TemporaryMail

Got it, that makes more sense and could actually make your inbox more private as the email provider won't be able to snoop into your emails to gather data to "make your ads more personalized".

I'll look into this now that it makes more sense, thanks for the advice!

Can you give me an example of who would be sending you emails with PGP though to your disposable email address and why?

Thanks for the advice and I'll look into supporting email forwarding, but I'm not sure why users would need PGP.

Exactly, that's the site I had in mind although I'm pretty sure it had another name before (could perhaps also be the reason to why I didn't find it in the first place).

Got it, this could perhaps work and the downside would however be that the user wouldn't have complete control over the domain, unless DNS control is provided and before I can say the word, I'd be a domain name registrar.

I think it's cool idea though and I might give this a shot, thanks for the idea and if I do implement this then feel free to contact me through the form and I'll set "lifetime" account up for you!

If I'm not misunderstanding you, the same should go for aliases as they will be flagged as disposable addresses as well. I also noticed that Addy allows users to send emails through it, which is a risky process as it requires close monitoring so spam isn't sent out through the service.

I will take a closer look at this and see if it's possible to improve it in some way.

Thanks for the kind words also and the same to you! =)

I think that's for the small players though as this should be pretty slow, expensive and have the risk of the "employees" stealing the data (the business they are in is practically stealing so I don't think they have high morals).

I think that completely depends on what the service is, but I don't think users would have anything against paying a few dollars if they find the service valuable, especially now when there are so many payment processors available.

Best of luck with the service also!

I'd rather fill out a captcha when I sign up than having to drag emails to spam on a daily basis so I can find emails that are actually important.

There are plenty just like there are IP lists for VPNs.

Feel free to share a link to your service as I'd love to check it out and best of luck running it also!

Right, that actually sounds like a decent idea and since the users would then have verified themselves with their payment details, it would reduce the risk of abuse.

That's what I would assume most of them are doing, yes.

In this day and age I don't understand why they wouldn't be able to just use a headless browser instead of doing it manually - has labor really become this cheap?

That's funny in a bizarre way.

Imagine having to tell someone that you can't access your accounts because you retweeted something that wasn't deemed acceptable.

Perhaps if we're lucky we will advance to having the big corps create a social credit system for us as well, ha!

It's a great service that I used myself many years ago and I was sad to see them shut down, but it seems as though they are back now.

I'm not sure that's a great solution though, because all the domains would use the same mail server which would basically instantly flag your domain and all your addresses as disposable.

In your ideal world we would be all be:

- Be hooked to a bunch of paid plans for stuff that's currently free.

- At the mercy of all the big providers that could one day just decide to turn our account off without a reason.

- Receive more spam than we currently do as all service providers would have our email addresses. Although these would all be aliases, we would have to spend a decent amount of time organizing folders, identifying which aliases that are receiving the spam and turning these off without losing access to the account.

I referred to your other points in detail here also: https://news.ycombinator.com/item?id=40968143

I really enjoy that you challenge my views on this though as we both have the same goal of stopping abuse on online services, while at the same time preserving user privacy. Your plan would work if all service providers were honest and didn't abuse your trust, my plan currently works and I'm no longer getting emails from politicians asking for donations.

> I honestly am very concerned you are releasing this with clearly... no understanding of the Internet abuse space.

I've given this some thought over the years so I know where I stand morally. As I've mentioned several times already, the issue lies in the service provider for forcing the user to give up their email address, in the majority of cases it will end up with you receiving spam from many different sources as your address will be sold, leaked and more.

>good luck

Thanks for the motivation!

> Make sure your cloud service allows what you're doing, make sure you have cost controls in place, and make sure you already have a relationship with a good lawyer.

Yeah, it's an expensive service to run (if you want to run it properly at least), but as long as it helps users and I see people sending in positive comments through the contact form, it will give me the motivation to continue.

A close friend of mine is a lawyer also so the day it becomes illegal to receive emails, I'll have to give him a call.

>Trials usually both restrict features like this and require valid payment info is already entered

That's good at least, but what I'm trying to say is that anything can be abused, the same way that the

>having websites all ask for people's phone numbers is way more privacy-invasive

It costs sites way more to send out texts than it does to send out an email, I'm sure that if we were to look at the overall amount of spam one receives in their lifetime, then we would see a great decrease. It's also a lot easier to stop spam coming from phone numbers as they are all registered and regulated compared to emails that aren't.

> you can keep your inbox clean without disposable email

You can also walk to the destination without taking a car, you can get fit without going to the gym and you can cook a meal without a recipe, but it won't be as convenient.

