Wow, so this is why I've been having trouble getting Mailchimp to load lately. As a developer I often have devtools open for whatever I'm working on. If need to help out marketing with an automation or something, using the same tab, I get banned for the day.
Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
11–20 of 204 posts
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#12Well that is poopy. Is there a way I can “stealth” open dev tools on all sites? I like to see network requests in a lot of places, but don’t like to think the server will change their responses based on my local actions.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#13How can they tell that you opened dev tools?
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#14This SO post is a bit old now, so I'd verify before proceeding, but it looks like having devtools open in a separate window will enable you to circumvent the check. https://stackoverflow.com/questions/40153206/detect-if-conso...
Or have it open before you visit the page. Assuming they are detecting a resize.
But if they really detect a resize, anyone who actually does resize their page will be blocked as well.
Doing that seems a bit insane to me.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#15Well that is poopy. Is there a way I can “stealth” open dev tools on all sites? I like to see network requests in a lot of places, but don’t like to think the server will change their responses based on my local actions.
Make it open in a separate window.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#16It's pretty common as an account hijacking vector, right? Hackers tell non-techies to paste things into the console, which can then share cookies or access tokens with the attacker. Obviously the browser is "owned" by the client, so a sufficiently motivated techie could bypass this any number of ways. But it prevents some number of non-techies from security issues.
You can print debug messages to the console to warn people. The website has no idea if they opened it or not.
But here, it seems they are detecting if the window is resized! That's just crazy.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#17I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#18It's pretty common as an account hijacking vector, right? Hackers tell non-techies to paste things into the console, which can then share cookies or access tokens with the attacker. Obviously the browser is "owned" by the client, so a sufficiently motivated techie could bypass this any number of ways. But it prevents some number of non-techies from security issues.
In that case you take Facebook 's route and show a message when you open the console.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#19That's an anticompetitive move. If you need to switch senders for some reason, the inspector is the only clean way to get an email's HTML into another ESP.
Is that true?
An email client like Thunderbird or Mail will save a copy of the email on your local hard drive, which will include the HTML. This isn't something I do regularly, but would be first first response if I needed to see the HTML of an email. Maybe Mailchimp has protections against this route too?
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#20Earlier quoted context omitted.
Open the inspector, reload the page and you'll see: "Request Blocked We blocked your request because the IP address you’re using looks suspicious. This issue will usually resolve itself after a short period of time, and you can try your request again. You can also try using a different IP address to see if that resolves the issue. If you need additional help, you can try one of these support options. Reference Number…
Thank you for the description. I assume they're using a bot management script which is set to block requests if devtools is open. For such websites, opening devtools in a separate window should work. Some websites will try to throw you into a loop of debugger statements if they detect devtools being opened, which is harder to work around, but it doesn't seem to be the case here.
Is there an extension or workaround that prevents sites from knowing you opened devtools (without breaking everything else on the site)?