Hacker News Reader

Comment by snowpanda | Hacker News Reader

>Anti Abuse API

Why does your company consider disposable email addresses abusive?

Some people use DEA to abuse of trial services of SaaS, for example. They register again and again after the trial has expired. These users consume resources but they never effectively become customers. Some companies ban users using DEA, anonymous proxies, TOR, VPNs... or even Free Email addresses (the conversion rate comparing a user registered with his or her company email and a Free Email (gmail, hotmail, protonmail...) is much higher).

> They register again and again after the trial has expired

This is great! You have users who are using your product, how could you not be happy? Find out why they are not converting, perhaps your offer isn't that great for their demographic? Note that even if they didn't pay to your service, they may be your biggest fans who may recommend your product to other people. DEA users are usually tech-savvy types, they are also the kind of people who are the early adopters when it comes to tech (since they were able to figure out how a DEA works & how to use one), and are probably the ones who normal people go to get advice. Don't forget that even if not a paying customer, they are still a customer in the sense that they could review your service or refer others through word of mouth! If you're blocking DEA services, it may end up costing you more.

That's a whole lot of "what ifs". I'd rather just block people that are consuming resources and potentially affecting service levels for actual customers (or people that will actually convert). The situation you paint might be true of a very small percentage. But more often than not it's just people that want to use something without paying for it.

> want to use something without paying for it.

So don't let people use your services without paying! A trial is only a trial if it locks or stops the user from using it after a trial period. Freemium models that limits number of uses aren't a trial.

The trial does stop the user from using it after a trial period. If you want to fault anything, it's using an email address to equate to a user. Fine. I'm guilty as charged. But, it's pretty common. Most legitimate users of a service want as frictionless a setup as possible.

Ultimately, my solution was to start requiring a credit card at sign-up. Shockingly, not a single mailinator.com address was used from that point forward and my conversion rate barely changed. But, it sucks I had to do that. There were people that legitimately wanted to try the service out that were put off by requiring a credit card so early. I personally hate providing a credit card for a service I haven't even tried yet.

I appreciate your reply, but I think it's an entirely toxic mentality. My business model isn't freemium because you could game the trial process (and violate the terms of service). And I shouldn't have to grossly restrict the trial to deal with mailinator.com sign-ups. Say what you will about mailinator.com, but it was hands-down the largest source of abuse of my CI-like service. Everyone else played by the rules and enjoyed a liberal trial to get familiar with product.

Why not make the whole business model "pay what you want"?

But no one stops you from getting a domain and effectively creating infinite email addresses to register

Virtually no one does this. If their own laziness is enough of a hurdle for them to not bother, I'm fine with that.

Actually I do. I bought a domain of my shortened initials and this domain catches all the emails sent to it. Every entity gets a custom address: bank@my-in.com, ikea@..., Etc.

It's very useful

I use Fastmail's subdomain addressing [1] to sign up for services in a very similar manner. I'm certainly sympathetic to bad services abusing the privilege of having your email address. My contention is that while this is the purported benefit of mailinator.com, in reality many people use it to abuse services.

In other words, there's a big difference between using ikea@ and saastrial1@, saastrial2@, saastrial3@,.. and so on to keep signing up for trials with the same SaaS provider.

[1] -- https://www.fastmail.com/help/receive/addressing.html

Do you still lock your doors at home, even though a thief could simply throw a rock through your window?

You effectively have unlimited (not infinite) e-mail addresses with Gmail and many other e-mail providers by using the + sign. E.g. fibers+HN@gmail.com

Except sites that mistakenly disallowed the + symbol.

Also, it's very easy to mechanically identify all such users because of the + symbol, which, if you are trying to prevent your real email address from revealed means it's not that useful...

Regarding the former, my ISP allows me to set forwarding email address. I could temporarily use these until X date or until they receive (a lot of) spam. Though all spam gets filtered anyway.

Regarding the latter, when they email you directly without the + you can be very strict. You could even apply whitelisting.

Presumably they don't block [.] however, and since gmail ignores it, you can always just use t.estexample@gmail, then te.stexample@gmail, etc.

I am well aware of that feature gmail has and have abused it in the past with many websites, but the parent said that some SaaS platforms block gmail altogether. It seems like a shoddy fix if you can get a really cheap domain and essentially do the same to register accounts.

Yeah, its like putting extra locks on the front door while the back door is wide open. However, most people would try the front door first.

A lot of domains have that feature btw. Gmail's specific feature is with the dots functioning as catch-all [1] (though Facebook apparently has the very same feature).

[1] http://www.slate.com/blogs/future_tense/2013/08/01/dots_in_g...

It's really a shame when online services make overly broad generalizations like this. I use disposable email addresses for all of my services, because they are the most effective way I've found to manage spam. (They also have the side benefit of a little added security when someone hacks Site A's account database and tries to use the email addresses to log in to Site B.) When a potential provider tries to coerce me in to exposing my keeper address, it signals to me that they (a) put their own convenience before my security, and (b) don't have a particularly good understanding of the internet. For both those reasons, I take my business elsewhere.

Even worse are the sites that happily accept disposable email addresses and claim to send a verification message, but never actually send it. This wastes my time with rummaging through spam filters and polling my inbox, wastes their time when I contact support to find out wtf is going on, and is generally just (c) a terrible experience.

In my opinion, you're doing things backwards.

Your modus operandus means you cannot share your e-mail address whereas my spam filter is so good that the amount of false positives and false negatives is negligible.

> (They also have the side benefit of a little added security when someone hacks Site A's account database and tries to use the email addresses to log in to Site

Using a password manager plus randomly generated, complex passwords mitigates that problem entirely insofar that your accounts can be used on different websites.

Both our solutions do not mitigate the doxing issue. A way to deal with that is removing your personal details whenever they're unnecessary (e.g. changing/removing them after you ordered something). Artifacts might still remain though, and faking them is probably illegal. It can lead to issues as well. My mother always gives a fake DOB akin to her own when she doesn't trust it, or gives a slight variant of her name. Then she knows something is wrong. Pretty clever, esp before this century.

> Your modus operandus means you cannot share your e-mail address

Of course I can. I don't know what you're getting at.

> Using a password manager

Doesn't solve the spam problem (which is what we're discussing here and the focus of my comment), and introduces its own problems.

> Of course I can. I don't know what you're getting at.

I was referring to it as an adaptation of the way I do it.

Your way of doing it is introducing another hop/point of failure and either adds a subscription, or having your addressed e-mail public.

> Doesn't solve the spam problem (which is what we're discussing here and the focus of my comment), and introduces its own problems.

I don't have a spam problem. Get an ISP or mail provider with some decent filters. Mine's been stopping spam since the '00 or something. Sometimes the spammers caught up, but only very temporary. I don't have a spam problem. I use the + to figure out how people (ie. marketeers/bots) got my e-mail address.

Also, a password manager does not introduce any meaningful problems.

Tons of trolls use disposable email addresses to register multiple accounts for forums and similar to harass others. I block most of the popular mailinator domains for my larger public forums (200k+ users).

Reply on news.ycombinator.com