Sending spammers to password purgatory • Hacker News Board

Re: Sending spammers to password purgatory

#21

Post by duxup » Thu, Aug 04, 2022, 4:23 AM UTC

armchairhacker wrote: post #5

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…

Google had me in an endless no right answers captcha after I left a vpn on one day.

Lasted a few hours. I figure someone else on that vpn was doing something wrong and they just blocked anyone from there for a while.

Super frustrating that your left to just … to get frustrated.

Re: Sending spammers to password purgatory

#22

Post by drfuchs » Thu, Aug 04, 2022, 4:31 AM UTC

Troy, watch out you don't open yourself up for an attack from the bad guys: They'll start sending you solicitations with ReplyTo addresses of industry honeypots, and before you know it, you'll become a known spammer and your regular outgoing emails will be routed to recipient's spam folders or maybe even dropped entirely.

Re: Sending spammers to password purgatory

#23

Post by artificialLimbs » Thu, Aug 04, 2022, 4:34 AM UTC

armchairhacker wrote: post #5

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…

Verizon’s site times out your login after like 2 minutes. Just trying to manage my account on the site is a nightmare, and I’m on fiber.

Re: Sending spammers to password purgatory

#24

Post by thomassmith65 » Thu, Aug 04, 2022, 4:36 AM UTC

  Spammer burned a total of 80 seconds in Password Purgatory

The ability to deal with a bad actor by wasting a minute and 20 seconds of his/her time isn't cause for fist-pumping or high-fiving. The internet needs a better way to verify user identity. The lack of online accountability isn't worth the cost anymore.

Re: Sending spammers to password purgatory

#25

Post by sdoering » Thu, Aug 04, 2022, 4:40 AM UTC

donkarma wrote: post #17

armchairhacker wrote: post #5

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…

steam censors passwords. if you have 88 in your password you will fail to register

I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles).

But how many people do I know born in 88. Or on the 8th of August?

I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers.

Edit: Typo

Re: Sending spammers to password purgatory

#26

Post by null0pointer » Thu, Aug 04, 2022, 4:55 AM UTC

sdoering wrote: post #25

donkarma wrote: post #17

Earlier quoted context omitted.

steam censors passwords. if you have 88 in your password you will fail to register

I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo

I bet for every one neo-nazi they block hundreds of birthdays or Chinese [0]. Just seems overly sensitive to me when you wouldn’t even know a person is a neo-nazi unless they start saying neo-nazi shit. Saying neo-nazi shit is in itself grounds for a ban so why block the number 88 at all? How could anyone possibly be offended by the number 88 alone?

0: https://en.wikipedia.org/wiki/Chinese_numerology#Eight

Re: Sending spammers to password purgatory

#27

Post by miedpo » Thu, Aug 04, 2022, 5:00 AM UTC

This reminds me of SpAmnesty.

Re: Sending spammers to password purgatory

#28

Post by fieryskiff11 » Thu, Aug 04, 2022, 5:09 AM UTC

sdoering wrote: post #25

donkarma wrote: post #17

Earlier quoted context omitted.

steam censors passwords. if you have 88 in your password you will fail to register

I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo

No post body was provided.

Re: Sending spammers to password purgatory

#29

Post by stepupmakeup » Thu, Aug 04, 2022, 5:17 AM UTC

bo1024 wrote: post #9

armchairhacker wrote: post #5

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…

> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.

ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.

Re: Sending spammers to password purgatory

#30

Post by ImPostingOnHN » Thu, Aug 04, 2022, 5:25 AM UTC

fjfbsufhdvfy wrote: post #11

armchairhacker wrote: post #5

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…

They are indeed set up to waste people's time. Blocking people leads to them searching for ways around your block really quickly. Making them waste time not realizing they have been blocked, such as endless retries or shadow bans, is much more effective at making them stop bothering you for a while longer. Time spent doing this is time they can't spend being malicious on your platform. It's unfortunate when a non-mal…

it is unfortunate that some people believe those pros outweigh the punishment inflicted on innocent users

it is better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one

essentially the companies are shifting their own pain (with spammers) onto innocent users ("it's your problem now, suck it users, lol!!!")