Show HN: Startup with no website - GuerillaClick@gmail.com

I have first.last@gmail.com and I've had people play poker and lottery and sign up for dating websites with my e-mail address. I've also received confidential information from insurance and building construction companies.

It's hilarious.

It's no crazier than using any other disposable email service... if I'm registering an account at neopets.org or whatever I probably just don't care.

In that regard though, it's not different to existing throwaway email services. I'd use this sort of thing for registering for annoying things like "free" wifi.

I own a domain which a lot of people on the Internet like to randomly type in when they are signing up for things. It is ridiculous how many services accepted those fake email addresses over the years and therefor how many accounts I could reset passwords for.

I don't understand what point you're making. Isn't that true of mailinator.com too? Have you never signed up for an account on a service you didn't trust not to spam you?

Unless you don't want an account. So many things require stupid email verification just to get at no transactional stuff like content.

and it pollutes the googleborg no less, by using a gmail account.

occasionally people (accidentally?) use my (long-in-disrepair) gmail account in this way, and it's amusing to see their little peccadillos. sometimes you get the devilish chance to change subtle details of an online profile =D

not to mention the damn google dot hack that still works with all gmail email accounts...

If you are worried about your user details getting stolen after signing up with someone else's email-

You aren't using this service correctly.

The idea is to not give away your email or signup for a website, but get access to that website.

Google TOS is pretty broad. However, one of the main factors here is that export controls could quickly come into play. Since Google is US-based, providing this service for those in embargoed countries could get you shut down quickly.

They also have a "don't misuse our services" clause and I'm sure this would count as misuse if found.

>Is it allowed under GMail's TOS?

Do you even have to ask? The answer is a clear 'NO'. There is zero chance that Google will allow you to abuse their email service in this way.

I hope OPs personal account isn't in anyway related to this account because when 'guerillclick@gmail' is inevitably banned, his personal account may be collateral damage.

Because overwhelmingly the HN crowd thinks building an app is building a startup.

If the Yo app can raise 1.5 million...

The monetization is having a curated up to date list of email verification handshakes.

This has value.

Gmail gives you another option - separate using dots.

g.uerillaclick@gmail.com

The number of options is of course limited but it's still recognized as a separate address while still coming into the same inbox

It's within RFC, but they all lead to one email inbox so you end up being able to manage multiple third-party accounts from a single email account. It's recommended to not reject these, but strip them: https://gist.github.com/judge2020/af8fb9cd2ac165462d44de4e58...

https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

Years ago I locked myself out of my Amazon account. Since I really wanted to keep using the same email account (and I didn't care about Amazon history, nor did I wish to go through an official account reset) I resigned up using a +suffix. I'm still amazed the second account was able to be created, though it's possible it's no longer allowed since this was around 2005 or so.

I will open source whenever I have time, I just did it last night and decided to share.

The "link-clicking" can be done using a Google App Script. I've used it before to auto-accept AWS opt-in notifications for Elastic Beanstalk environments.

My code was tied to a Google Sheet that would hourly pull matching emails, use a regex to extract the link, send an HTTP request to the URL, and record the URL and response in the spreadsheet.

Having a high level description of the code isn't as useful as the code itself. Alas, my code was part of my Google account at a previous employer.

> You can use Mailinator to do this already

While I'm a fan of Mailinator and their approach, I think the feature OP has about auto-clicking verify is unique. But yes, to do this right, you need the multi-domain approach of Mailinator instead of just aliases. Maybe Mailinator has an API or supports POP/IMAP that would make this possible, I haven't checked.

but the list of mailinator domains is easily looked up and blacklisted by most major sites. the op's insight is that sites won't blacklist gmail

Turns out those r/TIFU stories were fake. A Googler from the GSuite support debunked the claim. [0]

[0]: https://amp.reddit.com/r/google/comments/8l231x/google_banne...

That seems like it would be incredibly easy to DoS someone.

More and more services recognize disposable e-mail domains and don't allow such addresses. Obviously they can't block the gmail.com domain.

I like the idea, but it probably is against Google's TOS, so there's that ...

