Show HN: Startup with no website - GuerillaClick@gmail.com

288 points by eralpb 7 years ago | 184 comments

Hey there, there are lot of disposable email services, but as I was thinking I realized 95% of the time, I don't care about my inbox. I just want to "verify my email".

That's why I created a startup with no website, it's called guerillaclick@gmail.com, it's a credible domain (you don't say) and it will click on any "verify" links you send it to it.

You can use aliases to get around of duplicate emails in the target system, so like

guerillaclick+eralp@gmail.com guerillaclick+sdfaskdma@gmail.com guerillaclick+111@gmail.com

so choose an alias and start using the service!

I will provide a website to see the inbox of your alias. (maybe for services who send your pw in the email, but then you might be better off using other established servers.)

Gmail API is a bit slow so it might take 30 seconds for email to be received on my end, keep in mind while testing!

Best,

nine_k 7 years ago |

This is delightfully crazy.

Give some random guys with no website your registration record somewhere, allow them to verify your registration as theirs, and then impersonate you, reset passwords, see any communications, possibly log in as yourself and do anything. All this with no recourse.

Nigerian spammers moan from envy for such a brilliant self-propelled gullibility filter.

Semaphor 7 years ago | |

I have first.last@gmail.com and I've had people play poker and lottery and sign up for dating websites with my e-mail address. I've also received confidential information from insurance and building construction companies.

It's hilarious.

colechristensen 7 years ago | | |

At this point I feel like I've shared a life with some of the others at this point. There are several people who share my name who continually give out my address. I get school closings, invites to pie socials at churches, family pictures, conservative newsletters, and much more.

Once I was told about "my" enlistment in the reserves of some armed service. That one I replied to and got a very polite response from someone with a little bit of rank.

dprice1 7 years ago | | |

Me too-- a lot of receipts from Home Depot, little league, real estate documents (many times), scans from signing up for gym membership (which had a lot of PII in it, I called the guy), emails from a church elders group.

Once I got an advanced copy of remarks the UK Prime Minister was going to make the next day at the 2008 Jeddah global energy summit.

sixdimensional 7 years ago | | |

Same here. I've also received legal and tax documents, invitations to bachelor parties, draft scripts for motion pictures, medical records and offers to buy my multi-million dollar house in Florida (hint, I don't have one, but somebody with the same name does).

richardw 7 years ago | | |

Same. I once set up a google group to forward mail to the others. Limited usefulness.

World-class was the lady who sent me pics of herself in lingerie. Not too revealing and I deleted them immediately and replied to warn her. She nearly died of embarrassment.

I'm pretty sure there are spam lists who sign me up to products, probably for some kind of referral. I join all sorts of junk.

Compounded by Google making "first.last@" = "firstlast@"

Next Gmail account is going to be a guid.

jonathanmoore 7 years ago | | |

A while back when Yahoo released inactive email addresses, I grabbed moore@yahoo.com. It was a nightmare. The account would receive 10,000+ emails a day. The inbox was full of insurance claims, social security numbers, mortgage applications, pay stubs, and more. In the end, I deleted the account since I didn't want the possible liability of the account.

27182818284 7 years ago | | |

I have tons of this. I really hope the gmail team is working on it. I don't get spam anymore, I get someone with a name similar, but not quite mine's receipt, dealership tune up reminders, directTV announcements, information about going back to get their RN, etc.

Like none of it is spam exactly, just a lot of wrong numbers.

acomjean 7 years ago | | |

I had a coworker who had the same name as a coworker in Phoenix as (we are in Boston). He kept getting invites to meetings out there because the online email was also a scheduling tool (notes). He was getting annoyed dealing with them. I suggested flying to Phoenix to go to one of these meetings...

dsl 7 years ago | | |

I bribed an exchange admin or two and got [firstname]@[really big company].com. This company had a lot of consumer facing stuff, and some of which required an email address. Employees of the company would just put in [customers first name]@[the company].com when they didn't have an email address.

That was fun.

fhood 7 years ago | | |

I thought I was the only one (with a firstlast@gmail.com) that kept getting confidential info from/for construction companies, dentists, and some Canadian woman.

brewtide 7 years ago | | |

(Firstinitial)lastname@ Gmail checking in.

