3 ms·
> Isn't there a better way to fight bots? Don't? I mean, what are you trying to protect? If it's account registrations, shouldn't an email confirmation be eno
by floatboth 7y ago
> Isn't there a better way to fight bots?
Don't?
I mean, what are you trying to protect? If it's account registrations, shouldn't an email confirmation be enough?
- Kaveren 7y agowhy would an email confirmation be enough? playing whack-a-mole all day with different domains is unreasonable. whitelist only of domains is awful, and botters have tons of popular email accounts.
- folkhack 7y ago> If it's account registrations, shouldn't an email confirmation be enough? This won't stop someone with enough sophistication.
- floatboth 7y agoNot every service will be targeted by sophisticated bots. What kind of service are we talking about? Is it even social? Is it even a service or just a public website? OP did not provide a threat model or any description of the service really. Talking about this "in general" is awful and leads to stupid bullshit like endless CloudFlare captchas on literally STATIC blogs.
- zeroxfe 7y agoE-mail confirmations are easy to circumvent.
- midnightmonster 7y agoPlus if your app will send email to any address someone submits without even rate limitations, your domain reputation can take a hit for sending to fake addresses.
- gaieges 7y agoFamiliar with email aliases (ie user+words@gmail.com)? Easy to have infinite addresses and yet a single mailbox with automations upon receiving the confirmations.