Registrations using throwaway email accounts - thoughts?

[creativeforge]

Hi, I looked for a discussion on this here but didn't find. Let me know if this was already addressed.

► What is your experience or your stand toward these disposable email accounts?

► What could happen when the forum tries to send notifications and hit a dead account after a while? Does that place our forum on a blacklist of sort online?

Thanks!

Andre

Example: https://helpdeskgeek.com/free-tools-review/5-best-free-disposable-email-accounts/

 

[jeb35]

Just deny registrations from those addresses. I'm sure someone has an extensive list of them somewhere.

 

[z3r010]

I use debounce to validate email addresses on the registration page so disposable and fake emails don't get through.

 

[Alpha1]

I block fake email registrations and validate all email.

@Xon 's addon is great for registrations:

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

Also useful:

[J] Email Check

This is a simple addon that check the emails entered by users during registration via the api of validator.pizza ipqualityscore.com What's the limit? The number of request is limited to 120 requests per hour, per IP address for...

xenforo.com

 

[MapleOne]

I use debounce to validate email addresses on the registration page so disposable and fake emails don't get through.

They are not taking new accounts

 

[z3r010]

They are not taking new accounts

View attachment 274120

That's a shame, I've been using them for years, and it's very effective.

 

[MapleOne]

That's a shame, I've been using them for years, and it's very effective.

It's usually a sign that the business operations are on the wind down.

 

[motowebmaster]

The problem I have, which admittedly has become minor, are email addresses that become invalid after the registration. If an addon did checks both at registration, and again at a later time, that would be helpful.

I'm using Andy's addon that deletes users that haven't posted/contributed in a year, which helps. I don't allow new registrations to create private conversations until they have made ten forum posts; so if scammers registered with a temporary email address but can't attempt to take advantage of others privately their profile will eventually go away regardless.

Some time ago I exported out all of my user email addresses and sent them to Zerobounce for a one-time validation. The service is designed for those who market via email, but did provide useful results.

 

[Dragonfruit]

Just use this: https://xenforo.com/community/resources/ozzmodz-email-whitelist.7951/

Create a whitelist of valid email addresses. Nothing else will work on registration.

 

[TPerry]

Just use this: https://xenforo.com/community/resources/ozzmodz-email-whitelist.7951/

Create a whitelist of valid email addresses. Nothing else will work on registration.

The problem with that is how do you keep up with all the valid ISP emails?
What if someone who lives in Podunk Texas and uses a small ISP limited to their area uses their email provider. You have now blocked a user with an otherwise valid email from joining.
I can see where that add-on would be useful for a site that only allows access to specific clients... but for a wide-open system I imagine it is a nightmare to keep up with.

 

[Dragonfruit]

Eh, personally I don't think ISP emails should be used anyway. Same with work & EDU emails. The accounts are terminated once they're no longer an employee or student. I'd imagine it's the same with ISP. I know when someone changes local ISPs here their ISP email is no longer valid.

Users really should be creating their own forever account that they won't lose access to.

 

[TPerry]

Eh, personally I don't think ISP emails should be used anyway. Same with work & EDU emails. The accounts are terminated once they're no longer an employee or student. I'd imagine it's the same with ISP. I know when someone changes local ISPs here their ISP email is no longer valid.

Users really should be creating their own forever account that they won't lose access to.

The problem is that many refuse to use Hotmail/Live/Outlook, Gmail or Yahoo for their email providers... and prefer to use their ISP.
Granted, they can sometimes change their ISP, but if they are getting emails and they do change their ISP and don't their old ISP account gets closed, they get put into a bounced email status (if you are effectively utilizing XF functions) and have to supply their new email. Personally I would prefer an actual ISP linked email or even a domain related email instead of the "free" email providers as most spam bots are targeted to utilize them for creating fake accounts.
Trying to force users to use set email providers is an exercise in futility. Some areas may even totally block some major email providers "just because".

 

[Dragonfruit]

The problem is that many refuse to use Hotmail/Live/Outlook, Gmail or Yahoo for their email providers... and prefer to use their ISP.
Granted, they can sometimes change their ISP, but if they are getting emails and they do change their ISP and don't their old ISP account gets closed, they get put into a bounced email status and have to supply their new email.
Trying to force users to use set email providers is an exercise in futility. Some areas may even totally block some major email providers "just because".

Well we've been using this method on XF and one from vBulletin for several years and it works for us. I understand if you disagree and it doesn't work for you.

 

[TPerry]

Well we've been using this method on XF and one from vBulletin for several years and it works for us. I understand if you disagree and it doesn't work for you.

You able to provide any statistics on how many viable users you lose to joining because of the restrictions to limited email providers?
A classic case for my new site... 3 of the users use a comcast.com email account..... so if I blocked ISP providers, they would not have been able to join without jumping through hoops to get an "allowed" email.. which most won't do. I know I personally would not.

 

[Dragonfruit]

You able to provide any statistics on how many viable users you lose to joining because of the restrictions to limited email providers?

We had nothing to track it, but we're not concerned.

We get about the same daily registrations in the last 10-12+ years. Well within when this method was implemented. It feels more like we never see spammers anymore. But we also use this along side other anti-spammer add-ons.

 

[Dragonfruit]

A classic case for my new site... 3 of the users use a comcast.com email account..... so if I blocked ISP providers, they would not have been able to join without jumping through hoops to get an "allowed" email.. which most won't do. I know I personally would not.

Again, I understand if this does not work for you. I was just responding with a solution that we use, and we find effective.

It's also 2022, I don't know anyone that doesn't have multiple email accounts. Especially junk-type ones that they're okay with being leaked if sites/forums become breached. I have a few of those myself.

 

[jeb35]

I know when someone changes local ISPs here their ISP email is no longer valid.

Not true at all. I know of a few people who have had ATT.net emails with their accounts, they cancelled their services with them but they still have access to the email sending and receiving.

 

[Dragonfruit]

Not true at all. I know of a few people who have had ATT.net emails with their accounts, they cancelled their services with them but they still have access to the email sending and receiving.

Well it is here. I had to assist people migrating their email data before their ISP closed off their accounts. Anyway, I'm not trying to sell you on it. You don't have to use it. As you can see from the add-on's likes, there's many others that have found it to be a fit for them as well.

 

[Alpha1]

@Xon 's addon has the email domain blacklist / whitelist down quite well. You can moderate all new domains, then decide if you want to white or blacklist. After that you will never have to deal with the domain again.
But that is just one of many great features.

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

 

[TPerry]

@Xon 's addon has the email domain blacklist / whitelist down quite well. You can moderate all new domains, then decide if you want to white or blacklist. After that you will never have to deal with the domain again.
But that is just one of many great features.

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

sounds similar to the old TPU stuff that was out for XF 1.x. If so, that was fairly effective.