Disposable email addresses

[Ben Fairless]

Hi everyone,

I’m wondering If anyone else is seeing an increase in the number of people making accounts using disposable email addresses?

In our case, every so often we will see a spike in the number of accounts made from a specific domain. Usually each Account will make a request or add an annotation. It feels like it’s the same person, however we can’t be 100% sure.

Would be great to understand how others are dealing with this issue (if at all).

Thanks,

Ben

--

Ben Fairless

OpenAustralia Foundation

openaustralia | planningalerts | righttoknow | theyvoteforyou | morph

[Gareth Rees]

Hey Ben,

Yes, in short we've seen similar patterns leading to a policy change prohibiting disposable email use [1].

We've added some theme code to prevent their use [2] and add minimal rate limits for any existing accounts [3].

We've also added a weekly report to keep an eye on signup domains [4].

All of these are theme customisations, but could be pulled into Alaveteli core if there's demand (or indeed, if anyone reading wants to do this work it would be most appreciated!).

Best,

Gareth

[1] https://github.com/mysociety/whatdotheyknow-theme/commit/2a952f5

[2] https://github.com/mysociety/whatdotheyknow-theme/pull/2020

[3] https://github.com/mysociety/whatdotheyknow-theme/pull/2030

[4] https://github.com/mysociety/whatdotheyknow-theme/pull/2034

[Mattias Axell]

Hi Gareth,

Please pull it into Alaveteli core (or maybe rather Alaveteli example
theme?)

Best,
Mattias

> OpenAustralia Foundation <http://openaustraliafoundation.org.au/>
> openaustralia <https://openaustralia.org.au/> | planningalerts
> <https://planningalerts.org.au/> | righttoknow <https://
> righttoknow.org.au/> | theyvoteforyou <https://
> theyvoteforyou.org.au/> | morph <https://morph.io/>
>
> --
> You received this message because you are subscribed to the Google
> Groups "Alaveteli Dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to alaveteli-de...@googlegroups.com
> <mailto:alaveteli-de...@googlegroups.com>.
> To view this discussion visit https://groups.google.com/d/msgid/
> alaveteli-dev/3f882caa-10e4-491c-b5a4-eafd6f0ce6d6n%40googlegroups.com
> <https://groups.google.com/d/msgid/alaveteli-dev/3f882caa-10e4-491c-
> b5a4-eafd6f0ce6d6n%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Oliver Lineham]

What exactly is the issue they're causing?

Are they using them to evade bans or request limits?

Otherwise I don't see the problem. In my professional life I recommend using unique addresses per service for a number of security and privacy reasons.

Oliver

--

You received this message because you are subscribed to the Google Groups "Alaveteli Dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to alaveteli-de...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/CAKnAbpYvnDwT9-pyZs2ULvAL%3D5YGYCvVf0WPLBUCTomKpTF9FA%40mail.gmail.com.

[Ben Fairless]

It appears that one person is creating multiple accounts using a “10 minute mail” type service. Each account is then making a single request to the same authority for similar documents - ultimately causing that authority to be overwhelmed with requests.

--

Ben Fairless

OpenAustralia Foundation

openaustralia | planningalerts | righttoknow | theyvoteforyou | morph

To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/CAOPSvnAOjY0N5nTC8rMgW2RKB%2B4Nj6d6TM3FYpJ6_9dxyUB9Vg%40mail.gmail.com.

[Ben Fairless]

Hey Gareth,

Awesome work here!

Apologies for the silly question, but if I wanted to bring your changes into our theme, do I need to set the USERCHECK_API_KEY in general.yml? Or does it need to be set another way?

Many thanks,

Ben

--

Ben Fairless

OpenAustralia Foundation

openaustralia | planningalerts | righttoknow | theyvoteforyou | morph

 --

You received this message because you are subscribed to the Google Groups "Alaveteli Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to alaveteli-de...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/3f882caa-10e4-491c-b5a4-eafd6f0ce6d6n%40googlegroups.com.

[Graeme Porteous]

Hi Ben,

To set USERCHECK_API_KEY we use the config/rails_env.rb file where we put: ENV['USERCHECK_API_KEY'] ||= '...' 

If we port these feature to core then we would move to general.yml

--
Graeme Porteous
gra...@mysociety.org

To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/CAKnAbpaYXeRA0VEaVZRbfvsPRGza7mj9Ov0oRCXPK9LAmB4B8g%40mail.gmail.com.