0

I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) which required any user accounts to be an email address in the ".name" or possibly ".me" TLD (or in any other TLD that was intended for individuals or individual corporate employees only--i.e., not open to public registration) and perhaps disallowing subdomains (as it might be tempting for some companies to purchase a generic domain and lease out the personalized subdomains); of course it wouldn't stop a company from leasing out names like user123@spam-friendly-site.name, but as the TLD is intended for individuals, it would hopefully be easier to blacklist any such bad behavior-enabling sites wholesale.

The purpose would be two-fold:

  1. Raise the threshold for spammers as they would have to either purchase a new domain any time they wanted a new spam account (and any abusing domains could be blacklisted and shared as a public list) or obtain control of a legitimate user's email account or browser/system.
  2. Encourage people to throw off the yoke of dependency on fixed third parties for emails as well as website hosting, chatting, etc. by getting their own domains. One wouldn't want a phone number like 555-123-1234@att.com because one could not freely change providers. And there are no doubt many would-be content creators who would share more freely if they had a site belonging to them. If one wanted to be anonymous, one could reserve domains like anonymous567.name (e.g., me@anonymous567.name) -- and this would be fine with me as my purpose is not to positively ID people outside of the context of confirming they control the email address they give me but to raise barriers to spammers. It would add a small price to do content creation on the site as users would have to purchase a domain and configure email on it and would cost more so to become truly anonymous (e.g., to purchase separate domains for each site to avoid tracking between sites), but I think the burden should not lie on content websites to deal with spam registrations.

If this really gets going, one might also be able to set up one's email filters to block anyone not belonging to such a personalized domain as well, giving an auto-reply of how to register for one.

Does anyone have feedback on the idea, specifically any unexpected barriers I might encounter (such as ways it could be circumvented)? I know of course that it will raise barriers for some users, but any potential technical challenges?

  • There are some very long sentences in your question, really tough read. – Ben McDougall Aug 15 '13 at 7:22
  • 1
    So I would have to register a domain, just to post/read content to your site? It all sounds extremly cumbersome just to avoid spam. These days I dont even visit sites that require me to register just to read. There's always an open alternative. – Fredrik Aug 15 '13 at 10:54
  • Not to read content, but to post, yes. I also don't wish to burden users who do value having their freedom (by having or getting their own domain) with extra hoops like captchas and all that. It is not just for my site--I think it is the way the web should work. If Yahoo, GMail, etc. want to fit in, I think they should set themselves up to register domains for people and thereby give people freedom to switch. Beyond that, it can facilitate users TRULY owning their content--sites that wish to republish simply grab data (or prefs) off of the user's server instead of getting to contain it. – Brett Zamir Aug 15 '13 at 12:11
1

I think you have already identified one flaw. In general, web hosting providers have no interest in checking on the identity of their users, or of ensuring that they use domain names for legitimate purposes. Indeed, use of domain names as a proxy identities is probably not covered by their "terms of service" ... and not of interest to them.

In short, it won't be a significant impediment to spammers.

The second problem is that most people who don't already have a domain name don't want to be bothered with it. It costs money to get and keep a domain name. It costs time to organize. There is a learning curve. And so on.

In short, it will be a significant impediment to a significant subset of your real users.

And the other issue is that your scheme does not address your primary requirement ... authorization and access control.


You asked about technical challenges. Well my take is that the first problem above is a technical challenge. Unless you insist on your users using specific hosting providers with specific procedures, your scheme provides no significant impediment to spammers. All serious ("professional") spammers have ways to get an unlimited number of throw-away DNS addresses for free. So you are just going to be playing "whack a mole" at a different level.

  • Thanks for your reply--I'm not worried about the first issue because it is a lot easier to blacklist an entire domain and share that list than it is to blacklist a whole bunch of auto-generated Yahoo accounts (at little cost to the spammer) or whatever. – Brett Zamir Aug 15 '13 at 4:03
  • As far as users, yes, it will be an impediment to some, but people have managed to figure out how to get set up on the internet, and if this becomes a trend, I think personalized domains will also be better facilitated by companies and the web community, and once people start doing it for one site, it will become less of an impediment going forward (and a good thing in and of itself). – Brett Zamir Aug 15 '13 at 4:05
  • As far as authorization and access control, I really like the concept of BrowserID. My interest here is more in making things more difficult for spammers to reduce their tyranny and burden on sites opening themselves to public content creation. – Brett Zamir Aug 15 '13 at 4:08
  • Thank you for the update--I was not aware of their being able to get DNS addresses for free. And the idea of specific hosting providers is an interesting one though admittedly it may raise the barriers to the openness of the system. – Brett Zamir Aug 15 '13 at 4:13
  • In your mentioning specific hosting providers, I guess you mean querying the WHOIS of a domain to ensure it belonged to one in a whitelist, right? – Brett Zamir Aug 15 '13 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.