Hacker News Reader

Comment by Spivak | Hacker News Reader

We did, it's called non-disposable email. A non-unique pseudoanonymous identity that's somewhat difficult to mint in bulk.

If you don't like "accounts of well-known service providers" -- email or login-with-whoever then sources of identity that "everyone" has that are hard to get many of are government ids, phone numbers and credit cards.

Like what else is there? For super technical people we could do something like "proof of bitcoin address" where we verify control of a wallet with some minimum long-standing balance. We could make you submit a recording of yourself saying some random phrase and then do some facial recognition to detect duplicates. IP banning hasn't worked since the 90's.

View on HN

I don't really get this. Where do you draw the line between disposable and non-disposable email? What prevents anyone from creating <random string>@gmail.com addresses?

The phone number requirement?

See my other comment. Gmail was bad example, outlook has no restrictions.

You need a valid phone number to create a gmail account, and you can only have a few accounts attached to the same number. Google is "trusted" because they actively try to prevent spammers from joining their platform. Disposable email platforms don't, they let you create as many as you like.

Ok my bad gmail was not a good example. Lets go with outlook account then. Just tried and it definitely doesn't need phone number. And I wouldn't consider outlook disposable platform.

At least a third of spam registrations on a platform I run come from Gmail addresses, with another third from yandex and yahoo. They also all went away after we implemented a nearly trivial captcha in the registration flow.

Seems to me that 1) Gmail accounts aren't that hard to farm 2) most spam comes from free webmail providers not disposable email and 3) a captcha will solve most of your problems and if it doesn't, it means your site is being specifically targeted by someone with cash to burn, so you can assume that they'll have emails that aren't on the blacklist. At that point, invest in detection and moderation.

>You need a valid phone number to create a gmail account

This is 100% not true. Yes, the main site will require it, but there are legacy "portals" that allow signup without a phone number. No, I won't link to said portal.

Nothing, but if you try to create 1000 of such emails you’ll get banned by Google.

A normal user wouldn't make anywhere near that many and to a bot developer, "banned by Google" doesn't present even the slightest of challenges. Source: I develop web scrapers for many sites that really don't want to be scraped, including Google/Abc properties.

Sometimes it's hard. We try to keep our little list useful but it can never be a full solution -- I hope it cannot ever be and people value their privacy enough to not give up the freedoms of internet and TCP/IP.

As of gmail -- one of the guidelines for the list addition is whether you need to go through some sort of a registration. If you do then it is usually not treated as disposable by us.

Reply on news.ycombinator.com