There is no one-size fits all solution here. It comes down to what the cost of spam/fake accounts is, the level of sophistication of your adversaries, and the cost of loss of use to legitimate users blocked by your signup gates. Each site has their own weighting across these factors.
thenewnewguy 54 minutes ago [-]
The article author attemps to make a distintion between "burners" and "aliases" but I don't believe one exists for this usecase. Let's say for the sake of argument that you think blocking burner emails provides meaningful protection (I don't, but services using such a list obviously do). From your perspective, an "alias" is the same as a "burner". Both can be easily generated in bulk by a human or bots, cannot be resolved to an identity, and cannot be compared to determine if two emails are the same person.
xena 55 seconds ago [-]
I think this post was written by an AI model.
is_true 7 minutes ago [-]
Haha. I run a service that compiles IP addresses used by proxy services and a few months ago my own IP got there.
Turned out to be a friend that installed an app to watch soccer matches for free and in return he became a node of one of those services.
jambalaya8 13 minutes ago [-]
The easiest and best way is to rate limit the number of signups from a domain per day. You might still get people trying to bulk signup but as the article states, most large spam operators do not really use those domains anyway. Of course there are plenty of small time scammers to make up for that lack, so to speak.
I personally use burner emails when I want an account somewhere but would prefer not linking all of my personal interests and necessities to the same few email addresses. It just seems smart.
It is frustrating to try to make it clear you are not attempting to bypass authenticity controls, especially when AI can so frustratingly create text posts that can seem realistically 'human'.
Maybe someone will come up with a better way to attempt to add privacy back without ripping it away in the name of attempting to add it.
Though, I mean, that's been the issue since the 1990s: security or privacy, hard to have both, and yet difficult to have either without the other.
amukbils 6 minutes ago [-]
IDK man .. many services really just don't even want to deal with a sign up they are never going to reach. By using a disposable email, you're telling the business, I want to use your service, get value, but I don't really want you to reach me. To them, it sounds like a loss loss situation. Business are there to make money, and they offer a signup/trial/free account so they can give you access in exchange for being able to reach you.
But I do sympathize with the stupidity of marketing email madness.
amukbils 2 minutes ago [-]
Aliases are fair game .. for organization for just hiding your own email to limit tracking.. that's fair .. but bad, known disposable email generally just costs too much and is too risky for businesses.
xyst 10 minutes ago [-]
i have my own custom domain with a non ".com" TLD for e-mail and the number of services that reject sign ups for this purpose are way too high.
notably, micro center _was_ an issue but had to raise exception.
gruez 1 hours ago [-]
Reminder that apple provides burner emails that are effectively unblockable (because they use the @icloud.com domain, at least for now[1]), for $0.99/month.
$50/year and Fastmail will let you alias anything@yourdomain.com to your inbox. I use a different email for every company or website I interact with, so I know who spams me.
jambalaya8 10 minutes ago [-]
Services like this are great for some things, like adding and removing forwarding, and vacation mails, and organising mails to make life and work easier, but the provider still links everything. It is only, at best private in a single direction. That is fine for some things, not so great for others (and it has nothing to do with legality).
rz2k 48 minutes ago [-]
I’ve surprisingly found that I have started to have to use mydomain.com with Fastmail. Sometimes banks used for a business account, or accounts at b2b companies don’t treat fastmail.com as a large email provider, and otherwise try to associate me with other fastmail customers as though we are colleagues at Fastmail.
Normal_gaussian 33 minutes ago [-]
This is genuinely hilarious. Are you able to elaborate? Which banks? Which B2B? There is probably a shared product stack here that is making some hilariously poor decisions.
Lt_Riza_Hawkeye 31 minutes ago [-]
ImprovMX will do that for free...
T0Bi 55 minutes ago [-]
My domain at Hetzner including mail costs less than 20€/year and all emails to <whatever>@mydomain.com which are not part of predefined mailboxes land in my catchall@mydomain.com mailbox.
Normal_gaussian 32 minutes ago [-]
Do you have sending from the incoming address setup? If so, using what?
no_input 1 hours ago [-]
I love this feature from Fastmail but I have used a few websites (smaller of course) that will not accept anything outside of the big few email domains.