So much misdirected email. Try to sign up for something? Reset password change info to not theirs.

It's amazing what people send rather blindly.

desireco42 7 years ago | | |

Me too, why do you think this happens? I get emails from people who send it to my exact email, I am not sure why they think this is their email (sorry don't want to disclose my email... but it might be in profile :) ).

bacon_waffle 7 years ago | | |

Me too! One of the others with the same name signed up for a dating website (match.com IIRC) a few years ago and they sent enough information that I was able to improve his odds and help a bit with his decision making.

imsofuture 7 years ago | | |

I get a lot of updates on the kids (not my kids) from one specific person (I've responded to them, they keep doing it), and an occasional W2 (not my W2).

BerislavLopac 7 years ago | | |

Interesting that so many people had a similar experience. I guess my name is literally unique.

gpm 7 years ago | |

It's no crazier than using any other disposable email service... if I'm registering an account at neopets.org or whatever I probably just don't care.

jopsen 7 years ago | | |

wow, sites like neopets.org still exists :)

sleepychu 7 years ago | |

In that regard though, it's not different to existing throwaway email services. I'd use this sort of thing for registering for annoying things like "free" wifi.

faissaloo 7 years ago | | |

Most free wifi hotspots don't verify your email fyi

LCoder 7 years ago | |

I own a domain which a lot of people on the Internet like to randomly type in when they are signing up for things. It is ridiculous how many services accepted those fake email addresses over the years and therefor how many accounts I could reset passwords for.

justwalt 7 years ago | | |

What is it?

laughinghan 7 years ago | |

I don't understand what point you're making. Isn't that true of mailinator.com too? Have you never signed up for an account on a service you didn't trust not to spam you?

crb002 7 years ago | |

Unless you don't want an account. So many things require stupid email verification just to get at no transactional stuff like content.

clairity 7 years ago | |

and it pollutes the googleborg no less, by using a gmail account.

occasionally people (accidentally?) use my (long-in-disrepair) gmail account in this way, and it's amusing to see their little peccadillos. sometimes you get the devilish chance to change subtle details of an online profile =D

fredgrott 7 years ago | |

not to mention the damn google dot hack that still works with all gmail email accounts...

icedchai 7 years ago | | |

Not to mention the +something which gives you infinite email addresses.

2019ideas 7 years ago | |

If you are worried about your user details getting stolen after signing up with someone else's email-

You aren't using this service correctly.

The idea is to not give away your email or signup for a website, but get access to that website.

miketuritzin 7 years ago | | |

Yeah, my interpretation is that it's for situations where you would normally prefer to use a fake email (joeblow238998324@gmail.com) but can't because of the verify link.

floatingatoll 7 years ago | | |

As a reminder, site operators, this is why some sites require you to enter a user/pass to confirm a "verify link".

ReadyPlayerNone 7 years ago |

Interesting, I've a few questions as food for thought.

- Is it allowed under GMail's TOS?

- Have you considered the security implications of having what is presumably a server somewhere in your name clicking on any link that's sent to it?

- You say startup - do you have monetization plans? Putting adverts on the associated website perhaps?

dkoston 7 years ago | |

Google TOS is pretty broad. However, one of the main factors here is that export controls could quickly come into play. Since Google is US-based, providing this service for those in embargoed countries could get you shut down quickly.

They also have a "don't misuse our services" clause and I'm sure this would count as misuse if found.

spdebbarma 7 years ago | | |

Someone who works for GMail or Google has already read this HN post. I don't expect it to work for much longer unless OP has found a loophole.

imhoguy 7 years ago | | |

> providing this service for those in embargoed countries could get you shut down quickly.

How come Google can figure out who and where the interested end-user is when emails are actually send by web apps and clicking is done upon email retrieval (I bet some cron with POP3). Moreover emails from "bad" countries are rather filtered out as spam/scam.

Apart of this thread publicly inviting people it may be also hard to distingush the accout from any busy one. But I guess G may have some pattern matching and rate limits for such sinks.

simonebrunozzi 7 years ago | | |

Let me answer this: from what I know, and broadly speaking, this service is both illegal and not allowed by ToS.

macspoofing 7 years ago | |

>Is it allowed under GMail's TOS?

