Show HN: IsTempMail – Detect and block disposable email addresses

[xvolter]

This is completely ignoring the useful use cases of "disposable" emails like privacy. I have a domain that I specifically use as a catch all, so anytime I sign up for a website I use the domain as the username, like [e-mail]

This helps protect me in many ways. If my email is sold or leaked, not a big issue, I can just add that specific email to a blacklist and I never need to get spam from it again. Or if I cancel and keep getting spam about rejoining, blacklisted. It makes it easy to keep my spam and newsletters to a minimal.

It has the built in advantage that I can always sign up for new trials if I want, just do thatdomain.com1@ thatdomain.com2@ and so on. Although I don't do this often, I have had to do it for various reasons.

I've hit on occasion websites that block their domain from being in the email address, likely a poorly implemented security check because their software might say anyone with a "@service.com" email is an admin or something. In that case, I enter some random crap. I never have to remember the emails, since I can just search my email history for the address the service sent the registration confirmation to.

However, the downside is privacy. I use my own domain, which contains my full name, so when I sign up to some services and want to do so without giving my name, I still rely on a disposable email service such as hidemyass.com; and I do this for many online services. I am not a believer that everything I sign up for needs to know my full name, address, and email - often services ask for this information for no reason.

So attempting to block these types of services, that have valid and useful benefits to users, simply harms your users. You can avoid spam users with a captcha, and for trail abusers you already can't do much because @gmail.com already allows for a lot of aliases to work like @googlemail.com, or [e-mail] or [e-mail] etc, or [e-mail]

Don't harm your users with useless validations.

[sadasd21asda]

I disagree. I run a SaaS product and disposable emails are a bane to my existence. I get thousands of signups a day from people all around the world using disposable email addresses trying to milk the free tier of the product.

You have no idea the lengths people will go to.

If all you wanted to do was test a product out, create a real email address even if it's full of bogus details.

If you won't try my product without a real address then you're a customer I don't want and don't need.

[rubyn00bie]

Not to be an asshole but I absolutely loathe this... these sort of things are why I'm forced to give my email address to organizations I don't trust. This is offensive to my sense of privacy and I wish people would stop doing it.

Too often now sites/app want a login for no benefit other than to SPAM me with newsletters and crap I never wanted. That's why I use disposable email addresses, you're providing me no real value, at least sight unseen, but I must give you something I know is valuable-- my contact information.

[cryptarch]

I add the name of whomever I'm mailing whenever I enter my address, like "[e-mail]".

If they remove the "+microsoft" portion mailing me, that email is sent to my spambox and reported to spamcop, because I did not sign up with that address; the address I signed up with has the +etc infix.

Eventually I figure companies will get wise to this and I'll have to set up my own server which does the same trick with an underscore instead of the "+" sign.

[aembleton]

If they're not providing you with any value, then don't give them your email address.

If it's just a Regex check then you can just use [e-mail]. If it requires you to click on a verification link in the email then that is quite a high bar for you to go through to obtain something of `no value`.

[mike-cardwell]

I just give out automatically expiring email addresses. here's an email address which will work until Thursday and then start bouncing:

[e-mail]

I didn't have to click a button or anything to create it. It just exists, thanks to the pattern. Here's how I did it:

https://www.grepular.com/Automatically_Expiring_Email_Addres...

[Exuma]

These guys let you add your own domain

https://www.guerrillamail.com/

[tyingq]

I think the mistake was using the word "block". A general purpose "email type classifier" might be useful.

No need to block the temporary email, but you might use that information for other purposes, like having it be some weight to a fraud detection system. Note, not calling it out as fraud outright, but using it as one data point among others.

[hatsunearu]

Damn right, this is straight up evil technology, with high probability of harming society.

[otterpro]

I have a secondary email address as a throw-away email, just for the purpose of registration, i.e. [e-mail].

[clusterman]

I created it as a side project to stop fake registrations with disposable email addresses, like emails from mailinator, email-fake.com, temp-mail.org, etc.

It has a public API, no registration required, accepts up to 10 checks per minute. A WordPress plugin and a simple PHP library are also included.

Check it out :-)

[ithinkso]

Don't take it the wrong way, I wish you all the best but I also hope this particular project won't see any significant adaptation :(

[jakebasile]

No offense, but why block those addresses?

[XNOVRJ]

There's a reason I'm using a disposable address for your service. A much better user experience would be for you to allow me the option to try out your service before giving you my email.

[ythn]

How much does it cost to get my temp email service white listed?

[erelde]

Disposable email addresses exists precisely because we don't plan on returning. Some websites tried to block disposable addresses already, I just went somewhere else.

[lloydatkinson]

Then you are an arsehole, plain and simple.

[tyingq]

Cool. I know Microsoft has an email address classifier they use for things like product beta signups. See these examples:

https://flow.microsoft.com/providers/Internal.User/users/joe...

https://flow.microsoft.com/providers/Internal.User/users/joe...

