ProtonMail and SimpleLogin emails will be blocked from registering on websites
github.com
This makes me š
UPDATE: Thanks @nekusoul@lemmy.nekusoul.de for this update: The issue has now been commented on and was closed by the maintainer, where they explained why those blocks would be nonsense. But it appears the OP wants to still talk with maintainer privately about it.
If a website won't allow me to register with my protonmail , I will just not used that website.
Yep.
I've already run into a few. I mentally thank them for preventing me from wasting my time and money with them.
Is this going to be the response every time this shit happens until we're all just sitting on Lemmy twiddling our thumbs? The arrogance feels like it's downplaying the seriousness of the problem, and it's annoying to see it recited so much.
In a lot of cases, you may not have a choice of using the site or not. In cases where you do have a choice, eventually most if not all the alternatives can do the same shit if it becomes normalized.
API is letting these types of filter lists become shared easily, too. Sites may not even make a conscious decision to filter out proton, it may just happen because their filters are pulling from lists like this.
The problem is the trend. And try as you may, you can not fully escape that.
Well sometimes those websites ask you to register because you are buying something so they will loose me as a customer. Also even if I complain most companies dont care about privacy so I prefer to use my wallet as a way for this companies to listen my voice.
Use a custom domain on Protonmail (which includes Simplelogin) and you won't have any issues. It's a grand total of $5 per year for the domain.
Use a temporary email every time you use the website. Clog their mailing lists full of garbage. Make their metrics lie to them
deleted
Same. That said, sometimes itās a config error. I sent a very annoyed email to a website that didnāt work on Firefox, only for them to tell me that it was a bug and that they fixed it.
Yep what a wild thing, to try and filter email domains so they can try and find "fake" providers
And since people won't use the website, the website won't use the list. So the list would be useless.
The maintainer seems to have followed the same interpretation, weighing legitimate use against spam use. This is the official response to the issue as of 8h ago:
Simple as, if they don't even support e-mail it's surely a rather shite site.
The closed garden corpo-approved electronic message service the github issue is talking about simply won't do.
GitHub blocked me from registering with a Proton domain:
Damn, that guy's fucking dumb lmao
But also, is 7c/fakefilter even popular? It seems to barely have a following on GitHub to begin with. Seems pretty over the top to claim that PM and SL (and any other provider on that list) will get blocked from registering on websites.
And reading the project description the domains aren't even added manually. So the whole issue isn't needed at all. Might explain why it's been there since October.
The npm package has about 4000 weekly downloads. I don't know what that means in terms of popularity.
Less than left-pad. JavaScript devs are wild.
I know it probably predates String.prototype.padStart(), but it boggles my mind that people aren't just using the standard one.
He's not dumb, he's extorting people who will probably pay him.
Nobody's going to pay some random idiot who opened a ticket on a repo they aren't even a contributer on.
Sick of sites requiring an account, email or phone number. Makes the web even more unfriendly. I hope temporary emails can always get around filters, as if you play stupid games you should win stupid prices.
I was in a club and had to open an account to open a tab, they asked me for my government number ID, pretty standard, but then they started asking for phone number, age, email, Instagram account and I was like wtf, I just want a bottle of water!
Where do you live that providing your government id to a business is standard? In Germany, the only one outside of a judge to be allowed to request that is law enforcement ( even then only with proper cause ). Of course, some businesses are legally required to request and process your ID number ( e.g. when booking international flights, medical insurance companies etc), but these are under tight federal control and supervision to ensure data safety.
Age verification sometimes is a thing for purchasing 18+ things ( media or drugs like alcohol & smokes), but even then businesses will only ever perform a visual check of the date of birth on your ID. Technically they can never demand to hold your ID, not even for a short time just to better read the date. You only have to show them your ID. And actually recording and/or storing any of that information would be insanely illegal.
Germany / Europe might have its issues, but we at least try and take our freedom and data privacy serious. I would never dream of handing my ID to a generic business like a club for anything more than the age check.
It's in Brazil and is pretty standard. There's different IDs here, the most common one is called CPF and is used for financial transactions, is the number that identify you with the tax agency. In some things you can denied it, like in the pharmacy, but in other ones not, like buying a TV or car.