Do you even have to ask? The answer is a clear 'NO'. There is zero chance that Google will allow you to abuse their email service in this way.

I hope OPs personal account isn't in anyway related to this account because when 'guerillclick@gmail' is inevitably banned, his personal account may be collateral damage.

eralpb 7 years ago | | |

you make a very good point, thanks for the warning.

alpb 7 years ago |

Why do you call this a "startup"? It's a nice hack for sure but I'm not sure if it's has a prospect of being a business.

bdcravens 7 years ago | |

Because overwhelmingly the HN crowd thinks building an app is building a startup.

judge2020 7 years ago | | |

The product is a big part of a business, so if you have one, all you need is a business partner and VC's to create a multi-million dollar company.

p49k 7 years ago | |

If the Yo app can raise 1.5 million...

jen729w 7 years ago | | |

I wish they were continuing to spend it on their servers! I used Yo with my gf. It’s a daft service, sure, but if I really do just want to tell her I’m thinking about her it was kinda cool.

The iOS app might still work but the watchOS app hasn’t been updated for 5.x. :-(

crb002 7 years ago | |

The monetization is having a curated up to date list of email verification handshakes.

This has value.

reaperducer 7 years ago |

guerillaclick+eralp@gmail.com guerillaclick+sdfaskdma@gmail.com guerillaclick+111@gmail.com

Unfortunately, more and more services are rejecting + e-mail addresses. Either ignoring them, or flagging them as an error.

While it's perfectly within the RFC, companies are catching on to the trick.

(3M, I'm looking at you!)

kidsil 7 years ago | |

Gmail gives you another option - separate using dots.

g.uerillaclick@gmail.com

The number of options is of course limited but it's still recognized as a separate address while still coming into the same inbox

dsl 7 years ago | | |

I've built a few registration systems and always normalize email addresses (remove local part, de-dot gmail addresses) at signup and login.

It helps users who keep trying bobjones@gmail.com when they signed up with bob.jones@gmail.com. Also is pretty good at preventing mass signups using tricks like this.

apexalpha 7 years ago | | |

Actually guerilla.........................click@gmail.com would work too, since it fully ignores dots. So the options are just as (not) limited as anything a + can add.

judge2020 7 years ago | |

It's within RFC, but they all lead to one email inbox so you end up being able to manage multiple third-party accounts from a single email account. It's recommended to not reject these, but strip them: https://gist.github.com/judge2020/af8fb9cd2ac165462d44de4e58...

https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

josteink 7 years ago | | |

Recommended. By google, who just played loosely with the email-spec.

How rich.

dimensi0nal 7 years ago |

When Google inevitably shuts this down can you opensource the link clicking program?

eralpb 7 years ago | |

I will open source whenever I have time, I just did it last night and decided to share.

justin_oaks 7 years ago | |

The "link-clicking" can be done using a Google App Script. I've used it before to auto-accept AWS opt-in notifications for Elastic Beanstalk environments.

My code was tied to a Google Sheet that would hourly pull matching emails, use a regex to extract the link, send an HTTP request to the URL, and record the URL and response in the spreadsheet.

Having a high level description of the code isn't as useful as the code itself. Alas, my code was part of my Google account at a previous employer.

swongel 7 years ago |

You can use Mailinator to do this already, you can see all of their inboxes on their website and you can use all of their domains to bypass domain restrictions. For example I might use somethingsilly@bobmail.info and it will be redirected to https://www.mailinator.com/v3/index.jsp?zone=public&query=so...

kodablah 7 years ago | |

> You can use Mailinator to do this already

While I'm a fan of Mailinator and their approach, I think the feature OP has about auto-clicking verify is unique. But yes, to do this right, you need the multi-domain approach of Mailinator instead of just aliases. Maybe Mailinator has an API or supports POP/IMAP that would make this possible, I haven't checked.

naniwaduni 7 years ago | | |

Also exists: https://mailnesia.com/

imhoguy 7 years ago | | |

You can easily use one of many opensource self-hosted temporary email projects with APIs. Just check Github.

