Re: [Tiki-devel] Disposable email detector

Hi all

Been fiddling on with this a bit (is it just us or has the spam deluge increased recently for everyone?)

That list on GitHub is indeed very incomplete so i've been looking for better ones and this site seems quite interesting

    https://www.stopforumspam.com

Has anyone else used it? Will investigate further, but seems like they're doing a good job (and is free)

jonny




> On 28 Oct 2022, at 17:55, Jonny Bradley via TikiWiki-devel <[email protected]> wrote:
> 
> Hi Benoit
> 
> Thanks, shame... but i committed it and pushed it quickly as i won't have any further time before 25.x is branched, so was hoping we can polish it after that for 25.0 (and thereafter).
> 
> The initial use for it i see is not sending mailshots and newsletters to these addresses to save costs and bandwidth (and energy), i think banning them would be a bit extreme but could be added as an option.
> 
> That library is pretty minimal but you can use any list you want, so if someone wanted to find or maintain a better one it could work with that too.
> 
> If there are still significant objections i'll remove it.
> 
> jonny
> 
> 
> 
> 
>> On 28 Oct 2022, at 16:11, Benoit Grégoire <[email protected]> wrote:
>> 
>> On Thursday, October 27, 2022 11:01:23 A.M. EDT Jonny Bradley via TikiWiki-devel wrote:
>>> Hi all
>>> 
>>> I've just spent the morning with a client trying to clean out spam from his
>>> site and we're finding he's getting several registrations an hour by people
>>> using disposable/temporary email addresses, which i didn't really know much
>>> about before investigating.
>>> 
>>> I think it would be a useful thing for tiki (and tiki.org) to be able to
>>> detect these and either list them on the user admin (because there's no
>>> point emailing them), or block them from registering completely.
>>> 
>>> I've found an MIT licensed php library here which i might be able to sneak
>>> in to 25.x before we branch but just thought i'd see what others think
>>> about this?
>> 
>> I'm afraid it wouldn't help significantly, if at all :(
>> 
>> There have been such services for at least 2 decades, and people trying to list them for just as long.  They usually just generate unrealistic expectations on the part of administrators.
>> 
>> Using such lists will, in practice, block SOME actual humans using such services.  Usually not bots which tend to use their own domains (or hijacked ones). 
>> 
>> That specific list (https://github.com/disposable-email-domains/disposable-email-domains/blob/master/disposable_email_blocklist.conf) is updated quite infrequently compared to, for example, spam blocklists.  And that's assuming we actually code a cron script to keep it updated.
>> 
>> Modern temp mail services provide an address from a random domain picked in a list that they don't enumerate (to make anti-temp email blocking difficult).  Static lists will never be effective.
>> 
>> I tried the first 4 google results for "temporary email address", they all generated email addresses that weren't in the list above.  0 out of 4...
>> 
>> There are paid services that are possibly more effective at detection. 
>> 
>> But in practice, using CAPCHAS is probably the only somewhat effective mitigation.
>> 
>> --
>> Benoit Grégoire
> 
> 
> 
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel



_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel