ProtonMail and SimpleLogin emails will be blocked from registering on websites

If a website won't allow me to register with my protonmail , I will just not used that website.

Yep.
I've already run into a few. I mentally thank them for preventing me from wasting my time and money with them.
- Is this going to be the response every time this shit happens until we're all just sitting on Lemmy twiddling our thumbs? The arrogance feels like it's downplaying the seriousness of the problem, and it's annoying to see it recited so much.
  In a lot of cases, you may not have a choice of using the site or not. In cases where you do have a choice, eventually most if not all the alternatives can do the same shit if it becomes normalized.
  API is letting these types of filter lists become shared easily, too. Sites may not even make a conscious decision to filter out proton, it may just happen because their filters are pulling from lists like this.
  The problem is the trend. And try as you may, you can not fully escape that.
Same. That said, sometimes it’s a config error. I sent a very annoyed email to a website that didn’t work on Firefox, only for them to tell me that it was a bug and that they fixed it.
Yep what a wild thing, to try and filter email domains so they can try and find "fake" providers

And since people won't use the website, the website won't use the list. So the list would be useless.
The maintainer seems to have followed the same interpretation, weighing legitimate use against spam use. This is the official response to the issue as of 8h ago:

Dear Contributors,
We value your suggestions for expanding our list of disposable email providers. Your input is crucial in enhancing our tool's capabilities.
Decision on Gmail and ProtonMail Inclusion
After thorough evaluation, we have resolved not to include Gmail and ProtonMail in our list. Our rationale is based on the following technical and operational considerations:
 
        1. **Reputation and Reliability**
       
       * **Gmail and ProtonMail**: Established, reputable providers with a high trust level for personal and professional communication.
       * **Distinction**: Unlike typical disposable email services, they offer long-term, reliable email solutions.

    2. **Active Abuse and Spam Prevention Mechanisms**
       
       * **Effective Systems**: Both providers have robust mechanisms to detect and mitigate abuse and spam.
       * **Proactive Monitoring**: Ensures a secure email environment, reducing the prevalence of malicious activities.

    3. **Commercial Intent of Typical Disposable Email Providers**
       
       * **Focus**: Targeting providers driven by ad revenue, facilitating spam/abuse.
       * **Gmail and ProtonMail's Model**: User-centric, not primarily ad-driven.

    4. **Domain Limitations**
       
       * **Effectiveness**: Limited domain offerings by Gmail and ProtonMail make them less susceptible to misuse.
       * **Strategy**: Focusing on providers with extensive, rotating domain lists for more impactful filtering.

    5. **Individual User Accountability**
       
       * **Accountability Measures**: Both services have mechanisms to penalize users violating terms, decreasing misuse risks.



  
Summary and Next Steps
Including Gmail and ProtonMail does not align with our criteria for identifying disposable email services. Our aim is to target services significantly contributing to online spam and abuse, without impacting legitimate email services. We have reviewed your list and agree on adding some providers, like internxt.com (Reference). We will also incorporate the obvious choices from the tail of your list. We apologize for the delay in addressing this issue but intend to promptly resolve it by focusing on the most impactful additions.

Simple as, if they don't even support e-mail it's surely a rather shite site.
The closed garden corpo-approved electronic message service the github issue is talking about simply won't do.

Damn, that guy's fucking dumb lmao

But also, is 7c/fakefilter even popular? It seems to barely have a following on GitHub to begin with. Seems pretty over the top to claim that PM and SL (and any other provider on that list) will get blocked from registering on websites.

And reading the project description the domains aren't even added manually. So the whole issue isn't needed at all. Might explain why it's been there since October.
The npm package has about 4000 weekly downloads. I don't know what that means in terms of popularity.
- Less than left-pad. JavaScript devs are wild.
He's not dumb, he's extorting people who will probably pay him.
- Nobody's going to pay some random idiot who opened a ticket on a repo they aren't even a contributer on.

Sick of sites requiring an account, email or phone number. Makes the web even more unfriendly. I hope temporary emails can always get around filters, as if you play stupid games you should win stupid prices.