Receiving email is pretty easy - own domain with MX record and some cheap VPS with Docker. No need to worry SPF, DKIM, DMARC, DSBL - you care about these when you have to send emails from the host.

elamje 7 years ago | | |

If the site you are trying to login in to blocks mailinator, use <whateveryouwant>@notmailinator.com

bionoid 7 years ago | | |

Last I checked it appeared like Mailinator's POP3 support was completely removed, and API access requires a subscription. It was priced way above what I was willing to pay (I think $150/mo)

modzu 7 years ago | |

but the list of mailinator domains is easily looked up and blacklisted by most major sites. the op's insight is that sites won't blacklist gmail

deevin9 7 years ago | | |

I don't know if it still does it, but mailinator used to have a neat feature where it would "detect" bots trying to scrape its list of domains and start injecting legit ones like hotmail.com/gmail.com

macspoofing 7 years ago | | |

>the op's insight is that sites won't blacklist gmail

Why would you blacklist gmail.com when you can blacklist 'GuerillaClick@gmail.com'?

O_H_E 7 years ago |

Just make sure that account is not associated with any of your real data (even IP). There have been horror stories at /r/TIFU about people getting their personal accounts suspended and the whole enterprise account with them.

If Google gets angry about you, your life MIGHT be ruined –partially–

metahost 7 years ago | |

Turns out those r/TIFU stories were fake. A Googler from the GSuite support debunked the claim. [0]

[0]: https://amp.reddit.com/r/google/comments/8l231x/google_banne...

tnr23 7 years ago |

what about the gmail receive limit? its 60 emails per minute or about 80k per day

if you hit 1 minute over 60 you get blocked 24h

programbreeding 7 years ago | |

That seems like it would be incredibly easy to DoS someone.

ttul 7 years ago | | |

Indeed it is.

siruncledrew 7 years ago |

Did you get the idea from GuerrillaMail?

https://www.guerrillamail.com/

protomikron 7 years ago | |

More and more services recognize disposable e-mail domains and don't allow such addresses. Obviously they can't block the gmail.com domain.

I like the idea, but it probably is against Google's TOS, so there's that ...

godot 7 years ago | | |

Theoretically if this guerillaclick@gmail gets popular, I'm sure services can just specifically block guerillaclick+anything@gmail right?

kodablah 7 years ago |

If something like this becomes popular, one might expect sites concerned about non-human verification to add a captcha to their verification page before the account is considered verified.

herogreen 7 years ago | |

Or: ask the user to use the same browser and check that cookies match / "sanitize" gmail adresses

eXorus84 7 years ago |

Good luck for your startup with no website. It's very simple and clever.

I started my startup with a website to do a disposable emails service: mailcare.io It's also available in open source.

rcfox 7 years ago |

I've always wanted sort of the opposite. I'd sign up to a website, and they wouldn't ask for a password. To login, they would email a link to click and I'd be logged in for however long that cookie lasted. Why don't sites do that?

(Is email still considered slow? I remember having wait times in the hours back in the 90s, but I'm not sure I've ever waited anywhere near a minute in the past decade.)

Brozilean 7 years ago | |

> I've always wanted sort of the opposite. I'd sign up to a website, and they wouldn't ask for a password. To login, they would email a link to click and I'd be logged in for however long that cookie lasted. Why don't sites do that?

> (Is email still considered slow? I remember having wait times in the hours back in the 90s, but I'm not sure I've ever waited anywhere near a minute in the past decade.)

Tumblr does this at the moment. It asks for either email click or a traditional username/password setup.

overcast 7 years ago | |

Passwordless authentication exists, Medium has it, I've implemented it before, and I prefer it myself. The biggest issue being it adds an additional step, that most don't want to deal with. What if they don't have access to their email on that machine? Blasphemy, but it happens.

gpm 7 years ago | |

This is basically how steam works these days.

Sure, there is a "password" - but they won't let you log in without also verifying you have access to your email account - and you can reset that "password" only knowing the username and having access to the email account.

jonathankoren 7 years ago | |

Tumblr does that now.

