101–110 of 170 posts
Earlier quoted context omitted.
He's triggering it manually. And I'm pretty sure he knows what backscattering is.
I missed the manual part. If that is the case I wonder whose time is getting more wasted!
You can check in their GitHub repo [1] the list of reasons to reject your password (classified by level of "InfuriationLevel"). Some examples: 'Password must contain at least 1 primary Simpsons family character' 'Password must contain at least 1 Nordic character' 'Password must contain at least 1 Greek character' 'Password must contain at least 1 primary Griffin family character' 'Password must contain at least one e…
For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addre…
[flagged]
This is wrong. You are logging their password attempts and then sharing them with the world. It doesn’t matter that you think you know they are scammers. What gives you the right to dispense vigilante justice by disclosing people’s passwords? Shame on you.
He's not sharing the email adresses, only anonymous password attempts.
Earlier quoted context omitted.
> The "legitimate interest" GDPR strawman In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly…
People can claim it all day long but it was determined that IP addresses are only PII in the hands of an entity who can actually associate it with a person, like an ISP. https://www.jdsupra.com/legalnews/court-confirms-that-ip-add...
Earlier quoted context omitted.
If Steam never saw your real password, the hash of the password would itself become the password, and Steam would be storing your password in plaintext. In order for password security to work, you have to send Steam your actual password, which they then check against the hash themselves. So at some point, Steam will have your password in plaintext.
No, not really. I'll give you an example that's not really secure, but should illustrate one possible method: 1. You produce an "authentication hash" X = hash(normalize(your_username) + your_password) and send X to the server. 2. The server computes Y = hash(X) and checks Y against the stored hash. Now you're not sending the plaintext password to the service (e.g. steam), and steam is also not storing the "raw" authe…
For better or for worse, "publicizing spammers pain for our pleasure" has a guaranteed effect of shortening the useful lifespan of this tool. Unless of course no spammers ever read that article, OR HN.
Earlier quoted context omitted.
Yes banning users from a website is exactly like sending them to the gulag, it's exactly that
So you don't believe in guilty until proven innocent? Or do you? How do you justify banning innocent users?
Got sent to the gulag - well now you have a major problem. Can't post meme on reddit - oh no!
Websites generally aren't obligated to accept all users, precisely because we as a society decided that it's not really a big deal if you can't.
This is wrong. You are logging their password attempts and then sharing them with the world. It doesn’t matter that you think you know they are scammers. What gives you the right to dispense vigilante justice by disclosing people’s passwords? Shame on you.
you are mistaking scammers with spammers, and also mistaking what the poster thinks with reality the reality is they are spammers, because spamming the poster is the only way they can end up with a reply email containing a link with a valid key to interact with this API if they didn't send unsolicited commercial emails, there's no way they can interact with this API and get their passwords logged