I was in a club and had to open an account to open a tab, they asked me for my government number ID, pretty standard, but then they started asking for phone number, age, email, Instagram account and I was like wtf, I just want a bottle of water!
- Where do you live that providing your government id to a business is standard? In Germany, the only one outside of a judge to be allowed to request that is law enforcement ( even then only with proper cause ). Of course, some businesses are legally required to request and process your ID number ( e.g. when booking international flights, medical insurance companies etc), but these are under tight federal control and supervision to ensure data safety.
  Age verification sometimes is a thing for purchasing 18+ things ( media or drugs like alcohol & smokes), but even then businesses will only ever perform a visual check of the date of birth on your ID. Technically they can never demand to hold your ID, not even for a short time just to better read the date. You only have to show them your ID. And actually recording and/or storing any of that information would be insanely illegal.
  Germany / Europe might have its issues, but we at least try and take our freedom and data privacy serious. I would never dream of handing my ID to a generic business like a club for anything more than the age check.
- they asked me my government number ID, pretty standard
  How very dystopian.
Just keep using the temp emails and when they don't recieve your email , call them up. Their IT support will unblock it after 50-100 calls. Remember consumers have the power.
I tried to report an issue in GitLab. I needed to input my phone number and payment information to create an account. WTF? No thanks, I'll just not report the issue.
- do you guys not have phones
  When buying stuff online I find 0101etc works. Public numbers used to work fine for other things but not so much these days. If that doesn't work I usually don't give a damn about the service at that point (e.g. ShatGPT) #TeamBots
Sick of sites requiring an account, email or phone number.
Blame bots. The other day we had a post about how 70% of account creation processes on sites are started by bots. Imagine that if you didn’t even need confirmation.
- What if account creation was local (e.g. Git and keys)?
  If no data needs to be stored then no account is needed. Use the system where there is a unique indentifier based on the password.

the discussion is happening here: https://github.com/7c/fakefilter/issues/73

Someone working at Proton has commented on the issue, the list maintainer wanted to take the discussion with proton private so we have only a few posts from them.

If you want my personal take:

It's very clear how the list maintainer opposes anonymity in the internet in any form, which I see as an attack on freedom, journalism and activism.

I'm not a fan of Protonmail of any sort and in fact I consider that their privacy is lacking... but I really hope they can talk some sense into this guy. This block list seems to be used by a lot of webs that will start blocking virtually every private email provider.

(Edit: I assumed the person that posted the email list was a maintainer, but they don't seem to have a "contributor" or "owner" badge, so idk. Maybe they are just very angry at privacy and anonymity on the internet)

What do you consider to be a good privacy focused email solution that allows anonymity?
- I would love to know this too ☺️
- Is addy.io any good? I’ve poked around a bit but not investigated deeply
- What do you consider to be a good privacy focused email solution that allows anonymity?
  cock.li
- Try Tuta Mail
These lists are used by platforms to try and cut down on spam/bot account signups. This isn't a thing done for signups by the vast majority of platforms out there, but the API verification steps IS becoming more prevalent I suppose. I just got rejected for using a Protonmail domain to buy something outright on a very popular pet supplies platform the other day, but...eh.
- They’ll just lose my business and get a stern customer support email then. I don’t do business with companies that exclude Proton/Tutanota/Skiff emails.
It’s very clear how the list maintainer opposes anonymity in the internet in any form,
why would anyone ever be like this?
- Maybe a fed, corpo or authoritarian
- This is not the list maintainer. Just a rando who opened a request
Someone working at Proton has commented on the issue, the list maintainer wanted to take the discussion with proton private so we have only a few posts from them.
They're not the maintainer.
- I say that in my comment
  Edit: I assumed the person that posted the email list was a maintainer, but they don't seem to have a "contributor" or "owner" badge

OK simplelogin you can make an argument there, very stupid one though.

But protonmail and tutanota, wtf ?!?

Just because an email provider is privacy focused and offers custom aliases means all it's emails are spam ?

