Affected sites:
(1): ProtonMail: Making a Proton account with recovery email provided by burner.kiwi results in a weird verification message. The message seems to be encoded in base64 and is visible after decoding it from base64decode.org. I've attached images below for reference

(2) Render: The render.com verification email is also not formatted properly, there are extra 'characters' like = and some more. As a result, the verification link is invalid. This can be verified by trying to make an account on render.com using spacial.autos or adequate.fun

Proton:

Render:

On render, even after removing the = the link is still invalid, which leads me to believe that there are more unnecessary characters inserted that are breaking the link.

This took me a while to figure out so in case it helps others, here are the steps I used to build on an ARM64 device:

sudo apt update && sudo apt install -y curl tar git sqlite3 make

# burner.kiwi requires go >= 1.16
cd /tmp
curl -O -J -L https://go.dev/dl/go1.17.6.linux-arm64.tar.gz
tar -C /usr/local -xzf go*linux-arm64.tar.gz
export PATH=$PATH:/usr/local/go/bin
echo 'export PATH=$PATH:/usr/local/go/bin' > /etc/profile.d/go_path.sh
go version

cd /tmp
git clone https://github.com/golangci/golangci-lint.git
cd golangci-lint
bash install.sh
mv bin/golangci-lint /usr/local/bin

cd /tmp
git clone https://github.com/tdewolff/minify.git
cd minify/cmd/minify
go build
mv minify /usr/local/bin

cd /tmp
git clone https://github.com/haydenwoodhead/burner.kiwi.git
cd burner.kiwi
sed -i 's/GOOS=linux GOARCH=amd64 //g' Makefile
make build-sqlite
mv burnerkiwi /usr/local/bin

I am using Ubuntu 21 and have installed Go using APT, which is 1.17.

Firstly I grab the Burner.Kiwi repo using GIT: git clone https://github.com/haydenwoodhead/burner.kiwi.git
Cloning into 'burner.kiwi'...
remote: Enumerating objects: 3755, done.
remote: Counting objects: 100% (517/517), done.
remote: Compressing objects: 100% (313/313), done.
remote: Total 3755 (delta 315), reused 365 (delta 185), pack-reused 3238
Receiving objects: 100% (3755/3755), 12.19 MiB | 5.55 MiB/s, done.
Resolving deltas: 100% (1585/1585), done.

Based on the documentation I then need to run: make build
make build
rm ./burner/static/.min.css || true
rm: cannot remove './burner/static/.min.css': No such file or directory
Makefile:8: *** github.com/tdewolff/minify is required to build burner.kiwi. Stop.

I'll download minify and add to the directory: ls
about.burner.kiwi burner.kiwi config.go Dockerfile emailgenerator go.sum main.go minify README.md stringduration
burner cloudformation.json data email go.mod LICENSE.md Makefile notary roger.png

Try again to build: make build
make build
rm ./burner/static/.min.css || true
rm: cannot remove './burner/static/.min.css': No such file or directory
Makefile:8: *** github.com/tdewolff/minify is required to build burner.kiwi. Stop.

I can't access the website anymore, the message {"message":"Forbidden"} is shown as plain text in the page and nothing else.

Using Chrome, Firefox and Windows 10

Hi! Sorry for another my issue :)
Now you're using only mailgun and local smtp. In case of using smtp only, you can run one process per node, because it uses 25th port. That doesn't allow you to scale horizontally or use different configurations per-container.

What about providing remote smtp + auth for that? Then you can have a lot of containers and processes per node + use a lot of different configurations.

Hello.
Unfortunately I'm not golang programmer, but I was able to fork and manually change retention period of mailbox from 24 hours to 30 min + cookie lifetime. Is it possible to put variable for this in env?
Such configuration can be useful for users, who are not ok with default 24h retention.

Thanks in advance ;-)

Im considering running it on Lambda and i would appreciate it if you could share your basic anti-abuse approach.

For example:

-blocking incoming mails from certain domains.
-do you have an auto-kill function for lambda if somone abuse the servers?