CharlesW 1 hours ago [-]
Apple (like any email provider that conforms to RFC 2822) supports plus addresses as well.
teddyh 1 hours ago [-]
Are you implying that plus addresses are part of RFC 2822? Because they aren’t. AFAIK, no RFC documents specify the plus address convention. The RFCs merely specify that, in an email address, whatever is to the left of the @ sign is to be interpreted by the receiving system, and nobody else should make any assumptions about any of it, and certainly never alter it. And also that the + character is one of the many permitted characters to the left of the @ sign in an email address.
The plus address convention is just that, a convention, widely implemented by many email programs and servers, but not required by any standard, nor universally implemented.
50 minutes ago [-]
john_strinlai 47 minutes ago [-]
its talked about in a proposed standard, at least.
Any illegitimate email collection service already knows to strip out email subaddresses.
If you’re trying to avoid email spam, there’s not much difference in giving someone myname+foo@gmail.com versus just myname@gmail.com.
eli 31 minutes ago [-]
You could just use my.name@gmail.com for the no-alias version. So myname+foo@ works and my.name@ works but myname@ goes directly to the trash.
gruez 22 minutes ago [-]
That can also be normalized.
edoceo 5 minutes ago [-]
Yea, gotta take all dots out on the username portion of Gmail address
Larrikin 28 minutes ago [-]
It's become a fairly regular occurrence that any email with + just shows an error saying the email isn't valid. Bad actors can also easily strip it out after
joshbetz 1 hours ago [-]
Bad actors can just strip the plus part of the address
hoppyhoppy2 49 minutes ago [-]
Fastmail costs $60/year now, at least for new signups
MarioMan 49 minutes ago [-]
Cloudflare offers this for free as well.
washmyelbows 1 hours ago [-]
proton too
GuinansEyebrows 1 hours ago [-]
His own petard?!
observationist 52 minutes ago [-]
He was petarded quite hoistily.
mindslight 13 minutes ago [-]
"I never thought the leopards would eat MY face," sobs dude who contributed to the leopard-owned face eating industry.
There has never been a good argument for attempting to filter email addresses based on domain. Check address syntax on interactive forms purely to help users (did they fat finger something). Whatever well-formed address you've got, fire off emails and if they can receive them then it's a legit address. If you want to rate limit signups, then do so per-domain or per-mx, the same way you might limit incoming connections per-ip. That is the extent of guarantee that email provides you - trying to step over that demarc point is a control delusion.
Even outright throwaway domains like mailinator.com - if a user is giving you this type of address, it says more about your own requirement demanding an email address rather than the user themselves.
Rendered at 16:13:24 GMT+0000 (Coordinated Universal Time) with Vercel.
Turned out to be a friend that installed an app to watch soccer matches for free and in return he became a node of one of those services.
I personally use burner emails when I want an account somewhere but would prefer not linking all of my personal interests and necessities to the same few email addresses. It just seems smart.
It is frustrating to try to make it clear you are not attempting to bypass authenticity controls, especially when AI can so frustratingly create text posts that can seem realistically 'human'.
Maybe someone will come up with a better way to attempt to add privacy back without ripping it away in the name of attempting to add it.
Though, I mean, that's been the issue since the 1990s: security or privacy, hard to have both, and yet difficult to have either without the other.
But I do sympathize with the stupidity of marketing email madness.
notably, micro center _was_ an issue but had to raise exception.
[1] https://news.ycombinator.com/item?id=48559935
The plus address convention is just that, a convention, widely implemented by many email programs and servers, but not required by any standard, nor universally implemented.
https://www.rfc-editor.org/info/rfc5233/
If you’re trying to avoid email spam, there’s not much difference in giving someone myname+foo@gmail.com versus just myname@gmail.com.
There has never been a good argument for attempting to filter email addresses based on domain. Check address syntax on interactive forms purely to help users (did they fat finger something). Whatever well-formed address you've got, fire off emails and if they can receive them then it's a legit address. If you want to rate limit signups, then do so per-domain or per-mx, the same way you might limit incoming connections per-ip. That is the extent of guarantee that email provides you - trying to step over that demarc point is a control delusion.
Even outright throwaway domains like mailinator.com - if a user is giving you this type of address, it says more about your own requirement demanding an email address rather than the user themselves.