Fuck this shit.

I wonder what happens when they find out that you can do my.name+alias@gmail.com
- they seem to have it "covered"
- To be fair that's quite easy to check with a simple regex, you can see that in many services that have cached up to that.
- \+[^@]*
- Looks like you can even do this with iCloud accounts. They only let you have 3 at a time, but you can delete them whenever and create more as needed.
  https://support.apple.com/guide/icloud/add-and-manage-email-aliases-mm6b1a490a/icloud
Advertisers aren't interested in your privacy. Simple as.

Am I the one one thinking this post is blowing the topic way out of proportion?

The post title is clickbait in its purest form: nothing is being blocked (from what even). There is a single issue raised on some obscure filter list... This has no consequences whatsoever. I am wondering why Protonmail even bothers to comment on this issue...

Honestly, the more these one time accounts try to convince me to remove protonmail and simplelogin, the more I see how much it's needed to block them. It's like the marketing team is desperately trying to keep their services from being rightfully flagged and it just makes me want to block them even more. I do hope they won't cloud your judgement @7c , as these services are used for temp emails by all definitions. If you have any questions you may always ask me from the conversation we have started :)

Shit like this is what makes me want to pull my hair out at night

Yea, I guess it's impossible to make burner gmail accounts too...

Based on how GalacticHypernova is talking on that thread you'd think Protonmail, Tutanota, Skiff, and SimpleLogin's CEOs all made fun of them in high school and started their villain arc

Bold of you to assume they've been to highschool yet

The issue has now been commented on and was closed by the maintainer, where they explained why those blocks would be nonsense.

Hilariously, the issue creator still hasn't given up and is now trying to communicate with the maintainer privately. 🙃

I'd really want to know what's driving them. Surely no sane person would be this persistent without some ulterior motives?

I'd really want to know what's driving them
likely ego
- He's such a manchild, it's unbelievable. Won't budge when talked to in a friendly manner, will lash out if someone else calls him out, and will continue to complain in responses to civil people, saying nobody is being civil and whatnot, just for the sake of adding fuel to the fire. He got sat the fuck down by the repo owner, and the schadenfreude is fucking delicious.
But did they add addy.io?

It appears that the Github user GalacticHypernova is not a contributor to the 7c/fakefilter project - just someone asking for some domains to be added. The current list does not contain proton.me or protonmail.com.

I suppose this might be a reasonable litmus test for the reliability of that list.

The one who opened an issue is either 13 years old and dumb as a log or a troll (also dumb as a log) and this project is barely used, like at all

So please, don't give them attention

That comment chain was utterly hilarious. The OP practically wanted to block every email provider in existence.
You know because you can create spam from practically every provider. I guess it's good that this kind of idiocy is hashed out rather than just being implemented blindly with a pull request.
- And once he got sat the fuck down, he wanted to continue discussing the topic "privately, away from the toxicity", going full out Wormtongue. Fuck him.
- Stop all spam with this one simple ~~trick~~ filter! All spam emails contain '@', therefore all emails containing '@' are spam and will be blocked
You cannot even make it past the half-way mark of the OP to realize that the creator has no idea what they are talking about.
Something interesting I learnt about the generated gmail accounts is that they either contain + or an excessive amount of dots, 2 very odd patterns in real, legitimate email accounts. I was able to reliably detect at least 3 or 4 dots in the email itself when it's using the dotted variation.
Continuing the discussion, the fact that they are so defensive and immediately hide behind moral high ground when someone calls out their mental gymnastics out for the bullshit they are, makes me believe that they are a troll. A child would lose interest after getting so many negative responses.
The behavior you see from the creator is close to a troll tactic called "sealioning". While refusing to give their own claims any plausible proof (they constantly talk about "tests" they've run without any specification thereof), they request elucidation or sources for any contraindicating claims (here in the form of discussions which are held off-platform, e.g. on Discord), but fail to engage with any proof of the contrary (refusing to take protonmail and several other legitimate providers off the list even after talking to the literal CTO) while just reiterating their standpoint over and over again.
All the while, they pretend to discuss sincerely and are always polite and superficially receptive to counterclaims. This is key to their general strategy of eroding a victim's patience and exhaust their attention. One of two outcomes generally occur:
a) The victim snaps. In this case the troll will claim moral high ground and garner sympathy from 3rd-party observers because of fickle reasons like "there is no reason to insult somebody on the internet".
b) The victim leaves in order to not appear unreasonable. On a public platform, like a thread, many observers will then grant the "victory" to the troll because their stand point seems strong and counterclaims seem indefensible. This is the ultimate goal of the troll and what makes it dangerous.
- Just reminds me of an idiot PM we had who after realizing you could do the + thing on Gmail addresses made the devs block it, then didn't understand why qa and anyone else testing using those types of email accounts got mad when no one could get in or create new accounts