Or: ask the user to use the same browser and check that cookies match / "sanitize" gmail adresses

> I've always wanted sort of the opposite. I'd sign up to a website, and they wouldn't ask for a password. To login, they would email a link to click and I'd be logged in for however long that cookie lasted. Why don't sites do that?

> (Is email still considered slow? I remember having wait times in the hours back in the 90s, but I'm not sure I've ever waited anywhere near a minute in the past decade.)

Tumblr does this at the moment. It asks for either email click or a traditional username/password setup.

Passwordless authentication exists, Medium has it, I've implemented it before, and I prefer it myself. The biggest issue being it adds an additional step, that most don't want to deal with. What if they don't have access to their email on that machine? Blasphemy, but it happens.

This is basically how steam works these days.

Sure, there is a "password" - but they won't let you log in without also verifying you have access to your email account - and you can reset that "password" only knowing the username and having access to the email account.

Tumblr does that now.

I’ve never used the feature. I have an integrated password manager.

Medium actually does this.

How'd you log in if you lose control of your e-mail?

I wouldn’t say “most”. The sites where you have to verify are probably more sensitive and not something you’d verify with this service or a throwaway email anyway.

A lot of these sites know when you're using Twilio numbers and reject you anyway.

Is it a problem though for legit sign ups? I find the problem is that when you click the link in your email, you now have 2 tabs open. One with a verified login and one without.

Because it's a gmail address, you can put as many . as you want anywhere in the name. Gmail strips them out when determining the email address.

A feature of what?

If this guy can convince people to send him their registration codes and somehow monetize it he's in business.

great idea, which also warns about the websites it won't work on.

some require session authentication, so bot needs to login and THEN verify.

Throwaway/shared e-mail addresses are not for accounts you care about, they're for working around stupid requirements to register "for free" to access a resource you need.

some sites prevent mailinator accounts on signup

That has to be the worst idea of the year. You are essentially blocking perfectly valid emails on the assumption that one single email provider uses the + character with some special meaning. Congratulations, that's how you break the internet.

I will call support to notify them my e-mail (with a + in it) isn't working, like I have done before. No I don't have another e-mail address. Yes, this is really my e-mail address.

When a website presumes to normalize my Gmail address, I presume they aren’t interested in my money.

You are well within your rights to prohibit duplicate signups from the normalized address, but please don’t presume to replace what the user entered.

Kind of a slap to anyone who uses email aliases to sort/filter email

You may want to allow email aliases, but ignore the 'alias' part when checking for uniqueness.

Please don't. It's an important feature for a lot of people (me included).

Just ignore it when checking uniqueness, if you really must

The problem is that you are no longer compliant with the email spec: https://tools.ietf.org/html/rfc5322#section-3.2.3

Does nobody read RFC’s anymore?

I'd reconsider this change. Lots of people use email aliases to track which sites share their contact details with third parties. I see it all the time in signups for one of my sites - don't mind, of course, because I don't share their data. If you stop people doing this it might send the wrong message.

That's downright silly and a user hostile move, IMO (why at all wouldn't you want someone to test things out without having to give one of their main email address?). Your solution seems to assume that everybody uses only Gmail and Gmail plus addressing. Gmail also considers dots/periods in addresses as not existing. Try blocking those too (no, actually don't try this!). There are so many temporary or disposable email services that you'd be wasting your time trying to disallow all those. Your time could instead be better spent on making your product or service more attractive to paying customers.

Excellent work. Now disallow catch-all email addresses. I'll wait.

Well surprise, I actually use that feature in real life with my real email.

It is really helpful if you want multiple profiles for a service (ex. Different mode, different recommendation) or in filtering all emails sent to that specific address (can't filter with the "from" as I don't know who is emailing me)

Please don't break standards

But, then you are not complying with standard email, are you? See https://tools.ietf.org/html/rfc3696#section-3

I use an alias for every website, like me+apple@gmail.com to login to Apple.

Not sure of your app, but what do you care if multiple people share the same inbox? They can always with something like Mailinator or other domain-level aliasing.

Revert that change. Just like DRM is easily defeated, so is your webapp's alias check, one can simply buy a few cheap domains and your checks fail.

Great marketing for your services since you're putting them in your profile.