Sorry if this is beyond the scope of what you can share and thanks for making this awesome service. I also tried looking up for the legal implications on hosting such a service but found none.

As the title says, it would be useful sometimes to just be able to prolong the duration of an address.

.

Hi,

Love your no bullshit approach. Is it possible you could add a client SSL cert validation? This would solve authentication issues, without the need to deploy, say, Nginx in front of burner.kiwi.

How do you do
I hope to get your help，How to install in CentOS？How to configure SMTP？I really hope you can help me。

The sandboxed iframe does not protect enough from leaked information.

See https://www.emailprivacytester.com/test?code=5c94fc430dedd107e0336465

Is the code in the main branch in a buildable state? I'm getting errors...

`

github.com/mattn/go-sqlite3

sqlite3-binding.c: In function ‘sqlite3SelectNew’:
sqlite3-binding.c:125322:10: warning: function may return address of local variable [-Wreturn-local-addr]
125322 | return pNew;
| ^~~~
sqlite3-binding.c:125282:10: note: declared here
125282 | Select standin;
| ^~~~~~~
`

Hi
First of all I am thankful from Burner.kiwi developers.

If I want to host my own burner.kiwi I should use mailgun or I can use smtp or any mailgun alternative?

If there is a good alternative for mailgun please say those.

Thanks

$ curl https://burner.kiwi/api/v2/inbox/ -v -L
... [truncated tls handshake]
> GET /api/v2/inbox/ HTTP/2
> Host: burner.kiwi
> user-agent: curl/7.74.0
> accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 301 
< content-type: text/html; charset=utf-8
< date: Mon, 19 Sep 2022 09:54:46 GMT
< location: /api/v2/inbox
< server: Caddy
< content-length: 48
< 
* Ignoring the response-body
* Connection #0 to host burner.kiwi left intact
* Issue another request to this URL: 'https://burner.kiwi/api/v2/inbox'
* Found bundle for host burner.kiwi: 0x55da24fe0320 [can multiplex]
* Re-using existing connection! (#0) with host burner.kiwi
* Connected to burner.kiwi (54.245.58.14) port 443 (#0)
* Using Stream ID: 3 (easy handle 0x55da24fc3990)
> GET /api/v2/inbox HTTP/2
> Host: burner.kiwi
> user-agent: curl/7.74.0
> accept: */*
> 
< HTTP/2 200 
< content-type: application/json
< date: Mon, 19 Sep 2022 09:54:47 GMT
< server: Caddy
< content-length: 412
< 
{"success":true,"errors":null,"result":{"email":{"address":"[email protected]","id":"4f287549-afc9-46ab-bcd4-54acd79a9859","created_at":1663581287,"ttl":1663667687},"token":"eyJhbGciOiJIUzI1NiJ9.eyJJbmJveElEIjoiNGYyODc1NDktYWZjOS00NmFiLWJjZDQtNTRhY2Q3OWE5ODU5IiwiX19wdXJwb3NlIjoiYXV0aCIsImV4cCI6MTY2MzY2NzY4NywiaWF0IjoxNjYzNTgxMjg3LCJpc3MiOiJidXJuZXIua2l3aSJ9.JSQZElGOWfObR8jS9aFoMjxy5XWBgE-_soNC8MOHlV4"}}
* Connection #0 to host burner.kiwi left intact

Two things I noticed:

1. The response code is 200 OK instead of the documented 201 Created
2. Why does the server first return an 301 Moved Permanently to the same location it previously made a request to?

Site is responding with HTTP ERROR 502

Deprecate dep & vendor folder in favor of go modules.

I could take over this if you are ok with this.

Hi! What was the reason to remove prom metrics? even if kiwi runs outside of k8s, metrics are bro :) may be there is another kind of monitoring inside? I took a look at the code but saw nothing regarding monitoring.

P.S. can kiwi run in cluster-mode?