---

I'm starting to sound like a broken record as I'm just repeating myself, but to summarize things, we are both on the same page as our goals are to stop spam to users and abuse of services. The majority of the times an email address shouldn't even be needed and when it comes to sites where spam is more prevalent (e.g you mentioned The Verge), then they could simply verify your phone, payment details and a ton of other measures (captchas, checking IPs, rate-limiting, etc).

> Fastmail can investigate the abuse you are involved in and can suspend your account.

What if the Fastmail account is simply just using their free 30 day trial, how will they track the user then?

My point is that the malicious user will still have a way, while the legitimate user is punished by having to pay a fee to the email provider.

> Every time someone like you thinks this is okay, you make more service providers lock down what email domains they accept, punishing folks like me who just want their own domain on their email.

How about no one gets punished and service providers verify phone numbers instead of emails and we get to keep our inboxes clean?

That's great advice and although there's already an open source solution available, there's some hassle involved in setting it up.

I will definitely look into these solutions and although I've seen some of them around, there could maybe be a way to implement a better alternative that's both easy to use and safe so it doesn't get abused.

That's another way yes and I've actually seen another site do this, but I wasn't able to find it in my browser history.

Thanks for that comment, refreshing to read amidst this war zone of a comment section, ha ha! :)

Take a look at your network requests though, there isn't a single third-party script running on the site.

I understand what you mean, but it has to apply to the use-case. If the service I was running was to support journalists, then I would agree with you, but taking these measures would help promote spam as users would be able to get around the rate-limiting that I've set.

>Aliases you can discard are ad blockers for emails, disposable services are for bots, scams, and fraud.

What is the difference between the two though?

This kind of reasoning is why people can't run their own email servers anymore and instead have to rely on the big services.

>If you know the space, you'll be aware CAPTCHAs are trivially defeated today, regardless of the provider.

They are a lot more reliable than an email which is basically just a domain that anyone can buy and setup within mere minutes giving them access to endless email addresses.

>you generally need some sort of unique relatively hard to get many of identifier

Why not use phone numbers instead if the issue is truly important to them? This would cost spammers and bots way more money than emails.

Perhaps it's due to the fact that they won't be able to use the phone number to send their spam (or they could I guess, but it would cost them some money).

Again, wouldn't it be easier for the attacker to just buy a domain and use that completely undetected instead of having to use a rate-limited disposable email service?

A) The connection is fully encrypted.

B) That would make the UX horrible.

C) I had Tor enabled in the beginning, but when I got complaints from people on Tor doing really shady stuff with it I had to disable it.

This discussion isn't going in the direction I was hoping for, ha ha!

But as a developer of these sites I've used the majority to check my own domains and the most reliable one I've found is https://www.ipqualityscore.com/

I strongly recommend that you take another look at your signup process though and don't require users to give up their email addresses, instead make it optional and present an alternative like a captcha.

I don't think there's any value in that though.

You can get all the stuff you mentioned for a fraction of the time and money it would cost to create a disposable email service and then you would also only target the service you wanted instead of sitting around and hoping that a user creates an account at the site you're looking for.

The real value would in the reputation and history of the account (e.g a popular account on a social media site or community) and this isn't a thing that someone would use a disposable email service for as they wouldn't want to risk losing access to the account.

I didn't know at first and it was hell as when I first delved into this I thought it would be a simple task as it would be some agreed upon standard like JSON behind the scenes, but from what I understood emails were created a long time ago and some providers did things differently.

The majority of the work was done through testing lots of emails and I must have sent at least a thousands emails to myself from different providers and sites.

I've deleted the bookmarks in an attempt to reduce the PTSD it caused, but I think the main one I visited was RFC 1341 as I had some difficulties understanding the boundaries and encoding.

What was really tricky is getting it to work with all the different types as some emails didn't have boundaries while others had them, some were encoded entirely in base64, some partially, some of them were just plaintext, others were HTML while some were mixed or even offered multiple versions depending on what the email client supported.

Best thing is honestly to try it out and just pick a random address and send a really tricky email to it, would love to see you break the parser and telling me so I can improve it.

No, I wrote it in PHP and I didn't want to get an angry mob after me.

I've been thinking about open sourcing it if anyone would want it, but right now the site has way too little attention for it to get any traction. It's a really neat script though and it's also just one file and supports all the different kind of emails (with/without boundaries, base64 emails, attachments and some other stuff).

True and perhaps more weight is being put into detecting these nowadays.

The only reason the service provider requires your email address is to access your data.