4 ms·

I really don't see how "determine unique legal identity" is such a requirement? What are you running, e-voting? If that's really what you need, the relevant ju

by 3np 5y ago

I really don't see how "determine unique legal identity" is such a requirement? What are you running, e-voting? If that's really what you need, the relevant jurisdiction is likely to have some adopted e-identity system. If not, go back and question how you can solve your issues with as little PIIs as strictly necessary.

Spivak 5y ago
We did, it's called non-disposable email. A non-unique pseudoanonymous identity that's somewhat difficult to mint in bulk. If you don't like "accounts of well-known service providers" -- email or login-with-whoever then sources of identity that "everyone" has that are hard to get many of are government ids, phone numbers and credit cards. Like what else is there? For super technical people we could do something like "proof of bitcoin address" where we verify control of a wallet with some minimum long-standing balance. We could make you submit a recording of yourself saying some random phrase and then do some facial recognition to detect duplicates. IP banning hasn't worked since the 90's.
- sahkopoyta 5y ago
  I don't really get this. Where do you draw the line between disposable and non-disposable email? What prevents anyone from creating <random string>@gmail.com addresses?
  - Spivak 5y ago
    Nothing, but if you try to create 1000 of such emails you’ll get banned by Google.
    - franga2000 5y ago
      A normal user wouldn't make anywhere near that many and to a bot developer, "banned by Google" doesn't present even the slightest of challenges. Source: I develop web scrapers for many sites that really don't want to be scraped, including Google/Abc properties.
  - josephcsible 5y ago
    The phone number requirement?
    - sahkopoyta 5y ago
      See my other comment. Gmail was bad example, outlook has no restrictions.
  - lategloriousgnu 5y ago
    You need a valid phone number to create a gmail account, and you can only have a few accounts attached to the same number. Google is "trusted" because they actively try to prevent spammers from joining their platform. Disposable email platforms don't, they let you create as many as you like.
    - sahkopoyta 5y ago
      Ok my bad gmail was not a good example. Lets go with outlook account then. Just tried and it definitely doesn't need phone number. And I wouldn't consider outlook disposable platform.
    - franga2000 5y ago
      At least a third of spam registrations on a platform I run come from Gmail addresses, with another third from yandex and yahoo. They also all went away after we implemented a nearly trivial captcha in the registration flow. Seems to me that 1) Gmail accounts aren't that hard to farm 2) most spam comes from free webmail providers not disposable email and 3) a captcha will solve most of your problems and if it doesn't, it means your site is being specifically targeted by someone with cash to burn, so you can assume that they'll have emails that aren't on the blacklist. At that point, invest in detection and moderation.
    - tmitech 5y ago
      >You need a valid phone number to create a gmail account This is 100% not true. Yes, the main site will require it, but there are legacy "portals" that allow signup without a phone number. No, I won't link to said portal.
  - martenson 5y ago
    Sometimes it's hard. We try to keep our little list useful but it can never be a full solution -- I hope it cannot ever be and people value their privacy enough to not give up the freedoms of internet and TCP/IP. As of gmail -- one of the guidelines for the list addition is whether you need to go through some sort of a registration. If you do then it is usually not treated as disposable by us.

by 3np 5y ago

Spivak 5y ago

We did, it's called non-disposable email. A non-unique pseudoanonymous identity that's somewhat difficult to mint in bulk. If you don't like "accounts of well-known service providers" -- email or login-with-whoever then sources of identity that "everyone" has that are hard to get many of are government ids, phone numbers and credit cards. Like what else is there? For super technical people we could do something like "proof of bitcoin address" where we verify control of a wallet with some minimum long-standing balance. We could make you submit a recording of yourself saying some random phrase and then do some facial recognition to detect duplicates. IP banning hasn't worked since the 90's.

sahkopoyta 5y ago
I don't really get this. Where do you draw the line between disposable and non-disposable email? What prevents anyone from creating <random string>@gmail.com addresses?
- Spivak 5y ago
  Nothing, but if you try to create 1000 of such emails you’ll get banned by Google.
  - franga2000 5y ago
    A normal user wouldn't make anywhere near that many and to a bot developer, "banned by Google" doesn't present even the slightest of challenges. Source: I develop web scrapers for many sites that really don't want to be scraped, including Google/Abc properties.
- josephcsible 5y ago
  The phone number requirement?
  - sahkopoyta 5y ago
    See my other comment. Gmail was bad example, outlook has no restrictions.
- lategloriousgnu 5y ago
  You need a valid phone number to create a gmail account, and you can only have a few accounts attached to the same number. Google is "trusted" because they actively try to prevent spammers from joining their platform. Disposable email platforms don't, they let you create as many as you like.
  - sahkopoyta 5y ago
    Ok my bad gmail was not a good example. Lets go with outlook account then. Just tried and it definitely doesn't need phone number. And I wouldn't consider outlook disposable platform.
  - franga2000 5y ago
    At least a third of spam registrations on a platform I run come from Gmail addresses, with another third from yandex and yahoo. They also all went away after we implemented a nearly trivial captcha in the registration flow. Seems to me that 1) Gmail accounts aren't that hard to farm 2) most spam comes from free webmail providers not disposable email and 3) a captcha will solve most of your problems and if it doesn't, it means your site is being specifically targeted by someone with cash to burn, so you can assume that they'll have emails that aren't on the blacklist. At that point, invest in detection and moderation.
  - tmitech 5y ago
    >You need a valid phone number to create a gmail account This is 100% not true. Yes, the main site will require it, but there are legacy "portals" that allow signup without a phone number. No, I won't link to said portal.
- martenson 5y ago
  Sometimes it's hard. We try to keep our little list useful but it can never be a full solution -- I hope it cannot ever be and people value their privacy enough to not give up the freedoms of internet and TCP/IP. As of gmail -- one of the guidelines for the list addition is whether you need to go through some sort of a registration. If you do then it is usually not treated as disposable by us.