Interesting, will have to read up on how that works in Brazil. We also have a separate tax id here ( which is also used for pension and social security ), but that one is even more secure/private than the passport ID. We only provide that to our chosen medical insurance provider ( bc they need to register it with the ministry of finance ) as well as employers ( because 50% of the insurance has to be paid by employers).
It's explicitly not allowed and intended for generic identification purposes, because it makes it too accessible for identity theft and associated scams.
How very dystopian.
If you're ordering alcohol, completely ordinary
Or maybe that's what you were saying and I missed the sarcasm, idk
Is it ordinary for them to request the ID number? I'm Canada they just do a quick glance at the birth date on your ID
Just keep using the temp emails and when they don't recieve your email , call them up. Their IT support will unblock it after 50-100 calls. Remember consumers have the power.
I tried to report an issue in GitLab. I needed to input my phone number and payment information to create an account. WTF? No thanks, I'll just not report the issue.
When buying stuff online I find 0101etc works. Public numbers used to work fine for other things but not so much these days. If that doesn't work I usually don't give a damn about the service at that point (e.g. ShatGPT) #TeamBots
I used to have a disposable phone number just for signing up but it was more trouble then it was worth. If the website is shady enough, I go look somewhere else.
Blame bots. The other day we had a post about how 70% of account creation processes on sites are started by bots. Imagine that if you didnāt even need confirmation.
What if account creation was local (e.g. Git and keys)?
If no data needs to be stored then no account is needed. Use the system where there is a unique indentifier based on the password.
Never heard of this, how does that work?
A tripcode "is the hashed result of a password that allows one's identity to be recognized without storing any data about users. Entering a particular password will let one "sign" one's posts with the tripcode generated from that password. Trying to take another user's tripcode and compute their password from it (for instance, to make posts that appear to come from a particular person) is somewhat computationally difficult."
That's pretty cool, but still, does that really solve the bot problem? Doesn't it make it easier for them to spam?
Tripcodes doesn't affect bots spamming at all.
No longer needing accounts removes whatever barrier to entry email, phone or credit card is worth. On the plus side less people are being farmed for data, so society is better off š
What I mean is, doesnāt that barrier being removed make things easier for bots as well? And while humans only save a bit of time once to register, bot farms would improve a lot considering they do it over and over again.
Less data farming is undeniably better, but imo if something helps bringing us further from the Dead Internet outcome I can accept it. Of course, just the bare necessities, sites that require you mail + phone + name and so on when they donāt need them to function should really dial it down.
Perhaps requiring government ID would prevent even more bots.. but stopping bots is not my priority. When reading YouTube comments I see obvious comments from bots making generic comments or asking people to click links, but I also see many comments that make me wonder if they are being sincere or this is ML generated. Unless you're going to ask for more and more personal data then only the side creating bots will advance in fooling those requirement. Barriers to entry do not appear to be a valid long-term strategy.
Yeah, requiring government IDs would basically solve the bot problem, but would make the internet a privacy hell, especially for nations like China which already struggle with it.
We need a middle ground, but itās becoming increasingly harder to find one as you said.
the discussion is happening here: https://github.com/7c/fakefilter/issues/73
Someone working at Proton has commented on the issue, the list maintainer wanted to take the discussion with proton private so we have only a few posts from them.
If you want my personal take:
It's very clear how the list maintainer opposes anonymity in the internet in any form, which I see as an attack on freedom, journalism and activism.
I'm not a fan of Protonmail of any sort and in fact I consider that their privacy is lacking... but I really hope they can talk some sense into this guy. This block list seems to be used by a lot of webs that will start blocking virtually every private email provider.
(Edit: I assumed the person that posted the email list was a maintainer, but they don't seem to have a "contributor" or "owner" badge, so idk. Maybe they are just very angry at privacy and anonymity on the internet)
These lists are used by platforms to try and cut down on spam/bot account signups. This isn't a thing done for signups by the vast majority of platforms out there, but the API verification steps IS becoming more prevalent I suppose. I just got rejected for using a Protonmail domain to buy something outright on a very popular pet supplies platform the other day, but...eh.
Theyāll just lose my business and get a stern customer support email then. I donāt do business with companies that exclude Proton/Tutanota/Skiff emails.
Bro... You're on Lemmy. What business?
Yes, Lemmy users literally never spend any money, not once ever.