I’ve never used the feature. I have an integrated password manager.

nijynot 7 years ago | |

Medium actually does this.

megous 7 years ago | |

How'd you log in if you lose control of your e-mail?

lifeformed 7 years ago |

Isn't it spelled with two R's? "Guerrilla"? I didn't even notice at first, and was going to say that it's a hard to spell word for something you have to manually type in. Now I notice even the service itself is misspelled! Or is it just this announcement of it that's misspelled?

ArtWomb 7 years ago |

Nowadays, most require SMS confirmation that "You are indeed a human". And thus a mobile phone number. Have often considered wiring up something in Twilio so I can create multiple accounts, etc. But am too lazy to put in the effort. Perfectly willing to trade privacy for convenience in most cases ;)

dewey 7 years ago | |

I wouldn’t say “most”. The sites where you have to verify are probably more sensitive and not something you’d verify with this service or a throwaway email anyway.

c22 7 years ago | |

A lot of these sites know when you're using Twilio numbers and reject you anyway.

rkagerer 7 years ago |

How well will this scale? I know GSuite Gmail accounts are limited to 3600 emails per hour, among other limits.

megaman8 7 years ago |

What's awesome here, is that he/she's created a solution to a problem that almost everyone has. It might need a little work, as shown by other comments. but the core idea is a good workaround for sites that force you to give a bad email address to get at the content.

giarc 7 years ago | |

Is it a problem though for legit sign ups? I find the problem is that when you click the link in your email, you now have 2 tabs open. One with a verified login and one without.

aogl 7 years ago |

A lot of services don't allow +uniqueSection in email addresses anymore; just bear in mind..

ixwt 7 years ago | |

Because it's a gmail address, you can put as many . as you want anywhere in the name. Gmail strips them out when determining the email address.

williamdclt 7 years ago | | |

Not as useful as `firstnamelastname+twitter@gmail.com` for example :/

apexalpha 7 years ago |

A bit weird to call it a startup but a clever idea!

Maybe Mailinator could implement this autoclicking.

mandeepj 7 years ago |

Good thought. At the same time, it's a feature; not a startup. Sorry.

sodafountan 7 years ago | |

A feature of what?

If this guy can convince people to send him their registration codes and somehow monetize it he's in business.

timmit 7 years ago |

it is a geek idea! i like it.

you still get a website? ``` I will provide a website to see the inbox of your alias. (maybe for services who send your pw in the email, but then you might be better off using other established servers.)

Gmail API is a bit slow so it might take 30 seconds for email to be received on my end, keep in mind while testing! ```

just wondering does it break gmail's terms?

desireco42 7 years ago |

If you are not making money off of it, why would you call it a startup. It really is a project of yours.

Thank you for making this though.

anant90 7 years ago |

Request for feature: Chrome extension: a shortcut fills in guerillaclick+<random_hash>@gmail.com

eralpb 7 years ago | |

great idea, which also warns about the websites it won't work on.

some require session authentication, so bot needs to login and THEN verify.

iazid 7 years ago |

Can something similar be done with phone number verification ?

aboutruby 7 years ago |

Seems like the perfect one to get one's account stolen

TeMPOraL 7 years ago | |

Throwaway/shared e-mail addresses are not for accounts you care about, they're for working around stupid requirements to register "for free" to access a resource you need.

rajeshmr 7 years ago |

Doesn't mailinator (mailinator.com) already do this ?

joewrong 7 years ago | |

some sites prevent mailinator accounts on signup

Liquix 7 years ago | | |

Truth. All ephemeral/temporary/one-time mailboxes suffer from the same issue - once enough people start using it, the website owners take notice and it's blacklisted.

It'd be nice if you could create temporary <insert reputable domain here> accounts on the fly. User provides a captcha solve, your service uses this to create a random account & log in, user can view inbox or click 'open all links'. This wouldn't work with gmail because of SMS verification but would probably work on other domains and circumvents the above problem.

bdcravens 7 years ago | | |

And not all sites honor the "+". Too easy to filter that out.

hernantz 7 years ago |

there are alternatives like http://10minutemail.com

ReedJessen 7 years ago |

Wow. This is a sneaky idea. I love it.

bobjordan 7 years ago |

Thanks, just spent five minutes modding my webapp to disallow email aliases.

