Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

121–130 of 199 posts

Re: Subscription bombing and how to mitigate it

#121

Post by latexr »

znnajdla wrote: post #98
latexr wrote: post #76

Earlier quoted context omitted.

> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.

Yes and I don’t claim to solve the problem completely. It’s an impossible to solve problem which BigTech wants you to pay mafia protection money to “solve”.

The point I was making is that you’re criticising something while suggesting something else even easier to bypass.

Re: Subscription bombing and how to mitigate it

#122

Post by gregoriol »

shaky-carrousel wrote: post #64
pqdbr wrote: post #27

Recently we suffered a different kind of subscription bombing: a hacker using our 'change credit card' form to 'clean' a list of thousands credit cards to see which ones would go through and approve transactions. He ran the attack from midnight to 7AM, so there were no humans watching. IPs were rotated on every single request, so no rate limiter caught it. We had Cloudflare Turnstile installed in both the sign up for…

Well, what you can do is notify the card issuer about those cards that went through, so they can mark them as stolen. That surely will make the hacker really happy, and discourage them of doing it again :)

So you mean you are keeping full card numbers somewhere in your logs to... fix some potential security issue...?

Re: Subscription bombing and how to mitigate it

#123

Post by latexr »

stanac wrote: post #96
latexr wrote: post #76

Earlier quoted context omitted.

> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.

I added custom captcha (simple math as slightly distorted pictures with audio alternative) on one of my forms, it prevents ~80% of spam submissions. less than 1% of spam passes, other ~20% are blocked on key words (like "sex", "passion", etc...).

Not sure why you’re telling me that. I’m not criticising CAPTCHA, my parent comment was.

Re: Subscription bombing and how to mitigate it

#124

Post by aaron695 »

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

[dead]

Re: Subscription bombing and how to mitigate it

#125

Post by butvacuum »

gregoriol wrote: post #122
shaky-carrousel wrote: post #64

Earlier quoted context omitted.

Well, what you can do is notify the card issuer about those cards that went through, so they can mark them as stolen. That surely will make the hacker really happy, and discourage them of doing it again :)

So you mean you are keeping full card numbers somewhere in your logs to... fix some potential security issue...?

>Hey mr processor, the cards for transaction numbers x...y are stolen.

Re: Subscription bombing and how to mitigate it

#126

Post by jijijijij »

pverheggen wrote: post #36
m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

I wouldn't call this "known security issues", it's an inherent problem with any signup or forgot password page. Also, I doubt this is going to be pissing users off since they added Turnstile in invisible mode, and selectively to certain pages in the auth flow. Already signed in users will not be affected, even if the service is down. This is way different from sites like Reddit who use their site-wide bot protection,…

> I wouldn't call this "known security issues", it's an inherent problem with any signup or forgot password page.

It's not inherent, though! Easy, definite fix: Reverse the communication relation. If the user has to open their mail app anyway, you could simply require them to send an email to you, instead of vice versa. This would solve the problem completely. (If spoofing the sender could be done reliably, the service wouldn't be involved in the first place.)

Now, it would slightly increase friction and lower convenience. That's why it's not done. It's inherently incompatible with dark patterns, data collection and questionable new user acquisition, but this too could be solved through standards and integration - without making Cloudflare de facto infrastructure necessity!

Possible convenient, better solutions: Have the browser send this mail, either by passing a template to the mail app, integrating SMTP into the browser/addon, or instate a novel authentication protocol, which in fact may remove the human interaction completely.

As if 2FA security was the main motivation for asking for email, and/or phone anyway. Companies want user IDs, if possible UIDs, as soon as possible to increase user data value and gain marketing opportunities. I once had a "welcome mail" after typing in the address, before sending the form. Yeah...

Re: Subscription bombing and how to mitigate it

#127

Post by xmcqdpt2 »

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

As is often repeated, the optimal amount of fraud is not zero

https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...

They are optimizing towards making it easy to purchase things on a whim.

Re: Subscription bombing and how to mitigate it

#128

Post by nottorp »

stingraycharles wrote: post #13
m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

So your solution would be to do nothing? Cloudflare is an excellent solution for many things. The internet was designed to withstand a nuclear war, but it also wasn’t designed for the level of hostility that goes on on the internet these days.

Cloudflare is becoming a single point of failure. That is not a solution.

And these people weren't validating the email address on signup. To "reduce friction" i guess.

Re: Subscription bombing and how to mitigate it

#130

Post by petercooper »

As a newsletter company, we've dealt with this for over a decade now since we do the right thing and do double opt-in which involves sending the subscriber an email on signup.

Until a few years ago, IP reputation was a good defence against this. The bad traffic almost entirely came from IP addresses in certain countries or from datacenter IPs we could block. Nowadays, that doesn't work due to the prevalence of VPNs, so many legitimate users appear to come from low reputation IPs.

Turnstile is a reasonable solution in its normal form, though the 'invisible' option still lets a lot of them through. Another thing that works, surprisingly, is looking for "webdriver" usage. Despite being easy to strip out webdriver fingerprints, we find that the majority of automated attempts do not bother to do this. Adding more steps, honeypots (with an immediate short term IP ban), etc. also have an impact. It becomes a game of piling up numerous defences in a sort of "Swiss cheese model".

Post reply on HN