The whole exchange between the ProtonMail person and the repo maintainer is wild. The maintainer is clearly grinding and axe and pretending we should thank them for it https://github.com/7c/fakefilter/issues/73#issuecomment-1785182508

That dude's not even a maintainer, just some rando who apparently doesn't like protonmail.
- Imagine having that little happening in your life
- deleted
It's absolutely wild to read. This bloke absolutely has issues, what a weirdo
That's not the maintainer, just the user who opened the issue. Here's a (somewhat ironic) interaction between the same user and the maintainer: https://github.com/7c/fakefilter/issues/69

deleted

Why does anyone care? The npm package has 3,712 weekly downloads. They're trying to act like it's some mainstream package that a lot of companies rely on, but nobody uses it...

I'm tired of watching bad ideas grow into industry standards.
- Fair point.

Funny, considering I've moved over to a paid proton account as my primary email, and my former primary email/Gmail account, with its ability to instantly become infinitely many disposable email addresses, is now used as exactly that. This same procedure occured many years ago, when I made my yahoo email into the disposable junk mail home, and my shiny new Gmail became my primary. I wonder how many years it be until proton becomes my disposable, and some as-of-yet to be created service becomes my new primary email. Or maybe email will finally be dead by then, and we'll use something else entirely.

I will say, even after all of these years, and using the living shit out of my Gmail account in many, many places, I still only get two or three spam emails at most during the entire year.

No, you very likely get way more than that, they're just filtered out.
- This. I get tons, but almost none of them actually hit my inbox.
- Wouldn't OP see them in the Spam folder? If they say they get 2 spam messages they probably mean that.
Same, gmail now means garbage mail and only acts as a filter for my Protonmail now.

as someone who uses protonamil as my main email, this is very disappointing

Based on this other issue by the same user, I think there's no cause for concern that the dev will actually blacklist PM/SL: https://github.com/7c/fakefilter/issues/69

Anyone working with GitHub probably knows that it'd be lunacy to just act upon every issue/PR that people come up with.

Looks like someone noticed the PR and panicked. Then people someone crossposted here and people picked up the pitchforks a bit too early.
- 🔱🔱🔱 who are we going up against today 😄

Honestly, the more these one time accounts try to convince me to remove protonmail and simplelogin, the more I see how much it's needed to block them. It's like the marketing team is desperately trying to keep their services from being rightfully flagged and it just makes me want to block them even more.

what did protonmail do to you ..

Can you show us on the doll where it touched you?

this is someone probably <13

"RobloxPianoAutoplayer" "Anime-Clicker-Simulator-GUI"

what??

also their "Guardian V2" repo

Q: What is Guardian V2?

A: Guardian V2 is a side project of mine. Its purpose is to protect users from game/user-made malicious functions/scripts. It is highly customizeable

jeepers weepers man isn't it so cool to have their anti-cheat so customizeable??

- holy shit really? looks like there's hope after all

These genius also wants to block Tutanota too. What a joke. Never heard of this project and I will now go back to not hearing them.

When I was trying some gacha games out I tried using a disposable email but it wouldn't let me.

