151–160 of 170 posts
I wouldn't be comfortable doing this, for one thing, we know people tend to re-use passwords. So any email/password info you collect should be treated with security like they just gave you their bank login, because some of them did. So then Troy has to report himself to his own service (haveibeenpwned).
Earlier quoted context omitted.
Yes, although I would add an attention threshold too, as it's not entirely unknown for hired manual review to just spam the "guilty" button so they can get to lunch. In any case: your false positive rate needs to be massively low if you want to be a massive asshole to the people it flags -- or else you are just an asshole. If you can afford to get the FPR down, sure, have fun, but if not, please have the decency to n…
You can implement a jury trial system - have a pool of moderators, select a few at random and have them look at the account, only flagging it if there is a consensus that it’s a scam account
This reads more like Microsoft content marketing than a serious attempt to do anything of value.
Earlier quoted context omitted.
Yeah especially using that Microsoft service. Takes me back to M$ sponsored tech talks where they had to use MSN search and not mention the G word.
This is a Microsoft sponsored tech talk. Advertising for MS is one of Troy's businesses, as he discloses in his bio on the page. And the banner at the top says this particular post is sponsored by Cloudflare.
Earlier quoted context omitted.
> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.
So that's what that was... Was trying to do something legit, MS gave me a puzzle to solve, it was unsolvable in the time given, it wasted maybe 20 mins. Can't remember what it was, I think create an account for visual studio (you had to sign in to an MS account to keep using free VS, the wankers).
So I pick up spam calls, press 1 immediately, then put the phone back in my pocket. This usually connects it to a real person who hears ambient noise, thinking I'm nearby. Usually I waste like 60sec of their time for 2sec of my time. It's hard for them to protect against this because no matter what, they need some victims to talk to the real person, unless they develop a very smart AI. But a relatively simple bot with a list of likely scam numbers could automate the fake victim's side.
A colleague was dealing with more advanced scammers who had already made some progress with his unaware mother. Their scam was unique in that it required calling them back. He managed to collect all the phone numbers they were using, then he put up fake Craigslist ads for free couches... and you can guess the rest.
1. marcopollo – Password must contain at least two numbers. 2. marcopollo11 – Password must not begin or end with a number. 3. m1arcopoll1o – Password must not contain two of the same number. 4. m1arcopoll2o – Password must contain at least one special character (! ? & % $ # @). 5. m1arcopoll2o! – Password must not end with a special character. 5. m1arcopoll2!o - Password must not contain 3 or more of the same letter. 6. m1arcopoll2p! - Password must not contain 2 of the same consecutive character. 7. I forget, but it kept going.
At some point, I gave up and started generating random passwords. The first 3 attempts were still not accepted. In a way, those restrictions were actually reducing the entropy.
Don't do that. No, really, don't.
Okay, you didn't listen and did it anyway; please, at least don't automate it or semi-automate it where you're just doing it with one click.
> Spammer burned a total of 80 seconds in Password Purgatory
So you think, based on the belief that when you reply to the spam, it goes back to the spammer.
That may not be the case; when you engage spam, you are possibly generating "backscatter"; a person having nothing to do with the spammer may receive the e-mail.
Spam messages are not always relying on someone replying to them to hook in the victim. Sometimes there is no hook at all, or sometimes the hook is in the HTML links, and not in replying. (They additionally hope that if you reply, the person you are replying to will also get the spam e-mail, since it is quoted, and that person will click on the links.)