Re:Ask HN: What to do about random email sign-up attacks?
by mooreds on Monday March 25, 2024 @11:00AM
(#39817156)
You have a couple of options, none great.
You could enable social sign-on (Google, Facebook, etc) and disable sign up by email.
You could rate limit sign ups based on IP address, including a captcha (though it sounds like they may work around this).
You could use a waf like cloud flare and hope it distinguishes bad actors.
You could shut off new sign-ups or turn them manual for a time (make folks submit a form and add them yourself if you can verify they are interested) to make yourself a more painful target.
You could enable social sign-on (Google, Facebook, etc) and disable sign up by email.
You could rate limit sign ups based on IP address, including a captcha (though it sounds like they may work around this).
You could use a waf like cloud flare and hope it distinguishes bad actors.
You could shut off new sign-ups or turn them manual for a time (make folks submit a form and add them yourself if you can verify they are interested) to make yourself a more painful target.
Not a lot of easy options, though.