Sending spammers to password purgatory • Hacker News Board

Re: Sending spammers to password purgatory

#121

Post by leshenka » Thu, Aug 04, 2022, 2:12 PM UTC

jjoonathan wrote: post #97

mrtksn wrote: post #73

Earlier quoted context omitted.

> when we manually verified an account to be a scammer This makes all the difference with other services that block out users only to let them guess why they were blocked. If an automated system did that, I would have said it's evil. Yet, I hope you have a communication channel in case there was a human error.

Yes, although I would add an attention threshold too, as it's not entirely unknown for hired manual review to just spam the "guilty" button so they can get to lunch. In any case: your false positive rate needs to be massively low if you want to be a massive asshole to the people it flags -- or else you are just an asshole. If you can afford to get the FPR down, sure, have fun, but if not, please have the decency to n…

You can implement a jury trial system - have a pool of moderators, select a few at random and have them look at the account, only flagging it if there is a consensus that it’s a scam account

Re: Sending spammers to password purgatory

#122

Post by brightball » Thu, Aug 04, 2022, 2:13 PM UTC

0xFF0123 wrote: post #118

marcinzm wrote: post #111

Earlier quoted context omitted.

...you're assuming they're keeping the IP linked to a specific profile and then making a strawman argument based on that assumption.

It sounds like that's what they're doing, in order to find other spam accounts: > We'll manually review all accounts that use (more than one of) those ip addresses.

Review is the key. They're using it as an indicator of bad behavior to provide direction where other bad behavior may be.

The IP didn't identify the person, but it did potentially implicate accounts that needed to be reviewed or that may have been compromised.

Re: Sending spammers to password purgatory

#123

Post by onychomys » Thu, Aug 04, 2022, 2:23 PM UTC

legalcorrection wrote: post #16

This is wrong. You are logging their password attempts and then sharing them with the world. It doesn’t matter that you think you know they are scammers. What gives you the right to dispense vigilante justice by disclosing people’s passwords? Shame on you.

It's not like "wasibutt123" was very secure to start with.

Re: Sending spammers to password purgatory

#124

Post by EricE » Thu, Aug 04, 2022, 2:31 PM UTC

zasdffaa wrote: post #41

bo1024 wrote: post #9

Earlier quoted context omitted.

> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.

So that's what that was... Was trying to do something legit, MS gave me a puzzle to solve, it was unsolvable in the time given, it wasted maybe 20 mins. Can't remember what it was, I think create an account for visual studio (you had to sign in to an MS account to keep using free VS, the wankers).

https://github.com/VSCodium/vscodium

Re: Sending spammers to password purgatory

#125

Post by drewzero1 » Thu, Aug 04, 2022, 2:42 PM UTC

thih9 wrote: post #102

ghgr wrote: post #89

You can check in their GitHub repo [1] the list of reasons to reject your password (classified by level of "InfuriationLevel"). Some examples: 'Password must contain at least 1 primary Simpsons family character' 'Password must contain at least 1 Nordic character' 'Password must contain at least 1 Greek character' 'Password must contain at least 1 primary Griffin family character' 'Password must contain at least one e…

The emoji rule is particularly annoying on ios; there the password keyboard (i.e. virtual keyboard used on “password” form input fields) is different and doesn’t support entering emoji.

Good to know :)

Edit: I just noticed the list has one requirement for an emoticon, and another for an emoji. Carry on.

Re: Sending spammers to password purgatory

#126

Post by tialaramex » Thu, Aug 04, 2022, 2:44 PM UTC

tialaramex wrote: post #94

ivanbakel wrote: post #59

Earlier quoted context omitted.

If Steam never saw your real password, the hash of the password would itself become the password, and Steam would be storing your password in plaintext. In order for password security to work, you have to send Steam your actual password, which they then check against the hash themselves. So at some point, Steam will have your password in plaintext.

No. In order for password authentication to be something a five year old can do by pasting PHP code they found in a Stack Overflow search, that is how it works. But algorithmically even if you want passwords (you don't in most cases, get WebAuthn for example for web site authentication) you can use an asymmetric PAKE such as OPAQUE: https://tools.ietf.org/id/draft-krawczyk-cfrg-opaque-03.html This is quite a bit more…

When people downvote something I wrote because it's sharing an opinion they don't like it, I kinda get it, that's not really what HN downvotes are for, but sure.