You guys have money?
Like 3 sometimes
They're not the maintainer.
I say that in my comment
why would anyone ever be like this?
Maybe a fed, corpo or authoritarian
I was thinking the same. Would be mighty convenient for them if people had to switch to sellout mail providers because the alternatives are all blocked.
This is not the list maintainer. Just a rando who opened a request
OK simplelogin you can make an argument there, very stupid one though.
But protonmail and tutanota, wtf ?!?
Just because an email provider is privacy focused and offers custom aliases means all it's emails are spam ?
Fuck this shit.
I wonder what happens when they find out that you can do my.name+alias@gmail.com
they seem to have it "covered"
on both his issues he tries to contact the author of the repo to discuss some change that's too sensitive to talk about openly, lol
To be fair that's quite easy to check with a simple regex, you can see that in many services that have cached up to that.
That one is not anonymous at all and itās super easy to extract the ārealā email for advertising and spam purposes if you wish to do so
Looks like you can even do this with iCloud accounts. They only let you have 3 at a time, but you can delete them whenever and create more as needed.
https://support.apple.com/guide/icloud/add-and-manage-email-aliases-mm6b1a490a/icloud
Advertisers aren't interested in your privacy. Simple as.
Am I the one one thinking this post is blowing the topic way out of proportion?
The post title is clickbait in its purest form: nothing is being blocked (from what even). There is a single issue raised on some obscure filter list... This has no consequences whatsoever. I am wondering why Protonmail even bothers to comment on this issue...
Admittedly the title is pretty sensationalist. The repo activity seems to indicate that the project has some users. It's impossible to know how many sites or which sites block emails contained in this list and what the impact might be. Even though I think the 7c/fakefilter project is inane, I would hesitate to say there would be no consequences at all.
It's best to defend legitimate email providers whenever possible. If we don't, those with an axe to grind get to define the provider's reputation.
Shit like this is what makes me want to pull my hair out at night
Yea, I guess it's impossible to make burner gmail accounts too...
A whole new account? gasp
Yeah, that's obviously impossible because that would require you to pick a different username.
The issue has now been commented on and was closed by the maintainer, where they explained why those blocks would be nonsense.
Hilariously, the issue creator still hasn't given up and is now trying to communicate with the maintainer privately. š
I'd really want to know what's driving them. Surely no sane person would be this persistent without some ulterior motives?
likely ego
He's such a manchild, it's unbelievable. Won't budge when talked to in a friendly manner, will lash out if someone else calls him out, and will continue to complain in responses to civil people, saying nobody is being civil and whatnot, just for the sake of adding fuel to the fire. He got sat the fuck down by the repo owner, and the schadenfreude is fucking delicious.
They have a repo named reeeeeeeeeee that only contains basically an empty README.md I don't like to generalize but that speaks volumes.
Pun intended?
I am missing some Internet lore. Can you summarize the first of the volumes? Is it 4chan adjacent?
But did they add addy.io?
It appears that the Github user GalacticHypernova is not a contributor to the 7c/fakefilter project - just someone asking for some domains to be added. The current list does not contain proton.me or protonmail.com.
I suppose this might be a reasonable litmus test for the reliability of that list.
The one who opened an issue is either 13 years old and dumb as a log or a troll (also dumb as a log) and this project is barely used, like at all
So please, don't give them attention
That comment chain was utterly hilarious. The OP practically wanted to block every email provider in existence.
You know because you can create spam from practically every provider. I guess it's good that this kind of idiocy is hashed out rather than just being implemented blindly with a pull request.
And once he got sat the fuck down, he wanted to continue discussing the topic "privately, away from the toxicity", going full out Wormtongue. Fuck him.
Stop all spam with this one simple
trickfilter! All spam emails contain '@', therefore all emails containing '@' are spam and will be blockedYou cannot even make it past the half-way mark of the OP to realize that the creator has no idea what they are talking about.
Continuing the discussion, the fact that they are so defensive and immediately hide behind moral high ground when someone calls out their mental gymnastics out for the bullshit they are, makes me believe that they are a troll. A child would lose interest after getting so many negative responses.
