Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

11–20 of 199 posts

Re: Subscription bombing and how to mitigate it

#11

Post by AussieWog93 »

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

Honestly I really like CloudFlare as a business. There's no vendor lock-in, just a genuine good product.

If they turn around later and do something evil, literally all I need to do is change the nameserver to a competitor and the users of my website won't even notice.

Re: Subscription bombing and how to mitigate it

#12

Post by tariky »

I had similar situation on WooCommerce shop. But it was much more signups per hour. Putting turnstile in front fixed problem.

My conclusion is to move from WordPress software as fast as possible, every WordPress site I manage gets bombarded by bots.

Re: Subscription bombing and how to mitigate it

#13

Post by stingraycharles »

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

So your solution would be to do nothing?

Cloudflare is an excellent solution for many things. The internet was designed to withstand a nuclear war, but it also wasn’t designed for the level of hostility that goes on on the internet these days.

Re: Subscription bombing and how to mitigate it

#15

Post by JoshTriplett »

devmor wrote: post #6
cuu508 wrote: post #3

> If a bot creates an account with someone else’s email, the victim gets one email, if they ignore it that’s the end of it. The welcome email and everything after it only fires once the user verifies. As a user, I would prefer no welcome email at all.

Then there's no verification step, preventing the entire mechanism of you not getting spammed.

It sounds like cuu508 didn't want the post-verification welcome, as opposed to the one-time verification message.

Re: Subscription bombing and how to mitigate it

#16

Post by grey-area »

mads_quist wrote: post #10
grey-area wrote: post #9

Earlier quoted context omitted.

Can you expand on that? A separate honey pot sign up page invisible to real users, or something else?

You add "hidden" inputs to your HTML form that are named like "First Name" or "Family Name". Bots will fill them out. You will either expect them to be empty or you fill by JavaScript with sth you expect. It's of course reverse-engineerable, but does the trick.

Thanks, I’ve seen scripted attacks bypass this sort of hidden input unfortunately (perhaps human assisted or perhaps just ignoring hidden fields).

Re: Subscription bombing and how to mitigate it

#17

Post by cuu508 »

JoshTriplett wrote: post #15
devmor wrote: post #6

Earlier quoted context omitted.

Then there's no verification step, preventing the entire mechanism of you not getting spammed.

It sounds like cuu508 didn't want the post-verification welcome, as opposed to the one-time verification message.

Correct.

Re: Subscription bombing and how to mitigate it

#18

Post by alexjurkiewicz »

mads_quist wrote: post #10
grey-area wrote: post #9

Earlier quoted context omitted.

Can you expand on that? A separate honey pot sign up page invisible to real users, or something else?

You add "hidden" inputs to your HTML form that are named like "First Name" or "Family Name". Bots will fill them out. You will either expect them to be empty or you fill by JavaScript with sth you expect. It's of course reverse-engineerable, but does the trick.

Doesn't that break password manager autofill?

Re: Subscription bombing and how to mitigate it

#19

Post by wdutch »

nubg wrote: post #14

This post was written by AI, there are multiple clues. Author, why can you not use your own words? I am not sure what you meant to say, vs what is LLM garbage I could have prompted myself.

I can't comment on if it was written by AI or not but I found the OP informative and quite dense with useful information. Nothing stood out to me as garbage.

Re: Subscription bombing and how to mitigate it

#20

Post by colesantiago »

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

And your solution is assume everyone on the internet is a good actor?

How would you solve this at scale?

Post reply on HN