I'm really not a fan of heavy-handed approaches like this. I understand why most of the listed domains are on the proposed blocklist, but Tutanota and Proton are the two most common private email options. Rambler is a Russian news aggregate, so I'm not sure why that's in the list, politics aside

I've seen random surges in emails from Rambler.

Power Users: Block all emails that aren’t Gmail or Outlook!

Also Power Users: Why are Google and Microsoft monopolies!?

If that's the case, they should also block Gmail.

They did, the maintainer commented that they weren't going to add Gmail and proton mail.

So I gotta start using my AOL email again?

They'll never suspect CrAzY6969x@aol.com is a phony!

Well whatever 7c/fakefilter is, they just got unpopular.

It's a list of domains which provide temporary email addresses. The more interesting question is who uses them.
- With 125 stars and 11 forks?
  Pretty much nobody.
  Edit: If anything, that issue feels like an attempt at viral marketing for fakefilter.

Hah, there's also seznam.cz (meaning "a list") - I wouldn't be surprised if more then half of whole Czech Republic (so ~6M) uses that as their primary mail provider.
It's also a main local web search and maps provider among other stuff, and pretty popular with non-english speaking part of the population.

If the maintainer accepts this they would be most probably killing the project, can't imagine people using it when it drops their user registration by a lot because of blocklists this wide.

Same for Poland - wp.pl and o2.pl are the most used email providers over here. Most of my family have a wp.pl email, nobody uses gmail or anything else.
Seriously. If someone in Czechia doesn't use gmail, it's almost guaranteed they use Seznam
This blockist doesn't have that many users, though.

Yeap 83 businesses are my clients. If they do this ,guess they will never receive my email. Poor IT support of all the businesses. RIP

It would be a poor IT department if they just blindly implemented a block list that had been handed to them and allowed that block list to be updated regularly with no oversight as to what was changing.
- Not to say there aren't companies that do that, because there are plenty...

The issuer is just a random GitHub user. Keep pushing back the PR.

That's why I have setup a custom domain and catch all so I can create aliases on the fly. Was huge fan of simplelogin until I did a though experiment about ditching proton mail. I will not pay for email aliases.

I am not sure I understood your comment. I am using protonmail (ultimate) and they do have free simplelogin integration (I think proton bought SL). Definitely catchall is my way to go for reputable sites, but SL is great for trash "register once" sites so that I don't even disclose my domain!
- Using a simplemail means you are bound to a provider, in this case ProtonMail.If you setup a custom domain you can ditch ProtonMail/Simplelogin duo domains and switch to a different provider whenever you want.
I did the exact same thing.
When I saw Fastmail with aliasing features (beyond just using a catch-all with my domain) included in their $30/yr plan I couldn’t switch fast enough.
I guess Proton thinks they can rest on their name (which, admittedly, is a good one). But why pay for simplelogin + Proton when others do exactly what I need?
Could you please share the steps you took for this? I have an inkling , but not sure how to proceed. I m thinking of learning self hosting too, but can't right now due to reasons.
- I bought the domain, set required domain records as per protonmail docs, waited for verification to complete and enabled catch-all thingy.
  https://proton.me/support/custom-domain
This is the way. I finally got around to setting this up a few months back.
Duck duck go offers this service for free, they will forward to your regular email. Provided the generated addresses are random.

Thanks for adding an update to your post OP. Good to know cool heads prevailed!

Truly a sad day for poppy heads

Do keep in mind, it seems like protonmail is considered a whitelisted domain in the eyes of lead that's running that project. I say this because if you go under the issues page of it and then select the whitelist issue which is the issue that he uses to keep track of every domain that will not be blacklisted, protonmail appears there. That being said the others don't appear.

I love how dense OP was that he didn't even acknowledge the white-list and was acting like he was the authority (or the sheriff) on this topic, with nothing to back him up whatsoever.

That’s…a good portion of the free email providers on the planet. Even if companies are using this list as a filter for signups, it’s only going to be for a limited time.