The behavior you see from the creator is close to a troll tactic called "sealioning". While refusing to give their own claims any plausible proof (they constantly talk about "tests" they've run without any specification thereof), they request elucidation or sources for any contraindicating claims (here in the form of discussions which are held off-platform, e.g. on Discord), but fail to engage with any proof of the contrary (refusing to take protonmail and several other legitimate providers off the list even after talking to the literal CTO) while just reiterating their standpoint over and over again.
All the while, they pretend to discuss sincerely and are always polite and superficially receptive to counterclaims. This is key to their general strategy of eroding a victim's patience and exhaust their attention. One of two outcomes generally occur:
a) The victim snaps. In this case the troll will claim moral high ground and garner sympathy from 3rd-party observers because of fickle reasons like "there is no reason to insult somebody on the internet".
b) The victim leaves in order to not appear unreasonable. On a public platform, like a thread, many observers will then grant the "victory" to the troll because their stand point seems strong and counterclaims seem indefensible. This is the ultimate goal of the troll and what makes it dangerous.
Just reminds me of an idiot PM we had who after realizing you could do the + thing on Gmail addresses made the devs block it, then didn't understand why qa and anyone else testing using those types of email accounts got mad when no one could get in or create new accounts
The whole exchange between the ProtonMail person and the repo maintainer is wild. The maintainer is clearly grinding and axe and pretending we should thank them for it https://github.com/7c/fakefilter/issues/73#issuecomment-1785182508
That dude's not even a maintainer, just some rando who apparently doesn't like protonmail.
Imagine having that little happening in your life
Lil bro asks for discord instead of using email ahaha
Email is for boomers duh
deleted
Apparently Discord is preferable to email for long form professional communication lmao
It's absolutely wild to read. This bloke absolutely has issues, what a weirdo
That's not the maintainer, just the user who opened the issue. Here's a (somewhat ironic) interaction between the same user and the maintainer: https://github.com/7c/fakefilter/issues/69
deleted
Why does anyone care? The npm package has 3,712 weekly downloads. They're trying to act like it's some mainstream package that a lot of companies rely on, but nobody uses it...
I'm tired of watching bad ideas grow into industry standards.
Fair point.
Funny, considering I've moved over to a paid proton account as my primary email, and my former primary email/Gmail account, with its ability to instantly become infinitely many disposable email addresses, is now used as exactly that. This same procedure occured many years ago, when I made my yahoo email into the disposable junk mail home, and my shiny new Gmail became my primary. I wonder how many years it be until proton becomes my disposable, and some as-of-yet to be created service becomes my new primary email. Or maybe email will finally be dead by then, and we'll use something else entirely.
I will say, even after all of these years, and using the living shit out of my Gmail account in many, many places, I still only get two or three spam emails at most during the entire year.
No, you very likely get way more than that, they're just filtered out.
This. I get tons, but almost none of them actually hit my inbox.
Wouldn't OP see them in the Spam folder? If they say they get 2 spam messages they probably mean that.
Yep, mail to the spam folder is what I mean.
Same, gmail now means garbage mail and only acts as a filter for my Protonmail now.
as someone who uses protonamil as my main email, this is very disappointing
Based on this other issue by the same user, I think there's no cause for concern that the dev will actually blacklist PM/SL: https://github.com/7c/fakefilter/issues/69
Anyone working with GitHub probably knows that it'd be lunacy to just act upon every issue/PR that people come up with.
Looks like someone noticed the PR and panicked. Then people someone crossposted here and people picked up the pitchforks a bit too early.
š±š±š± who are we going up against today š
what did protonmail do to you ._.
Can you show us on the doll where it touched you?
this is someone probably <13
"RobloxPianoAutoplayer" "Anime-Clicker-Simulator-GUI"
what??
also their "Guardian V2" repo
jeepers weepers man isn't it so cool to have their anti-cheat so customizeable??
These genius also wants to block Tutanota too. What a joke. Never heard of this project and I will now go back to not hearing them.
I'm really not a fan of heavy-handed approaches like this. I understand why most of the listed domains are on the proposed blocklist, but Tutanota and Proton are the two most common private email options. Rambler is a Russian news aggregate, so I'm not sure why that's in the list, politics aside
I've seen random surges in emails from Rambler.
Power Users: Block all emails that arenāt Gmail or Outlook!
Also Power Users: Why are Google and Microsoft monopolies!?
If that's the case, they should also block Gmail.
