "oo, that one has an awesome looking octopus [evident.io], okay!") In almost every case, their service isn't right for me. I'm happy to tell them that at the booth, and explain why I don't feel we need your Enterprise Scale Thingamabob.
When I get those emails three months later that I don't want, I don't feel comfortable marking as spam. I'd much prefer to unsubscribe.
That said, I'm having trouble with this seeming contradiction:
> Sure, it's unwanted, but _I did sign up for it_.
Maybe "want" is too strong a word, but you certainly knew you were willing to tolerate it when you did sign up for it.
Conversely, when I'm at a trade show, because I find those emails truly unwanted (and actually intolerable from vendors in whom I have no interest), if I've registered with a real e-mail address, I don't share it just for the octopus t-shirt.
I routinely see marketing e-mail that I want to see erroneously auto-sent to Spam by Gmail. Since this has even happened for infrequent explicit-opt-in lists, I have to conclude there's no such thing as a "local" filter there.
It would merely be evidence that there's a datum of "spam: From:LinkedIn To:mmt" going into the global filter database and that matching both From and To is sufficiently strong evidence to that global filter.
If you start marking someone's emails as spam and their emails start automatically landing in your spambox but not everyone else's, then obviously they do have localized filtering. They almost certainly do because some people actually like to receive "newsletters" and junk mail to clip the coupons or whatever.
You imply that this distinction doesn't matter, but I assert that it matters very much.
The difference is that a local filter can reasonably be expected to exclude any remote (to my domain, for example) "localized signal" when making a decision, whereas to a global filter, there's no such thing as "remote".
Looked at another way, imagine mmt.example.com with 10 users and mcbits.example.com with 800 users are both served by gmail (and we're the first two early adopters). Then imagine none of my users ever mark From:LinkedIn mail as spam (and maybe even mark it as ham in some way), whereas 25% of your users mark From:LinkedIn as spam and the rest merely ignore it (never marking it as ham, though perhaps reading it, mark-as-read-ing it and/or labeling/archiving it either manually or with a filter).
With two local filters, I would expect my users never to have to search their Spam folder for message from LinkedIn. With a global filter, I would expect the relatively small quantity of relatively weak data indicating From:LinkeIn is ham (which happens to be associated with "localized signal" of instances of "From:@mmt.example.com") to be overwhelmed by more numerous strong signals from your users that "From:LinkedIn" is spam and for my users to have to check the Spam folder for messages from LinkedIn at some point.
The latter is what I have observed actually happens.
That doesn't preclude the global filters from also occasionally binning some of LinkedIn's email when the global spam score is so high that the local ham score fails to override it. And the same thing could happen whether they implement it as a hierarchy of filters or just one filter with localized signals.
> I would expect email from LinkedIn to be far more likely to be automatically marked spam for those 25% of users who have previously marked those emails as spam.
This is true regardless of whether or not the filter is global or local, though. That 25% provides the majority behavior for both a local filter and a global filter.
> That doesn't preclude the global filters from also occasionally binning some of LinkedIn's email when the global spam score is so high that the local ham score fails to override it.
It does preclude it, because with a truly local filter, those people are a majority (unanimous, even). Even occasional miscategorization as spam would be completely unexpected. It's only when the filter is global do they end up subject to tyranny-of-the-majority behavior.
However the danger is that some of these are fake, and you might not remember what you signed up for. Then, the spammer knows that you clicked that link. They may learn to know your IP address, dox you further, etc. Or, worse, they can attempt to breach the security of your computer via your browser (0-day or otherwise).
A way to deal with this is using the + sign. Whenever you share your e-mail address knowingly, add the + sign with the address name sans (cc)TLD. Whenever someone e-mails you without the + sign they either harvested that address or they got it from you directly. So when you receive a spam e-mail you'd like to unsubscribe from not addressed to your + e-mail address, don't unsubscribe. You never signed up for it in the first place.
Oh, please. Of the two, the former is the only one that really matters here.
I know where you are coming from, but I don't think I've ever heard it said this way. Do you have any resources that talk about free trials or fremium in these terms?
Is the value in that email mostly in the ability to market to the individual behind it, or is the value only in its ability to be sold and/or cross-advertised to?
Personally I would say that any user who didn't sign up is "worthless" (given the context you are using here), whether they gave you a disposable email address or not.
Mail people don’t want to receive is spam. You do not have a right to send anyone anything they don’t want. If your business model depends on that it’s going to fail.
So long as you can keep track of literally billions of counters in real time, you can effectively combat spammers.
Source: MailChannels CEO
[1] https://neo4j.com/blog/fraud-prevention-neo4j-5-minute-overv...
The rest of the spam is done using compromised computers but once that's done the ISP of that provider gets quickly noticed and either the ISP blocks that customer or they themselves get blocked wholly due to their inaction. So they choose eggs for their money (as the Dutch saying goes).