3 ms·

@nirvdrum: I can't reply to you directly, probably because of the downvotes, but anyway... My point is that when you design a trial, you should look for constr

by Aldo_MX 12y ago

@nirvdrum: I can't reply to you directly, probably because of the downvotes, but anyway... My point is that when you design a trial, you should look for constraints that are more difficult to abuse, and also more valuable for a user, and definitely "1 month of service" is neither difficult to abuse, nor valuable for a user. If you found a solution in requiring CC details on signup, it's OK, but that was just a temporary cure to your illness of having a time-limited trial. It's not the fault of mailinator, nor the fault of banks, is the fault of wanting to have one (trial) account per person. South Korea even takes the extreme approach of requiring social security numbers to guarantee that every account reflects one (korean) person, yet it is trivially easy to find stolen databases of schools and companies, and many forums, especially gaming forums even recommend you to commit identity theft to play an online korean game. Not even companies like Amazon, Google, Microsoft, etc. can save themselves from complex abuse techniques like stolen CC's, generated and valid CC's, disposable CC's, etc. You can pretty easily find news about massive DDoS attacks generated from their clouds using these techniques. Regardless of how much effort you have spent dealing with abuse, if you are only playing wack-a-mole, you are just wasting your time. I know it is easier said than done, but probably adding a proxy to do throttling, enforce global limits to free users (ex. domain + ip per hour/day), and stopping/reporting DoS attempts would had been a better investment than trying to prevent users from using Mailinator.

nirvdrum 12y ago
We're going in circles, so this will be my last comment on the matter. In our experience, over an extended period of time, there was virtually no legitimate use originating from Mailinator users. Maybe it's a fantastic service for others. For us, it was hands down the biggest source of abuse. It would be extremely difficult for anyone to convince me of its legitimacy in the face of the data we saw over a prolonged period. And it's not even that Mailinator users would sign up, try it for 30 minutes, and then just move on. In that case, I'd just say they weren't qualified, didn't like the service, didn't find the value prop, whatever. But that's not what happened. I don't really think the "you're going to get screwed, so just learn how to get screwed" attitude is really appropriate. There have been a few armchair theories on how we should have dealt with the issue. Suffice to say, 10 paragraphs of text here aren't going to enumerate everything we tried. And it's not as if we made no product improvements in that period either. Simply put: if you don't want to use the service, great. If you don't find it valuable, that's fine too. But no one's taking the high road trying to perennially use a service without paying for it, meanwhile calling it a quality issue. And none of this is abstract. We tried all sorts of technical solutions. People just found another way to abuse. We slapped the credit card gate up and had not a single Mailinator signup for the 2 years after that. It simply solved the problem. Maybe someone will up the ante with fake credit cards . . . for us, we found thousands of Mailinator users weren't willing to take that step.

by Aldo_MX 12y ago

nirvdrum 12y ago

We're going in circles, so this will be my last comment on the matter. In our experience, over an extended period of time, there was virtually no legitimate use originating from Mailinator users. Maybe it's a fantastic service for others. For us, it was hands down the biggest source of abuse. It would be extremely difficult for anyone to convince me of its legitimacy in the face of the data we saw over a prolonged period. And it's not even that Mailinator users would sign up, try it for 30 minutes, and then just move on. In that case, I'd just say they weren't qualified, didn't like the service, didn't find the value prop, whatever. But that's not what happened. I don't really think the "you're going to get screwed, so just learn how to get screwed" attitude is really appropriate. There have been a few armchair theories on how we should have dealt with the issue. Suffice to say, 10 paragraphs of text here aren't going to enumerate everything we tried. And it's not as if we made no product improvements in that period either. Simply put: if you don't want to use the service, great. If you don't find it valuable, that's fine too. But no one's taking the high road trying to perennially use a service without paying for it, meanwhile calling it a quality issue. And none of this is abstract. We tried all sorts of technical solutions. People just found another way to abuse. We slapped the credit card gate up and had not a single Mailinator signup for the 2 years after that. It simply solved the problem. Maybe someone will up the ante with fake credit cards . . . for us, we found thousands of Mailinator users weren't willing to take that step.