Disposable email domains without anti-abuse are blocked for forum registrations

admin

The attacks have stopped so we've turned this off for now. It will be quickly re-enabled with an updated list if the attacks start again.

Legitimate users occasionally use disposable email domains for throwaway accounts. Unfortunately, we've been forced to block using a subset of these domains lacking basic anti-abuse mechanisms. Domains for anonymous email aliases with anti-abuse mechanisms such as addy, SimpleLogin and Proton aliases will not be blocked as part of the blanket blocklist. We'll handle those alias domains separately as needed.

Our forum is being targeted with an extreme level of raiding with hundreds of accounts created every few days to direct abuse towards both community members and moderators. These accounts are being manually created and used to raid the forum so we can't prevent it with mechanisms for blocking bots such as captchas.

We're currently using a list containing around 75k disposable email domains lacking anti-abuse mechanisms. It comes with a list of around 30 additional domains with at least basic anti-abuse mechanisms which are not currently being blocked and will be handled on a case-by-case basis.

We're going to be adding additional defenses against raids and spam to the forum. Flarum v2 is currently in a release candidate stage and should have a stable release soon which has massive improvements to both Flarum and many of the extensions for it including several anti-spam / anti-abuse ones we use.

mspbonn

Finally 🚀

ClickClickDrone

admin
Thank you for adding measures like these which help keep trolls out -- it means a lot to me!

r134a

It is unfortunate time has to be spend on this cause, but it is what it is i guess. The recent spam streaks (allthough originating from 1 person i think) have indeed been quite disruptive.

Carrousel7956

I advocate for this mitigation: moderators approving the first post of an account.

Currently, the spam gets removed manually and quickly, therefore the first posts would get approved at a similar rate. It's privacy focused and will stop anything but extremely focused human engineered spam.

It's like avoiding badness enumeration in a sense. It's impossible to list all bad actors, so why not only allow good actors. Of course it can be combined with any other methods that are desirable, though.

I can't speak to whether the burden of manually approving every forum user would be an unreasonable ask of the moderation team, but my idea is only the first post of a new account, which is not many and could be quickly eyeballed in a unified interface. It seems to me that it would be easier than hunting for specific first-posts that are rule-breaking.

Many forums like Privacy guides.net, monero.forum use this technique.

I don't know if it's possible on Flarum so that could easily disqualify this approach.

Curious to hear the admins, moderators or anyone's thoughts on this proposal.

Carrousel7956

Appreciate the transparency with email blocklists, many sites have opaque anti-spam measures which can make it a pain to sign up privately. This demonstrates how much the maintainers of the project care about their user experience.

_zack_

I think that admins are doing the right thing. In the last couple of days there were very nasty posts against the community. If a person who may even not be a GOS user visits the forum homepage and sees profanities it is not a good look for the project and the community. I think that as members we might try to contribute by promptly flagging spam accounts/ posts thus reducing the necessity of this temporary ban.

admin

We'll get some extra tools to protect against these attacks when we upgrade to Flarum v2 but it's still in a release candidate phase and we currently don't have time to deal with making a test deployment. We don't want to try upgrading the main forum to it and potentially breaking it for hours or longer then having to roll it back. That means having to set up a test environment for it. We don't have time for it right now.

admin

Carrousel7956 The person putting the most time into doing this is incredibly malicious and more than willing to pretend to be someone acting in good faith prior to spamming abuse. It's something we can start doing as another protection but similar to blocking large batches of the domains they're using, it won't stop them.

legreteco

admin As always, a fraction of the users are responsible for everyone else having to live with the consequences. I completely support your decision, even though I like to use throwaway emails.

DeletedUser1041

admin as one of the many who kept seeing the mass barrage of posts and was reporting them, thank you. Raccoondad did nothing wrong!

admin

@DeletedUser1006 The initial post has been updated to clarify that we're still currently permitting domains for email aliases with anti-abuse mechanisms included. We're currently permitting SimpleLogin, addy.io and other options but those will be blocked as soon as they start being heavily abused and will remain blocked until the services stop the extensive abuse. If they can't stop it then they'll remain blocked when we have raid protection enabled and will only be unblocked when the forum isn't being actively raided.

admin

The initial post has been updated based on improvements to the blocklist including a 2 tier split between services completely lacking anti-abuse mechanisms and those trying to stop abuse. The forum will use the regular blocklist not blocking services during times we're being heavily targeted by raids. We'll handle the extra domains added by the strict blocklist on a case-by-case since there are only a few groups of those which don't add up to a large number of total domains. We're going to remove the outdated discussion especially since the malicious troll raiding our forum came to this thread to derail it.

DeletedUser1041

admin are Proton pass aliases and simple login seen as the same thing in this context? For example if I used one of them and then banning them becomes necessary does my pre-existing account get banned as a result or is it grandfathered in unless I do something similar(which I wouldn't do)?

admin

DeletedUser1041 It only blocks domains from being used for initial registration and changing the email for an account. Existing accounts using these email domains aren't impacted and will continue receiving emails.

Our initial approach of blocking sending our own emails to the domains which were being abused did impact existing users because they would have started missing emails. We moved to using an extension which builds it into Flarum and we've figured out how to replace the far from adequate list it uses with our own. We found a very well maintained high quality list split into a regular tier and a strict tier where the strict tier is where those alias services trying to prevent abuse end up in via an added list. We're using the regular tier but we're prepared to more temporarily block domains in the list added by the strict tier as needed. We can also expand both lists as needed ourselves, but the new list is much higher quality and already aggregates disposable emails from a bunch of sources along with filtering out false positives with multiple approaches including a whitelist to prevent it blocking major email domains by accident.

DeletedUser1041

admin understood, thanks for breaking it down and finding a solution to it. Seems like a headache to have to deal with.

admin

Johnnyloans You're welcome to try to find disposable email providers which aren't detected by it. One of the new ones the malicious person started using was added to the standard list today rather than us having to add it. We haven't automated updating the list yet but we can do that if their attacks continue.

It's intentional for addy, SimpleLogin, Proton aliases, etc. to still be usable because they have at least basic anti-abuse and we can handle those case-by-case when they're being abused.

admin

The attacks have stopped so we've turned this off for now. It will be quickly re-enabled with an updated list if the attacks start again.