Companies want new accounts. They don’t mind very much if those accounts are fake - big numbers get investor attention. It only takes a handful of support cases with “I tried to register but it says my email address isn’t allowed” before the C-suite makes it clear to IT that this filter is no longer in sync with the corporate strategy.

Ironically I'm paying for proton because the free services suck.
I can actually well imagine them responding to use a Gmail or short list of major domains. Normies are normal and the companies want an email they can link to all the other data on the web.
What all of you fail to realize is that it's literally the point of the project. To filter those "emails" that value privacy. Just like everyone has the right to use those privacy prioritized emails, website operators have a right to know. That is a 1:1 copy of the description of the project.

That was a fun read.

Hard for me to understand how blocking valid email providers like Proton, Tutanota, and Skiff, would actually mitigate any abuse. All it's going to do is hurt the websites with this filter and prevent privacy-minded folks from signing up. Unfortunate to see, hopefully they get some common sense and don't block these for no reason.

Nice raid Lemmy

I know I gotta receive some slack for this, actually all my temps emails are outlook ones, they do not require a phone number and I can redirect all traffic to my main one easily and sort it there with rules.

Nothing is happening, some kid was making requests that were entirely ignored until lemmy jumped in. I cried when they said that they preferred discord to email for official communication.
- I thought that bit was hysterical.
  "Tell me you've never been employed before without telling me."
  "I prefer discord for business communication."
- Is the creator even a kid? I find it hard to believe a kid would give that much of a shit about email spam lists. But, then again, nearly half his repositories are forks or involve Roblox.
Some random email filter project.

Can someone please explain to me why they can't create the account even if it is used as disposable? Storing one text file with the login on their side does not cost much storage at all.

Because they want to sell it and spam it.

It's actually really easy to get past the custom domain issue.
If the domain is send-and-receive, it will need a SPF record to avoid getting blackholed by most mail providers. A TXT lookup for the SPF record would tie the custom domain back to the real provider.
Or even easier, you could look up the MX records to see what domain they point to.

This happens to me occasionally already as a paid Fastmail user. I switched from Gmail about a year ago and I can’t change my existing Yahoo account to use Fastmail.

I get it, we deal with fraud and abuse from throwaway emails all day at work, but it is frustrating for sure.

Hmm worrying. I switched to Fastmail too and use a lot of their 'masked emails'. No problems so far, touch wood

Every ~3 to ~5 years I change my free email addresses (gmail, hotmail/outlook, yahoo, etc.). Although, I don't use yahoo anymore.

I have turned a few of my old gmail accounts into spam mail trawlers as I “Gotta catch ’em all! ” and every time I have to make a temporary or single use account for a service I want to check out/try or I just foresee making only a single purchase I always use a gmail account+alias if they don't have a guest checkout option. The old gmail accounts are checked quarterly on a if-I-remember basis but at least once a year.

On first contact with any business, services or people I have never met in person I usually give a newer gmail address I check biweekly in case my forwarding filter missed something important.

Moreover, I use gmail incoming mail rules to forward copies of important keywords and specific email address to my 2 professional (redundant) emails for which I enabled notification on my phone, main desktop and workplace.

Gmail is so ubiquitous and well trusted that I can pretty much use it in any input forms for registration or verification. Their spam filter is also pretty good (not always) to skip/pre-filter obvious phishing and scam emails.

Even though I have already moved away or avoided Google, Microsoft, Meta/Facebook, LinkedIn, Apple, TikTok, Wechat, Temu, PayPal, Sony, etc. I occasionally still have to indirectly deals with them on a limited case-by-case but specific situations.

By excluding so many excellent email services they are inadvertently making sure that Gmail, Outlook and other allegedly "reputable" free emails services slowly become a junk/spam/marketing email dump that few would want to enable constant notification for and fewer would want to delve into and sift through daily.

Sorry, this became a long rambling rant about all the layer of protections I have to use nowadays to just avoid wasting energy and attention on the profusion of spam/useless emails.

I guess this is why spamgourmet became almost unusable in recent years. It's a pity because the service is effective at blocking spam but I can imagine there is abuse potential.