They did, the maintainer commented that they weren't going to add Gmail and proton mail.
So I gotta start using my AOL email again?
They'll never suspect CrAzY6969x@aol.com is a phony!
Hah, there's also
seznam.cz(meaning "a list") - I wouldn't be surprised if more then half of whole Czech Republic (so ~6M) uses that as their primary mail provider.It's also a main local web search and maps provider among other stuff, and pretty popular with non-english speaking part of the population.
If the maintainer accepts this they would be most probably killing the project, can't imagine people using it when it drops their user registration by a lot because of blocklists this wide.
Same for Poland - wp.pl and o2.pl are the most used email providers over here. Most of my family have a wp.pl email, nobody uses gmail or anything else.
Seriously. If someone in Czechia doesn't use gmail, it's almost guaranteed they use Seznam
This blockist doesn't have that many users, though.
Yeap 83 businesses are my clients. If they do this ,guess they will never receive my email. Poor IT support of all the businesses. RIP
It would be a poor IT department if they just blindly implemented a block list that had been handed to them and allowed that block list to be updated regularly with no oversight as to what was changing.
Not to say there aren't companies that do that, because there are plenty...
Well there wouldn't be a company for very long if they're blocking potential customers
The issuer is just a random GitHub user. Keep pushing back the PR.
That's why I have setup a custom domain and catch all so I can create aliases on the fly. Was huge fan of simplelogin until I did a though experiment about ditching proton mail. I will not pay for email aliases.
I am not sure I understood your comment. I am using protonmail (ultimate) and they do have free simplelogin integration (I think proton bought SL). Definitely catchall is my way to go for reputable sites, but SL is great for trash "register once" sites so that I don't even disclose my domain!
Using a simplemail means you are bound to a provider, in this case ProtonMail.If you setup a custom domain you can ditch ProtonMail/Simplelogin duo domains and switch to a different provider whenever you want.
Oh yeah, this makes absolutely sense. I do use simplelogin only for things I don't really care about, but it is definitely a good point what you are saying.
Could you please share the steps you took for this? I have an inkling , but not sure how to proceed. I m thinking of learning self hosting too, but can't right now due to reasons.
I bought the domain, set required domain records as per protonmail docs, waited for verification to complete and enabled catch-all thingy.
https://proton.me/support/custom-domain
I did the exact same thing.
When I saw Fastmail with aliasing features (beyond just using a catch-all with my domain) included in their $30/yr plan I couldnāt switch fast enough.
I guess Proton thinks they can rest on their name (which, admittedly, is a good one). But why pay for simplelogin + Proton when others do exactly what I need?
Duck duck go offers this service for free, they will forward to your regular email. Provided the generated addresses are random.
This is the way. I finally got around to setting this up a few months back.
Thanks for adding an update to your post OP. Good to know cool heads prevailed!
Truly a sad day for poppy heads
Do keep in mind, it seems like protonmail is considered a whitelisted domain in the eyes of lead that's running that project. I say this because if you go under the issues page of it and then select the whitelist issue which is the issue that he uses to keep track of every domain that will not be blacklisted, protonmail appears there. That being said the others don't appear.
I love how dense OP was that he didn't even acknowledge the white-list and was acting like he was the authority (or the sheriff) on this topic, with nothing to back him up whatsoever.
Thatāsā¦a good portion of the free email providers on the planet. Even if companies are using this list as a filter for signups, itās only going to be for a limited time.
Companies want new accounts. They donāt mind very much if those accounts are fake - big numbers get investor attention. It only takes a handful of support cases with āI tried to register but it says my email address isnāt allowedā before the C-suite makes it clear to IT that this filter is no longer in sync with the corporate strategy.
Ironically I'm paying for proton because the free services suck.
I can actually well imagine them responding to use a Gmail or short list of major domains. Normies are normal and the companies want an email they can link to all the other data on the web.
That was a fun read.
Hard for me to understand how blocking valid email providers like Proton, Tutanota, and Skiff, would actually mitigate any abuse. All it's going to do is hurt the websites with this filter and prevent privacy-minded folks from signing up. Unfortunate to see, hopefully they get some common sense and don't block these for no reason.
Nice raid Lemmy
I know I gotta receive some slack for this, actually all my temps emails are outlook ones, they do not require a phone number and I can redirect all traffic to my main one easily and sort it there with rules.
