Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

131–140 of 199 posts

Re: Subscription bombing and how to mitigate it

#131

Post by bigDinosaur »

jijijijij wrote: post #126
pverheggen wrote: post #36

Earlier quoted context omitted.

I wouldn't call this "known security issues", it's an inherent problem with any signup or forgot password page. Also, I doubt this is going to be pissing users off since they added Turnstile in invisible mode, and selectively to certain pages in the auth flow. Already signed in users will not be affected, even if the service is down. This is way different from sites like Reddit who use their site-wide bot protection,…

> I wouldn't call this "known security issues", it's an inherent problem with any signup or forgot password page. It's not inherent, though! Easy, definite fix: Reverse the communication relation. If the user has to open their mail app anyway, you could simply require them to send an email to you, instead of vice versa. This would solve the problem completely. (If spoofing the sender could be done reliably, the servi…

Nothing with email can ever be an easy fix, although the idea is amusing. It is inherently the problem.

Re: Subscription bombing and how to mitigate it

#134

Post by nmcfarl »

stingraycharles wrote: post #13
m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

So your solution would be to do nothing? Cloudflare is an excellent solution for many things. The internet was designed to withstand a nuclear war, but it also wasn’t designed for the level of hostility that goes on on the internet these days.

But cloudflare is also just difficult, I’m on Starlink (because where I am my only other option is Hughes net), and my browser of choice is Safari. No vpn, and only boring ad blockers.

I routinely blocked by Cloudflare from viewing things and occasionally, I am blocked from buying things. Just this weekend, it was $100 worth of athletic wear. I just keep clicking the box and it never lets me complete the purchase. After the 7th or 10th time I go and find another vendor that would actually sell to me. I was more annoyed than usual because the website already had my credit card at this point – but as this article proves there are reasons to block an order even with a credit card.

Re: Subscription bombing and how to mitigate it

#135

Post by rglullis »

So that explains the handful of random sign-ups I am getting on Communick. The pattern fits exactly what I am seeing as well (3-4 signups in an hour, weird usernames and gmail/hotmail addresses with lots of "." that are usually ignored. At least on my case the mitigation comes with my obsession in not collecting any unnecessary data. Email address are optional and only used if you are already a paying subscriber.

Maybe I should just remove it from the sign-up form altogether and use it as a honeypot.

Re: Subscription bombing and how to mitigate it

#137

Post by tmarice »

I don't really understand the captcha hate, it's table stakes for any public-facing form. You need to pick a point on the "Ease of signup" vs. "Security" curve, and email signup + captcha seems to be the sweet spot.

I haven't seen any proof that the big ones (Google, CF) can be easily and automatically bypassed, and would love to learn more if someone has evidence to the contrary.

Re: Subscription bombing and how to mitigate it

#139

Post by withinboredom »

HumanOstrich wrote: post #120
sarchertech wrote: post #116

Earlier quoted context omitted.

You have to think hard about the problem and apply individual solutions. Cloudflare didn’t work for the author anyway. Even if they had more intrusive settings enabled it would have just added captchas, which wouldn’t likely have stopped this particular attacker (and you can do on your own easily anyway). In this case I assume the reason the attacker used the change credit card form was because the only other way to…

None of your solutions seem useful in this case, especially a $150 hold. Site-wide rate limiting for payment processing? Too complicated, high-maintenance, and easy to mess up. You can't block 100% of these attempts, but you can block a large class of them by checking basic info for the attempted card changes like they all have different names and zip codes. Combine that with other (useful) mitigations. Maybe getting…

A $150 hold would clearly be noticed by the victim, so the attacker wouldn't even try it.

Re: Subscription bombing and how to mitigate it

#140

Post by LEDThereBeLight »

tmarice wrote: post #137

I don't really understand the captcha hate, it's table stakes for any public-facing form. You need to pick a point on the "Ease of signup" vs. "Security" curve, and email signup + captcha seems to be the sweet spot. I haven't seen any proof that the big ones (Google, CF) can be easily and automatically bypassed, and would love to learn more if someone has evidence to the contrary.

Anyone who’s trying to make money through stuff like this (versus just experimenting) is using one of the many paid captcha-solving APIs, which cost a cent or two per solved captcha.
Post reply on HN