Hacker News Reader

Comment by 8organicbits | Hacker News Reader

I'm always a little suspicious of these services. People use them to create throw-away accounts, which they abandon after one use. Those accounts remain active and are useful for botting (vote manipulation, comment spam, etc). Whoever owns the email domain can do a password reset to do an account take over.

I'm curious about the privacy policy. The title says that you don't have ads, but there's tons of discussion about sharing information with ad partners.

View on HN

Yes, just like all other email providers nothing is encrypted and you could totally look at the emails.

The difference here is though that there's nothing of value.

If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon.

I like that you bring this stuff up though as it could perhaps be good to mention this on the site down at the FAQ so people don't think I'm doing something shady with the service since there are no ads.

> If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon

Or spinning up hundreds of accounts on a website so you can perform card testing. Or creating accounts so you can put all of the inventory for an e-commerce site into carts to reserve it for yourself. Or running sneakerbots. Or any other malicious intent where the victim is the website operator.

Again, wouldn't it be easier for the attacker to just buy a domain and use that completely undetected instead of having to use a rate-limited disposable email service?

You're assuming they're doing it hundreds of times a minute. Often they're signing up for the accounts by hand to get through the captchas. The rest of it can be automated

That's what I would assume most of them are doing, yes.

In this day and age I don't understand why they wouldn't be able to just use a headless browser instead of doing it manually - has labor really become this cheap?

Captcha and rate limiting solutions are extremely good at stopping completely automated signups. It's far easier to pay someone in India a few bucks to sign up for a hundred accounts so you can do card testing than it is to run a server and write software for it. Hell, most of these people probably aren't even programmers.

I think that's for the small players though as this should be pretty slow, expensive and have the risk of the "employees" stealing the data (the business they are in is practically stealing so I don't think they have high morals).

> People use them to create throw-away accounts

A separate use case is when there's a free download that's email-gated, rather than account-gated. Examples would be Gumroad, certain 3D print platforms and such. I'd rather not wind up having my email just be added to some marketing list.

If I'm using a temporary email service, I'm using it specifically because I don't care if the account gets taken over, though.

Oh, the threat isn't to the user. They don't care about accounts they have abandoned. The threat is to services that suffer vote manipulation, spam, etc. The benefit of this approach is that you've got a bunch of abandoned accounts that were organically created (captchas solved, residential IP ranges, etc.)

I don't think there's any value in that though.

You can get all the stuff you mentioned for a fraction of the time and money it would cost to create a disposable email service and then you would also only target the service you wanted instead of sitting around and hoping that a user creates an account at the site you're looking for.

The real value would in the reputation and history of the account (e.g a popular account on a social media site or community) and this isn't a thing that someone would use a disposable email service for as they wouldn't want to risk losing access to the account.

There's a whole industry around detecting these and placing them on block lists.

Could you recommend a few solutions or companies? I'm looking for such a solution at the moment. Thanks!

This discussion isn't going in the direction I was hoping for, ha ha!

But as a developer of these sites I've used the majority to check my own domains and the most reliable one I've found is https://www.ipqualityscore.com/

I strongly recommend that you take another look at your signup process though and don't require users to give up their email addresses, instead make it optional and present an alternative like a captcha.

verifymail.io is a pretty decent source, though I don't know what they charge for API access.

I've never evaluated any myself, but became acutely aware of them after launching my own temporary mail service as a learning exercise. I think there's a github repo somewhere that's regularly updated with a block list of these cycled domains though.

There are plenty just like there are IP lists for VPNs.

Feel free to share a link to your service as I'd love to check it out and best of luck running it also!

they're honeypots.

Reply on news.ycombinator.com