This was definitely working in the past and I couldn't find any recent commit that seemed like it would affect it. The following steps end up serving the static folder from the repo root instead or what gets compiled for the build.

git clone https://github.com/haydenwoodhead/burner.kiwi.git
cd burner.kiwi
go mod init
make build-sqlite
[set up BK env with STATIC_URL=/static]
./build/burnerkiwi

Accessing WEBSITE_URL works and core functionality is fine, but none of the CSS loads. However, WEBSITE_URL/static/custom.css does load.

It's really not a new technology, and many ISPs don't really provide a proper IPv4 anymore.

Can you develop more features of the API as follows:

1. Create custom emails
2. Read mail by sender and, or subject
3. Delete mail after reading (optional)
4. Add email TTL option
   My job really needs it, thank you

In order to open have a naming that makes sense when using different email providers, the proposal is to rename the following environment names from -> to:

MG_DOMAIN -> API_DOMAIN
MG_KEY -> API_KEY

So in #7 I can reuse them without incurring in a naming conflict.

We can keep this open until #7 comes, but wanted to open the issue to grab some feedback from you.

messages do not come

Hi all,

Sorry, this isn't an issue as such, just somewhere to open a discussion.

I currently own a temporary email service similar to that of Burner.Kiwi, although mine is written in PHP and relies heavily on IMAP. While this has worked reasonably well until now, the IMAP server is struggling to keep up with the number of concurrent connections to the single inbox so I am trying to find an alternative. Burner.Kiwi looks quite promising so far.

Firstly, can I ask, how many concurrent users could Burner.Kiwi handle using SQLite, or is this entirely limited by server resource? If this could handle say a million emails a day and 1,000 concurrent users, then I might go ahead and do this.

Ideally I would like to run Burner.Kiwi in a server-less environment, but this would require MailGun, which is expensive. I see someone has talked about using SendGrid before which is a lot cheaper although this isn't built. Do you know if anyone has started such a thing? I might be interested in building this, although I might need a little help.

Apart from that, I am trying to think of alternative ways which Burner.Kiwi could handle incoming emails in a server-less environment. I am wondering if it would be possible to use AWA SES somehow? From my initial investigation emails could be processed by AWS SES and put into an S3 container, or, piped into a Lambda function. From there anything can happen, maybe onwards to MySQL, Postgres, DynamoDB? Likewise, an Azure LogicApps could also automatically pick up emails from an Outlook inbox and parse that into a database.

Any thoughts?

curl https://burner.kiwi/api/v1/inbox/
404 page not found

API Docs used: https://about.burner.kiwi/apidocs/

Is the endpoint correct?

What do you think about supporting Sendgrid?

In my case that's the tool we are using internally for our mailing, so being able to deploy our own burner.kiwi instance but using sendgrid would be a great plus.

I think the page is down or otherwise unavailable. Love the project

Ok, so I have never used an api before, so this could be a dumb question...
The id was "22fd0760-67aa-461b-ba34-16c1f82f9219"
So in python3 I executed:

import requests
r=requests.get("https://burner.kiwi/api/v1/inbox/22fd0760-67aa-461b-ba34-16c1f82f9219")
print(r.text)

and I got:

'{"success":false,"errors":{"code":500,"msg":"Unauthorized: given auth key invalid"},"result":null,"meta":{"version":"37a54f8","by":"Hayden Woodhead"}}\n'

Any ideas on how to fix this?
Thanks!

One feature I'd like to see is the ability to set a custom address to receive at. Is this something you have looked at/do you know if Mailgun's API supports it? I'd be happy to work on this if there are no known blockers.

How do you setup the DNS when using SMTP?

Can you provide an example of your DNS configuration?

It doesn't seem to use its own smtp server when set so my question is are there any special requirements for the smtp server if it does need to be a separate program like does it have to be set up for catch all

i cant access burner.kiwi api somehow.

message content display not work.

Hi,

I've noticed that you're running burner.kiwi on Fly.io. Would you mind publishing your fly.toml file so others can deploy this app via Fly.io?

I am happy to write up a guide to run this app within the free tier limits if you are okay to publish the steps.

Thank you!