However in cases like this what I wrote was just a fact about a world which they weren't aware of, I'm not sure what they hope to achieve by downvoting.

ivanbakel wrote "In order for password security to work, you have to send Steam your actual password" and that's not true. It's not going to become more true if you can just delete my comment explaining why it's not true, that's not how our universe works.

Re: Sending spammers to password purgatory

#127

Post by archi42 » Thu, Aug 04, 2022, 2:45 PM UTC

0xFF0123 wrote: post #118

marcinzm wrote: post #111

Earlier quoted context omitted.

...you're assuming they're keeping the IP linked to a specific profile and then making a strawman argument based on that assumption.

It sounds like that's what they're doing, in order to find other spam accounts: > We'll manually review all accounts that use (more than one of) those ip addresses.

Obviously only vanviegen knows what they're doing, but here is what I'd do (IANAL!):

1. Identify offender (scammer/spammer) using other methods like manual review

2. Block offender as described, and only now start logging the IPs for them (claim: at that point it's legitimate interest)

3. If another user now uses one of the IPs, assume their also offenders and log their IPs as well to weed out false positives (claim: they use the known offender IPs, so there is a good chance their also offenders -> leg. int.)

4. Ban all actual offenders and delete associated IPs for false positives.

It's possible they're doing this flow and just simplified it for posting here.

Saving the IP/geolocation could also be legitimate interest to identify altered locations. E.g. say you're US based and suddenly login from $abroad they could send you a 2FA mail to secure your account.

Re: Sending spammers to password purgatory

#128

Post by drewzero1 » Thu, Aug 04, 2022, 2:45 PM UTC

brk wrote: post #99

ghgr wrote: post #89

You can check in their GitHub repo [1] the list of reasons to reject your password (classified by level of "InfuriationLevel"). Some examples: 'Password must contain at least 1 primary Simpsons family character' 'Password must contain at least 1 Nordic character' 'Password must contain at least 1 Greek character' 'Password must contain at least 1 primary Griffin family character' 'Password must contain at least one e…

My favorite was "password must be a palindrome".

Mine is "Password must contain 'Password must contain'".

Re: Sending spammers to password purgatory

#129

Post by zasdffaa » Thu, Aug 04, 2022, 2:47 PM UTC

EricE wrote: post #124

zasdffaa wrote: post #41

Earlier quoted context omitted.

So that's what that was... Was trying to do something legit, MS gave me a puzzle to solve, it was unsolvable in the time given, it wasted maybe 20 mins. Can't remember what it was, I think create an account for visual studio (you had to sign in to an MS account to keep using free VS, the wankers).

https://github.com/VSCodium/vscodium

Well, look at that! Thanks

Re: Sending spammers to password purgatory

#130

Post by detaro » Thu, Aug 04, 2022, 2:54 PM UTC

tialaramex wrote: post #126

tialaramex wrote: post #94

Earlier quoted context omitted.

No. In order for password authentication to be something a five year old can do by pasting PHP code they found in a Stack Overflow search, that is how it works. But algorithmically even if you want passwords (you don't in most cases, get WebAuthn for example for web site authentication) you can use an asymmetric PAKE such as OPAQUE: https://tools.ietf.org/id/draft-krawczyk-cfrg-opaque-03.html This is quite a bit more…

When people downvote something I wrote because it's sharing an opinion they don't like it, I kinda get it, that's not really what HN downvotes are for, but sure. However in cases like this what I wrote was just a fact about a world which they weren't aware of, I'm not sure what they hope to achieve by downvoting. ivanbakel wrote "In order for password security to work, you have to send Steam your actual password" and…

It seems pretty obvious that you were downvoted primarily for the entire entirely unnecessary "5 year olds copy-pasting from stack overflow" bit. "Actually, this isn't true anymore, a few years ago [afaik OPAQUE is from only 2018?) they found a protocol that solves this:" would've been a much more productive start to that comment.