11

I believe this is a common issue when we talk about some type of community. I have some users that use temporary emails from sites like yopmail.com and similar.

I am not sure if I should block this type of users, or just let them visit the site even with a fake email. I can use something like this to block.

Probably these users will create a serious registration if they like the service, but this fake email account will damage the reputation when using bulk emails.

  • a) Block the account registration when using this type of sites.
  • b) Ban this users after some time. Think like a disposable account.
  • c) Do nothing.
Improve this question
1
  • If a community uses an experienced managed service provider, with good track record, transparent about breaches, for the platform, then disallowing these emails may be acceptable. If it’s a setup where you manage the service on a shoestring, without design-for-security, audits, etc., then it’s prudent to assume that the account data is practically public, and using any real personal information one cares about not leaking is a no-no. E.g. self-managed phpBB or Wordpress sites should be treated as if their storage had public guest (anonymous) read access. That’s the reality of it.
    – Kuba hasn't forgotten Monica
    Jul 21 '19 at 13:37
9

On Stack Exchange we have found that in general (though not exclusively) users with throwaway e-mail addresses are not the sort of users you want on a serious, professional site. While there may be legitimate reasons for some people to use them, the vast majority of such users aren't interested in interacting with the community.

There is also a very serious issue with such accounts - it's all too easy for someone else to gain control of a throw away e-mail address, so it makes it easy for those with nefarious intent to take over your account. This is so serious that Stack Exchange have stopped sending out recovery e-mails to such addresses:

Mailinator (and other services like it) allow you to create a fully disposable email address. What this also means is that anyone could change your password on your behalf.

This isn't a theoretical possibility. A few months ago someone did just that for a bunch of accounts on Stack Overflow. (Fun fact: people who are inclined to sign up for sites using mailinator are also fond of using their username as their email address.)

Why isn't the password recovery system automatic for certain email domains?

So, a the very least I'd implement the same restriction. Allow people to sign up, but if they lose their password that's it. This is effectively option b.

Depending on the service you are offering, I'd probably seriously think about option a - not allowing signups from such addresses. Obviously you'll have to keep your blacklist of domains updated as new temporary email services started up, but hopefully that shouldn't be too onerous.

As for people wanting anonymity - as long as you don't display links to social media unless people opt in and allow "fake" names then there shouldn't be an issue here.

Improve this answer
1
  • Using a fake name, while exposing social media names, real emails, etc. to a site is fine as long as you trust that site to be secure. I imagine that most amateur-ran sites with no security process, that use phpBB and similar software, are pretty much open books as far as data leaks go. In fact, for a site that’s early in its life, set up by non-professionals, I’d not be using any real personal info that I may care about not leaking. And probably anything non-tech oriented, like online faces of brick-and-mortar stores – even big chains – are open books too. History tells us that well :/
    – Kuba hasn't forgotten Monica
    Jul 21 '19 at 13:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.