Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

171–180 of 199 posts

Re: Subscription bombing and how to mitigate it

#171

Post by jb1991 »

deltoidmaximus wrote: post #147
letier wrote: post #61

Earlier quoted context omitted.

I have a very early gmail address. A very common first name plus two letters. It is almost unusable by now. Invoices, subscriptions, important documents about some persons real estate dealings. They all end up in my inbox. I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No co…

> I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No confirmation from my side necessary. Does google not require a verification when you setup a backup email address?!

Yes they do, so I’m not sure how that could be possible. Unless it’s a back up email address for some other email service that doesn’t require it.

Re: Subscription bombing and how to mitigate it

#173

Post by jb1991 »

xmcqdpt2 wrote: post #127
jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

As is often repeated, the optimal amount of fraud is not zero https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra... They are optimizing towards making it easy to purchase things on a whim.

As I’ve noted, I’m referring to things far beyond just purchases.

Re: Subscription bombing and how to mitigate it

#174

Post by ProllyInfamous »

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

>It’s bonkers to me that there’s any developers out there working for these companies that never thought to implement simple email verification

Other POV: I simply do not use email — like at all (don't even have a SPAM account anymore) — if your website requires me to enter an email address just to buy something, I WILL find a burner/temporary email that will allow the transaction script to proceed ("10 minute email").

I am personally grateful when a store allows me to proceed with a guest transaction [i.e. non-login, non-email purchase] — even if that means I might need to "call in" should the transaction be flagged/delayed [usually isn't].

Intentionally not giving examples to avoid hacker/targetting, but many US clothing manufacturers offer these frictionless (and legitimate) purchase pathways.

Re: Subscription bombing and how to mitigate it

#175

Post by eduction »

withinboredom wrote: post #141
tmarice wrote: post #137

I don't really understand the captcha hate, it's table stakes for any public-facing form. You need to pick a point on the "Ease of signup" vs. "Security" curve, and email signup + captcha seems to be the sweet spot. I haven't seen any proof that the big ones (Google, CF) can be easily and automatically bypassed, and would love to learn more if someone has evidence to the contrary.

My blog does a proof-of-work before submission (withinboredom.info) in your browser. It'll use a fair bit of cpu power, but should only take a few seconds to complete. For an attacker... that's quite slow and self-limiting.

I did Ctrl-F on "proof-of-work" in this thread to see if anyone had tried this, you seem to be the only one. Seems like a good precaution before sending even a verification email.

Did you have to roll your own or was there some proof of work library you were able to use?

Update: Ah, found the code - https://withinboredom.info/posts/how-this-blog-actually-work...

Re: Subscription bombing and how to mitigate it

#176

Post by expedition32 »

pprotas wrote: post #53
jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

This is intentional. Email verification is friction, so it gives users a chance to reconsider whether their purchase is really necessary. This is bad for business, because they’d prefer if you were impulsive. Also, people usually type their emails correctly, especially these days with auto-fill. So not sending confirmation emails is optimizing for the happy path.

I just recently got a Visa debit card and I have to verify every purchase in my bank app.

Absolutely 100 percent fraud and security proof.

However as you it is an extra step and I imagine many retailers have done the math between fraud and friction...

Re: Subscription bombing and how to mitigate it

#177

Post by alsetmusic »

tantalor wrote: post #166

Mitigating this is kind of pointless, because so many sites are vulnerable to this. I got subscription bombed from about a dozen .gov sites a while back. Healthcare.gov, Social Security Administration, WTC Health Program, FDA, National Institute of Mental Health, Medicare.gov. It's very easy for attackers to do this. Putting in effort to solve this for one site, and expecting any impact, is like trying to empty the o…

You mitigate because you want to be responsible and not contribute to a problem. One person has to be the first to do something better before it can become a thing that is a best practice throughout an entire industry.

Re: Subscription bombing and how to mitigate it

#178

Post by datsci_est_2015 »

dylan604 wrote: post #168
datsci_est_2015 wrote: post #163

Earlier quoted context omitted.

Genuinely asking, are you a product manager? You’re giving me flashbacks to all of the PMs who suggested a 2-3 branch decision tree for a complex classification problem, because that’s what struck them as intuitive. We are just a few baby steps away from reinventing the entire field of fraud detection within this thread.

Sir, I resent the implication! I do not lie with such swine! It's easy to say that every site must add protections against every single type of attack, except it's impossible for site owners to be experts in fraud. While credit card processing vendors are expected to be experts in fraud. I ask you where in this situation would be the better place to implement fraud detection? Of the two places, whose more financially…

:)

I think we’re 100% in agreement: let the payment processors handle the fraud. Except payment processors unfortunately hold all the cards and will shut your site down if you don’t comply with their standards :(

Re: Subscription bombing and how to mitigate it

#179

Post by observationist »

aftbit wrote: post #169
petercooper wrote: post #130

As a newsletter company, we've dealt with this for over a decade now since we do the right thing and do double opt-in which involves sending the subscriber an email on signup. Until a few years ago, IP reputation was a good defence against this. The bad traffic almost entirely came from IP addresses in certain countries or from datacenter IPs we could block. Nowadays, that doesn't work due to the prevalence of VPNs,…

That's a fun cobra effect. Age verification ("intended" to make children safer online, if you take the most charitable view) forces more and more people to use VPNs, which overall degrades the value of IP reputation as a signal, forcing providers to accept less reputable IPs because real customers come from them, which means that providers are more vulnerable to attacks that can be used to target children.

The point isn't protection from attacks that target children, it's gatekeeping content to keep it away from children. Providers are more vulnerable to attacks, overall, because of that gatekeeping, because of ht inevitable use of tools like VPNs and proxies to bypass the mechanisms being used. This sort of anti-anonymity is specifically and precisely targeted at decreasing the security of individuals, subjecting them to surveillance and control by the state. It has nothing to do with "protecting the children" and never did.

The four horsemen of the infocalypse are always about power grabs, they're never about actually protecting citizens, or children, or securing a country or region.

Re: Subscription bombing and how to mitigate it

#180

Post by Terr_ »

datsci_est_2015 wrote: post #163
dylan604 wrote: post #156

Earlier quoted context omitted.

thousands of $1 charges and refunds in a 7 hour period seems unusual to me. then again, i've never run a site that received thousands of charges ever, so seeing it in a few hours would be obvious.

Genuinely asking, are you a product manager? You’re giving me flashbacks to all of the PMs who suggested a 2-3 branch decision tree for a complex classification problem, because that’s what struck them as intuitive. We are just a few baby steps away from reinventing the entire field of fraud detection within this thread.

> reinventing

https://xkcd.com/793/

Post reply on HN