Live data from Hacker News

Sending spammers to password purgatory

troyhunt.com

161–170 of 170 posts

Re: Sending spammers to password purgatory

#161
post #89

You can check in their GitHub repo [1] the list of reasons to reject your password (classified by level of "InfuriationLevel"). Some examples: 'Password must contain at least 1 primary Simpsons family character' 'Password must contain at least 1 Nordic character' 'Password must contain at least 1 Greek character' 'Password must contain at least 1 primary Griffin family character' 'Password must contain at least one e…

How about "Password must exhibit at least some character". :) :)

Re: Sending spammers to password purgatory

#162

There are simpler and more effective ways to waste spammers' time. First of all, I can't remember the last time I've gotten email spam that expected a response. On the other hand, phone spam, which is much more disruptive, is usually trying to screen me briefly then funnel me to a scammer. So I pick up spam calls, press 1 immediately, then put the phone back in my pocket. This usually connects it to a real person who…

I tried a similar approach but it resulted in me being spammed way more frequently. I assume pressing 1 flags your number as "likely to respond" and the database is then sold to other scammers. Also, collecting numbers doesn't work because all the spam calls I receive are from spoofed mobile numbers which change each time. The craigslist trick just punishes some unsuspecting person, not the scammer.

Re: Sending spammers to password purgatory

#164

This reads a bit much like an ad. I sure have to scroll through a lot about Microsoft, Cloudflare, etc. before the funny password requirements I came for, at the verrrry end.

Yeah especially using that Microsoft service. Takes me back to M$ sponsored tech talks where they had to use MSN search and not mention the G word.

I once attended a MS workshop at my school on Azure. The speaker kept saying “open x page in Edge”, until there was a page that didn’t render properly with Edge. He was very hesitant to say Chrome.

Re: Sending spammers to password purgatory

#165

Earlier quoted context omitted.

steam censors passwords. if you have 88 in your password you will fail to register

I just made a new steam account with '88' in the password. It seems to have worked fine. I also can't find any reference to this on the internet.

https://www.adl.org/resources/hate-symbol/88

Re: Sending spammers to password purgatory

#166

There are simpler and more effective ways to waste spammers' time. First of all, I can't remember the last time I've gotten email spam that expected a response. On the other hand, phone spam, which is much more disruptive, is usually trying to screen me briefly then funnel me to a scammer. So I pick up spam calls, press 1 immediately, then put the phone back in my pocket. This usually connects it to a real person who…

I tried a similar approach but it resulted in me being spammed way more frequently. I assume pressing 1 flags your number as "likely to respond" and the database is then sold to other scammers. Also, collecting numbers doesn't work because all the spam calls I receive are from spoofed mobile numbers which change each time. The craigslist trick just punishes some unsuspecting person, not the scammer.

Yes, it probably adds you to their lists. Somehow, after doing this for years, I'm probably only getting one spam call each day, maybe because my carrier did something to cut down on them.

The Craigslist trick worked because of a unique situation. They were using real numbers because their scam relied on being called back. He did call manually to make sure.

Re: Sending spammers to password purgatory

#167

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addre…

So, the problem I see here is when spammers abuse someone else's machine to conduct activity like this, and all those random people get their IP addresses blocked by your system.

And how would the legitimate owner of that IP address ever know how to contact you to get removed from your blacklist?

Re: Sending spammers to password purgatory

#168
post #130

Earlier quoted context omitted.

It seems pretty obvious that you were downvoted primarily for the entire entirely unnecessary "5 year olds copy-pasting from stack overflow" bit. "Actually, this isn't true anymore, a few years ago [afaik OPAQUE is from only 2018?) they found a protocol that solves this:" would've been a much more productive start to that comment.

While OPAQUE is modern, this whole idea isn't. SRP is a 1997 Stanford project with their results first published in 1998. But you're probably not wrong about people not liking how I phrased my reply.

Somehow I thought OPAQUE had some important change that made it practical compared to previous variants, but now I can't find what that would be or why I thought that, so yeah, the reference to the date is indeed irrelevant I think.

Re: Sending spammers to password purgatory

#169

Earlier quoted context omitted.

I just made a new steam account with '88' in the password. It seems to have worked fine. I also can't find any reference to this on the internet.

https://www.adl.org/resources/hate-symbol/88

Sorry, you are right. I meant any reference with regards steam passwords.

Re: Sending spammers to password purgatory

#170

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addre…

So, the problem I see here is when spammers abuse someone else's machine to conduct activity like this, and all those random people get their IP addresses blocked by your system. And how would the legitimate owner of that IP address ever know how to contact you to get removed from your blacklist?

No, the IP addresses won't be blocked, but the accounts will be reviewed.

Legitimate users would be able to contact us using the email address that is shown right underneath the error message.

Post reply on HN