DarkWiiPlayer 7 years ago | |

That has to be the worst idea of the year. You are essentially blocking perfectly valid emails on the assumption that one single email provider uses the + character with some special meaning. Congratulations, that's how you break the internet.

tobyhinloopen 7 years ago | |

I will call support to notify them my e-mail (with a + in it) isn't working, like I have done before. No I don't have another e-mail address. Yes, this is really my e-mail address.

kodablah 7 years ago | | |

To be fair, I would assume/hope the implementation is gmail specific and just truncs the + part only when doing uniqueness validation. Granted its effectiveness is small.

leowoo91 7 years ago | | |

That is essentially losing 1 customer vs handling thousand spammers.

floatingatoll 7 years ago | |

When a website presumes to normalize my Gmail address, I presume they aren’t interested in my money.

You are well within your rights to prohibit duplicate signups from the normalized address, but please don’t presume to replace what the user entered.

sourceless 7 years ago | |

Kind of a slap to anyone who uses email aliases to sort/filter email

ioulian 7 years ago | | |

I use aliases to filter my email and also to see who sells my email address to third parties. All the websites I've used allow "+" in the email address so that's good.

adhipg 7 years ago | |

You may want to allow email aliases, but ignore the 'alias' part when checking for uniqueness.

williamdclt 7 years ago | |

Please don't. It's an important feature for a lot of people (me included).

Just ignore it when checking uniqueness, if you really must

_eht 7 years ago | |

The problem is that you are no longer compliant with the email spec: https://tools.ietf.org/html/rfc5322#section-3.2.3

Does nobody read RFC’s anymore?

DarkWiiPlayer 7 years ago | | |

> Does nobody read RFC’s anymore?

I did, before posting my answer, though I admit I was too lazy to look up the email RFC and instead just used the URI RFC and assumed the allowed characters in the user-name would be the same :P

ReadyPlayerNone 7 years ago | |

I'd reconsider this change. Lots of people use email aliases to track which sites share their contact details with third parties. I see it all the time in signups for one of my sites - don't mind, of course, because I don't share their data. If you stop people doing this it might send the wrong message.

ixwt 7 years ago | | |

This is a poor way to track who is selling your contact details. It's trivial to strip + aliases from a list.

wtmt 7 years ago | |

That's downright silly and a user hostile move, IMO (why at all wouldn't you want someone to test things out without having to give one of their main email address?). Your solution seems to assume that everybody uses only Gmail and Gmail plus addressing. Gmail also considers dots/periods in addresses as not existing. Try blocking those too (no, actually don't try this!). There are so many temporary or disposable email services that you'd be wasting your time trying to disallow all those. Your time could instead be better spent on making your product or service more attractive to paying customers.

wifistrong 7 years ago | |

Excellent work. Now disallow catch-all email addresses. I'll wait.

O_H_E 7 years ago | |

Well surprise, I actually use that feature in real life with my real email.

It is really helpful if you want multiple profiles for a service (ex. Different mode, different recommendation) or in filtering all emails sent to that specific address (can't filter with the "from" as I don't know who is emailing me)

Please don't break standards

mxuribe 7 years ago | |

But, then you are not complying with standard email, are you? See https://tools.ietf.org/html/rfc3696#section-3

neals 7 years ago | |

I use an alias for every website, like me+apple@gmail.com to login to Apple.

frou_dh 7 years ago | | |

Sounds like busywork without appreciable gain

kodablah 7 years ago | |

Not sure of your app, but what do you care if multiple people share the same inbox? They can always with something like Mailinator or other domain-level aliasing.

dcbadacd 7 years ago | |

Revert that change. Just like DRM is easily defeated, so is your webapp's alias check, one can simply buy a few cheap domains and your checks fail.

Kiro 7 years ago | |

Great marketing for your services since you're putting them in your profile.

ClassyJacket 7 years ago |

Interesting idea!

asimjalis 7 years ago |

Beautiful.

fxfan 7 years ago |

Don't worry about providing website.

eralpb 7 years ago |

For future awesomeness please follow @eralpbayraktar on Twitter :)

Thanks!