Hacker News Reader

Comment by mst | Hacker News Reader

Assuming you have the technical capability, requiring an email address and confirmation for only tor users could work.

Freenode does something similar - tor and other problematic traffic sources can connect but must use connect time SASL to authenticate to a previously created account, which is sufficient to exclude the vast majority of the griefers.

View on HN

At least right now – I suspect the intersection of "TOR users" and "people happy to provide email address confirmation" is so small as to be insignificant. Any development effort aimed at that cohort could almost certainly be better used elsewhere.

Having said that, I'm currently trying to make a point of using TOR for regular and mundane uses - particularly if using government sites - just to increase the amount of "legitimate" tor traffic. I'm also (carefully) intentionally de-anonymising myself while using tor like this - identifying myself to local government websites while doing "ordinary" things while connected over TOR - I booked an extra trash collection recently for example. I don't suppose my local council website managers even notice, but I like to think my local PRISM equivalent operators see traffic like this and think "WTF?" ;-)

(But like the parent-poster, I've suffered forum-trolls, and given the time and skill poor nature of most forum owners, the obvious "just ban free email accounts/tor/cellular-ip signups" is often the right, if overly broad hammer.)

FreeNode's use is a bit more extensive than just requiring an email address - you have to create the account from a non-Tor IP, so if you do something bad and get banned, they ban the account (thus preventing further access from you via Tor) and then also have the option of banning the IP that registered the account (preventing it from registering further accounts that will be abused via Tor). If they really want to, they can also ban the email address, but in practice this really isn't worthwhile as it's so easy to get a different one.

What good would email address confirmation do? You do know about mailinator, right?

Most sites that have issues with trolls and find IP blocks insufficient can also block on mailinator and similar domains.

No, they attempt to block similar domains. And completely fail at it.

I never use my main email for anything I don't feel requires it, and while maininator.com is often blocked, I've never in my life had to refresh the mailinator page more than twice for an alternate domain that works. Since mailinator accepts email from any domain that has it's MX record set to it, if you own a domain you can set it to be an alternate name to mailinator in seconds. Enough people have done this.

No, it's actually super easy to block it if you're clever enough ;)

Could you point me to a site that does successfully block it?

There are tons of lists that are regularly updated that list all published mailinator.com domains. While it's true you can set up a new one on a subdomain of your own, as soon as you publish it to mailinator and it enters the rotation of the domains that come up, it's easily added to the lists and blocked. There's even a commercial live list with plugins for most email systems that blocks on any of the hundreds of mailinator-listed domains as well as over a thousand other disposable email domains.

Heck you can just write a script to refresh the mailinator.com homepage to start pulling out domains to block: @veryrealemail.com, @chammy.info, @mailinator2.com, @spamthisplease.com, @sogetthis.com, @mailinator.net, @binkmail.com, @sendspamhere.com, @spamherelots.com, etc.

Reply on news.ycombinator.com