I don't understand, what's happening? Blocked where?
Nothing is happening, some kid was making requests that were entirely ignored until lemmy jumped in. I cried when they said that they preferred discord to email for official communication.
I thought that bit was hysterical.
"Tell me you've never been employed before without telling me."
"I prefer discord for business communication."
Yeah, not being able to keep track of email was a weak fucking excuse.
Yeah, they should have pushed back and said "Nope, email is the only method we will conduct professional communications over."
Is the creator even a kid? I find it hard to believe a kid would give that much of a shit about email spam lists. But, then again, nearly half his repositories are forks or involve Roblox.
The creator is a chad
Some random email filter project.
Oh well shit if I care, I loathe email anyway. Please block me š
Can someone please explain to me why they can't create the account even if it is used as disposable? Storing one text file with the login on their side does not cost much storage at all.
Because they want to sell it and spam it.
Simplelogin supports custom domains. This is a non-issue if you use your own domain(s).
It's actually really easy to get past the custom domain issue.
If the domain is send-and-receive, it will need a SPF record to avoid getting blackholed by most mail providers. A TXT lookup for the SPF record would tie the custom domain back to the real provider.
Or even easier, you could look up the MX records to see what domain they point to.
I don't use Simplelogin so I don't know how their service works. The domains used for aliases don't need to originate email so there's no need for an SPF record. The A record for the hostname used for the MX record(s) could technically point at multiple IPs that could be changed often.
I own a significant number of domains and manage my own servers. There's quite literally no way for anyone to prevent me from using an email alias.
My point was that trying to block email aliases is a fool's errand. It's a slight hindrance to only the least technical users. The entire 7c/fakefilter project is an exercise in futility.
This happens to me occasionally already as a paid Fastmail user. I switched from Gmail about a year ago and I canāt change my existing Yahoo account to use Fastmail.
I get it, we deal with fraud and abuse from throwaway emails all day at work, but it is frustrating for sure.
Hmm worrying. I switched to Fastmail too and use a lot of their 'masked emails'. No problems so far, touch wood
I guess this is why spamgourmet became almost unusable in recent years. It's a pity because the service is effective at blocking spam but I can imagine there is abuse potential.
Every ~3 to ~5 years I change my free email addresses (gmail, hotmail/outlook, yahoo, etc.). Although, I don't use yahoo anymore.
I have turned a few of my old gmail accounts into spam mail trawlers as I āGotta catch āem all! ā and every time I have to make a temporary or single use account for a service I want to check out/try or I just foresee making only a single purchase I always use a gmail account+alias if they don't have a guest checkout option. The old gmail accounts are checked quarterly on a if-I-remember basis but at least once a year.
On first contact with any business, services or people I have never met in person I usually give a newer gmail address I check biweekly in case my forwarding filter missed something important.
Moreover, I use gmail incoming mail rules to forward copies of important keywords and specific email address to my 2 professional (redundant) emails for which I enabled notification on my phone, main desktop and workplace.
Gmail is so ubiquitous and well trusted that I can pretty much use it in any input forms for registration or verification. Their spam filter is also pretty good (not always) to skip/pre-filter obvious phishing and scam emails.
Even though I have already moved away or avoided Google, Microsoft, Meta/Facebook, LinkedIn, Apple, TikTok, Wechat, Temu, PayPal, Sony, etc. I occasionally still have to indirectly deals with them on a limited case-by-case but specific situations.
By excluding so many excellent email services they are inadvertently making sure that Gmail, Outlook and other allegedly "reputable" free emails services slowly become a junk/spam/marketing email dump that few would want to enable constant notification for and fewer would want to delve into and sift through daily.
Sorry, this became a long rambling rant about all the layer of protections I have to use nowadays to just avoid wasting energy and attention on the profusion of spam/useless emails.
Would it help if they could check if the account is older than one month?
From 2018, I have been using fake emails for signup on websites that I am sure I wouldn't be using again.
In rare occasion that I do keep using the website, I change it to one of my 'useful' mails. This has kept so much spam at bay for me.
Also this list blocks it too https://github.com/wesbos/burner-email-providers/issues/422
Please help!
Hey make sure to get me in the next screenshot!
Based fakefilter suggestions