It classifies things like gmail, yahoo mail, hotmail as "Consumer" addresses.

So, there might be some additional markets for you if you can identify "consumer" emails vs "business". Also, some niche areas like isEduEmail(), for things like student discounts (fyi, not as simple as it seems at first glance).

[GordonS]

Interestingly, if you try an @yandex.com address you get back a true "isViral" property. Wonder what that means?

[mschulze]

If you consider using this, please for the privacy of your users make sure to only check the domain, not the full mail address (so not like the first two API request examples).

[clusterman]

It's an API function, so it should accept any reasonable input. The WordPress plugin checks only the domain name part, and the bulk checker does too.

[basdp]

This is such a bad idea. 99 out of a 100 times the use case for such a service is because the developer wants to make sure it can spam a real email address.

[maciekmm]

In the past I've used this: https://github.com/martenson/disposable-email-domains

Gets the job done.

[clusterman]

I used it too, but several new domain names are added every day. It's ineffective to manage/update your local block list.

[josho]

Kudos to the founder for trying something new.

But, I hope this doesn't take off because there are valid reasons for using fake email addresses. E.g. I don't trust the site not to sell my email, or leak it inadvertently through a security exposure.

[sklivvz1971]

I really don't like this service at all. It destroys value, like the ability to be anonymous, and enables abuse by companies - the 90% use case is by companies who use it for sending marketing junk as we all know perfectly.

[o_____________o]

I guess you don't show the domain name blacklist because that's the entire business?

[jpalomaki]

Maybe instead of blocking disposable emails, give user a gentle notification and explain why you would not like him to use such email address.

[joshmanders]

While the service mentions blocking them, this API can be used just for that. All it does is take an email and tell you if it's a temp email. What you do with that info after is up to you.

[alphabettsy]

I really hope this doesn't see adoption in many cases. I can see it being okay in places where abuse is an issue, but I use different disposable email services specifically because I don't want spam or my actual email exposed in the endless stream of breaches.

I don't want Best Buy Rewards, etc. having my email to sell.

[alphonsegaston]

Can someone provide examples of temp mail abuse that makes this necessary? I sometimes use these service to avoid being subscribed to ceaseless email marketing rings or get at information (in my opinion) needlessly siloed in things like forums.

Seems also like a user-hostile escalation in this kind of arms race that will eventually be overcome anyway.

[sklivvz1971]

The only example I can think of is when using temp-mail for serious stuff.

E.g. you register an actual account with temp-mail, this makes anybody able to reset the password.

I totally agree though that this service is user-hostile.

[al_chemist]

If you ask somebody their phone number and they give you a fake one - they don't trust you and think you are an asshole. Same with e-mail. When you feel you need to protect yourself from "disposable emails" then your problem is elsewhere.

[sgehly]

I don't quite understand why this service is attempting to charge for what is basically an email list, when email lists with more domains have been public for quite some time.

[homero]

New ones pop up

[kip_]

Why is thrott.com (ThrottleHQ) on your block list?

I'd argue that those emails aren't disposable. I use ThrottleHQ to track when service providers resell my email to other lists.

[clusterman]

Ones can create multiple email addresses, and disposable them in an instant. It's just another disposable email service that is easily abused by spammers.

[GordonS]

> Disposable Email Address (DEA) services

Is that acronym even a thing?

[clusterman]

I store and track "disposable email address service provider", so I want to abbreviate that name. Anyway, I removed the "DEA provider" counter and the acronym :-)

[hayleox]

If you implement this on your site, it won't get me to give my real email address; I'll just leave and not give your product a chance.

[Veratyr]

> Disposable Email Address (DEA) services are tools for spamming, fake registration, free trial abusing, etc. And we hate them!

Gloves are a tool for criminals! Knives are a tool for murderers! Cameras are a tool for terrorists and pedophiles!

Like these other tools, email addresses have legitimate uses. If you find yourself getting a lot of disposable addresses, there are other ways to ensure you get a valid email address, like only asking for one when your users are actually going to want to receive your emails.

[cryptarch]

Why block disposable email addresses?

[avaer]

This got me thinking of a tangential business idea: a user-hostile site blocker.

You take a quick quiz of stuff you personally consider unacceptable from a site (such as blocking disposable emails), and then it comes up with an autoupdated blocklist.

Does this exist?

[jpambrun]

If I have no incentive login again, you should probably not ask my email. This service is a nuisance just like all those sites that require an email for no good reason.

[fredsanford]

This sucks. I hate it. VERY few "services" are worth the exposure of my real email address. I made this mistake with yahoo, bigfoot.com and amazon.

It would not hurt my feelings if the developer of this "service" became allergic to pizza. And if the service were to close... The allergy is reversed, gradually.