3 ms·
It's arguably the case that Firefox Relay is no different from the other services in this list. If someone can use it to create ~unlimited identities for almost
by bastawhiz 5y ago
It's arguably the case that Firefox Relay is no different from the other services in this list. If someone can use it to create ~unlimited identities for almost free, that serves the same purpose as any other disposable email service.
And frankly, there's no sense in getting upset about a directory of services that allow the creation of unlimited disposable identities. If it wasn't this github repo, it would be another. As long as there's demand for lists of these services, the lists will exist.
And why do folks want lists of these services? Because they're a massive nuisance: folks avoid paying for services and abuse free services with spam (or worse). This isn't to say that businesses shouldn't support their users in being privacy-conscious, but the unfortunate fact of the matter is that Sybil-esque attacks are costly to businesses (time, resources, reputation), sometimes to the point of being existential threats. Many businesses have no choice but to make _some_ tradeoff between user-friendliness and revenue/operations cost.
My own business was absolutely _flooded_ with spam until I started blocking most popular disposable email services. I built tools to help detect and mitigate the spam, but it was purely reactive. I was spending more than half of my time fighting spam instead of working on the product.
The reason these services work for privacy-conscious folks is because they're convenient. But that's the same reason they're useful for malicious actors: nobody wants to spend the time to set up a new gmail account. The (time) cost of establishing the identity is what makes it hard to use for abuse.
There are obvious potential solutions. The first is for services like Firefox Relay to allow abuse reports. If I see spam from a Firefox Relay user, I should be able to report it and have it count against them. Any legitimate service should hold its customers to some responsible use guidelines, and if they break those rules, there should be consequences.
Another is that identities should not be "free". I disagree with Mozilla's pricing: $1 for unlimited identities is practically begging for bad actors to use the service. Setting limits or scaling the cost of the service (more identities per unit of time costs more, or throttling identity creation) makes it harder to abuse services with those identities. Almost no legitimate users actually need truly unlimited email addresses, and the ones who do can very much afford to pay more than a single dollar. Even generous limits would help to avoid many problems.
I'm generally bearish about crypto and blockchain technology, but I can also see how using it for identity would be super beneficial. There's some cost to establishing the identity, and you separately can use a (~worthless) disposable email for communication. The identity is worthless to "leak" and isn't useful for marketers.
- Nextgrid 5y agoI find that the services most vulnerable to sybil attacks are malicious ones funded by "growth and engagement" - see my comment above: https://news.ycombinator.com/item?id=29960340 https://news.ycombinator.com/item?id=29960340 If you charge for the service, a lot of attacks suddenly become pointless or unprofitable, implicitly mitigating the problem.
- bastawhiz 5y agoI'd say you're wrong. My business is just me, and I offer a free plan to let folks kick the tires. My biggest competitors charge nothing for their services, so I can't compete if I don't offer a free plan. I don't think you could produce data that shows what you're suggesting, and in fact I think the reality is that the opposite is quite true. Any business that offers trials or free options is vulnerable to abuse, and any amount of abuse will eventually begin to eat into business resources. And business who do charge for their products don't have the "growth and engagement" money to burn on bad actors.
- Vinnl 5y ago> Setting limits (...) makes it harder to abuse services with those identities. Almost no legitimate users actually need truly unlimited email addresses (...). Even generous limits would help to avoid many problems. Note that Relay already rate-limits customers: > we limit our free users to 5 total aliases, and we rate-limit our premium customers so they cannot create large-scale throw-away aliases for abusive sign-ups and behaviors. https://github.com/wesbos/burner-email-providers/pull/339 https://github.com/wesbos/burner-email-providers/pull/339
- trestacos 5y agoI think another option here is for email masking services to allow other services to ask if a user has registered at their site before. Details: https://dev.to/stephensisk/throwaway-email-blocklists-want-to-block-firefox-relay-heres-an-alternative-470f https://dev.to/stephensisk/throwaway-email-blocklists-want-t... I'd be happy to work on building that for my service if someone is interested in using it. I think your point about mozilla's pricing being too cheap is an interesting one. I don't think of the pricing as $1 - I think it as $1/month, so it builds over time. But clearly it would be a bigger deterrent if it cost more. I think blocking these email masking services and treating them exactly like throwaway email services is the wrong way to go since I think a lot of users want to use something like this. (discloure: I'm working on https://www.thxnothx.com https://www.thxnothx.com which is also an email masking service combined with some other features)