Re: [Tiki-devel] Disposable email detector

On Thursday, October 27, 2022 11:01:23 A.M. EDT Jonny Bradley via TikiWiki-devel wrote:
> Hi all
> 
> I've just spent the morning with a client trying to clean out spam from his
> site and we're finding he's getting several registrations an hour by people
> using disposable/temporary email addresses, which i didn't really know much
> about before investigating.
> 
> I think it would be a useful thing for tiki (and tiki.org) to be able to
> detect these and either list them on the user admin (because there's no
> point emailing them), or block them from registering completely.
> 
> I've found an MIT licensed php library here which i might be able to sneak
> in to 25.x before we branch but just thought i'd see what others think
> about this?


I'm afraid it wouldn't help significantly, if at all :( 

There have been such services for at least 2 decades, and people trying to list them for 
just as long.  They usually just generate unrealistic expectations on the part of 
administrators. 

Using such lists will, in practice, block SOME actual humans using such services.  Usually 
not bots which tend to use their own domains (or hijacked ones).  

That specific list (https://github.com/disposable-email-domains/disposable-email-domains/blob/master/disposable_email_blocklist.conf[1]) is updated quite infrequently 
compared to, for example, spam blocklists.  And that's assuming we actually code a cron 
script to keep it updated.

Modern temp mail services provide an address from a random domain picked in a list 
that they don't enumerate (to make anti-temp email blocking difficult).  Static lists will 
never be effective. 

I tried the first 4 google results for "temporary email address", they all generated email 
addresses that weren't in the list above.  0 out of 4...

There are paid services that are possibly more effective at detection.  

But in practice, using CAPCHAS is probably the only somewhat effective mitigation.


-- 
Benoit Grégoire 

--------
[1] https://github.com/disposable-email-domains/disposable-email-domains/blob/
master/disposable_email_blocklist.conf

_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel