4 ms·
I'm always a little suspicious of these services. People use them to create throw-away accounts, which they abandon after one use. Those accounts remain active
by 8organicbits 2y ago
I'm always a little suspicious of these services. People use them to create throw-away accounts, which they abandon after one use. Those accounts remain active and are useful for botting (vote manipulation, comment spam, etc). Whoever owns the email domain can do a password reset to do an account take over.
I'm curious about the privacy policy. The title says that you don't have ads, but there's tons of discussion about sharing information with ad partners.
- TemporaryMail 2y agoYes, just like all other email providers nothing is encrypted and you could totally look at the emails. The difference here is though that there's nothing of value. If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon. I like that you bring this stuff up though as it could perhaps be good to mention this on the site down at the FAQ so people don't think I'm doing something shady with the service since there are no ads.
- bastawhiz 2y ago> If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon Or spinning up hundreds of accounts on a website so you can perform card testing. Or creating accounts so you can put all of the inventory for an e-commerce site into carts to reserve it for yourself. Or running sneakerbots. Or any other malicious intent where the victim is the website operator.
- TemporaryMail 2y agoAgain, wouldn't it be easier for the attacker to just buy a domain and use that completely undetected instead of having to use a rate-limited disposable email service?
- bastawhiz 2y agoYou're assuming they're doing it hundreds of times a minute. Often they're signing up for the accounts by hand to get through the captchas. The rest of it can be automated
- TemporaryMail 2y agoThat's what I would assume most of them are doing, yes. In this day and age I don't understand why they wouldn't be able to just use a headless browser instead of doing it manually - has labor really become this cheap?
- bastawhiz 2y agoCaptcha and rate limiting solutions are extremely good at stopping completely automated signups. It's far easier to pay someone in India a few bucks to sign up for a hundred accounts so you can do card testing than it is to run a server and write software for it. Hell, most of these people probably aren't even programmers.
- TemporaryMail 2y agoI think that's for the small players though as this should be pretty slow, expensive and have the risk of the "employees" stealing the data (the business they are in is practically stealing so I don't think they have high morals).
- stavros 2y agoIf I'm using a temporary email service, I'm using it specifically because I don't care if the account gets taken over, though.
- 8organicbits 2y agoOh, the threat isn't to the user. They don't care about accounts they have abandoned. The threat is to services that suffer vote manipulation, spam, etc. The benefit of this approach is that you've got a bunch of abandoned accounts that were organically created (captchas solved, residential IP ranges, etc.)
- TemporaryMail 2y agoI don't think there's any value in that though. You can get all the stuff you mentioned for a fraction of the time and money it would cost to create a disposable email service and then you would also only target the service you wanted instead of sitting around and hoping that a user creates an account at the site you're looking for. The real value would in the reputation and history of the account (e.g a popular account on a social media site or community) and this isn't a thing that someone would use a disposable email service for as they wouldn't want to risk losing access to the account.
- ranger_danger 2y agothey're honeypots.
- j0hnyl 2y agoThere's a whole industry around detecting these and placing them on block lists.
- distalx 2y agoCould you recommend a few solutions or companies? I'm looking for such a solution at the moment. Thanks!
- TemporaryMail 2y agoThis discussion isn't going in the direction I was hoping for, ha ha! But as a developer of these sites I've used the majority to check my own domains and the most reliable one I've found is https://www.ipqualityscore.com/ https://www.ipqualityscore.com/ I strongly recommend that you take another look at your signup process though and don't require users to give up their email addresses, instead make it optional and present an alternative like a captcha.
- ocdtrekkie 2y agoverifymail.io is a pretty decent source, though I don't know what they charge for API access.
- j0hnyl 2y agoI've never evaluated any myself, but became acutely aware of them after launching my own temporary mail service as a learning exercise. I think there's a github repo somewhere that's regularly updated with a block list of these cycled domains though.
- TemporaryMail 2y agoThere are plenty just like there are IP lists for VPNs. Feel free to share a link to your service as I'd love to check it out and best of luck running it also!
- Springtime 2y ago> People use them to create throw-away accounts A separate use case is when there's a free download that's email-gated, rather than account-gated. Examples would be Gumroad, certain 3D print platforms and such. I'd rather not wind up having my email just be added to some marketing list.