search

mozilla / fx-private-relay

Keep your email safe from hackers and trackers. Make an email alias with 1 click, and keep your address to yourself.
https://relay.firefox.com
Other
1.47k stars 176 forks source link

Relay email detection and blocking #559

Open 20k-ultra opened 4 years ago

20k-ultra commented 4 years ago

Sites and applications sometimes block emails if they are from a disposable inbox service. What is the consensus on this happening to Relay? Given that all the accounts end in relay.firefox.com this could easily be detected. Burner emails are so prevalent that there are services to help businesses/sites detect them.

Maybe address aliasing with an email domain that a site couldn't block because they'd loose too many real users (like why domain fronting is powerful). Or more realistically, the relay domains are dynamic just enough that the blacklist used is incorrect frequently.

groovecoder commented 4 years ago

Thanks for filing. We're paying close attention to user reports of sites blocking relay addresses, and will try to make relay addresses work on as many sites as possible.

groovecoder commented 4 years ago

Did you see a specific site where the relay address was blocked?

20k-ultra commented 4 years ago

I haven't used Relay tbh. I am just looking into it now but I have concerns about sites being able to easily block it so wanted to hear what the strategy is.

groovecoder commented 4 years ago

BJs.com rejected @relay.firefox.com address but accepted @mailinator.com address. Possible sub-domain blocking.

20k-ultra commented 4 years ago

I can see how blocking subdomains in an email is a good idea since a spammer just has to buy 1 domain and create multiple subdomains to circumvent any domain blacklisting. I think Relay is the first email I've seen with a subdomain. Wouldn't it be better to use a credible domain and have user's get accounts from that ?

I know this idea isn't perfect but just food for thought @groovecoder ..imagine the following email:

user123+relay@firefox.com

This has the benefit of using a reputable and widely used domain so less chance to get blocked. We can create a whole "namespace" for relay emails by using aliases (the + or .) with relay appended. This can be programmatically managed without any changes to DNS records.

groovecoder commented 4 years ago

From AMO review: kickresume is reportedly also blocking.

sabian2008 commented 4 years ago

This isn't a very important example but I've found that the mobile games of the company Etermax (e.g. http://www.preguntados2.com/) block e-mails @relay.firefox.com, and considering the scale of the company I guess their detection is performed by a third party, so there are probably other sites blocking relay as well.

akirayamamoto commented 3 years ago

I think that using + in the address is a bad idea. I know sites that block or error when using + in the address. One example that I can remember now is anz.com.au. I have experienced this on some other websites as well.

user123+relay@firefox.com