Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwned or Bot

troyhunt.com

Post reply on HN
Print view View original

21–30 of 89 posts

Re: Pwned or Bot

#21

Post by nibbleshifter »

arjvik wrote: post #3

This is a cute "hack" for bot detection, but it's too unpredictable for the real world. Far too many users with good security hygiene are penalized by this system Plus, this might incentivize hackers to defeat the system by logging into and using email accounts pwned in these breaches.

> Plus, this might incentivize hackers to defeat the system by logging into and using email accounts pwned in these breaches.

This already happens at a large scale anyway.

There's hundreds, if not thousands of "account shops" and sellers online selling hacked accounts for all sorts of services. Everything from Spotify to Twitter to news sites.

They ingest new breaches (or use automated tools to go hack sites and dump databases), and automatically test the leaked credentials against loads of shit using tools like OpenBullet or SentryMBA.

Those tools even integrate rotating proxies, captcha solvers, etc.

There's a few good talks on this, credential spraying and account shops.

Re: Pwned or Bot

#23

Post by MonkeyClub »

Buffout wrote: post #19
CGamesPlay wrote: post #6

Facebook and Twitter are basically closed to new users. If you've gone this far without an account, your new one will be shut down for being a bot within hours of creating a new account, or flagged for "extra verification" which requires sending a government ID to these companies so they can verify that you didn't photoshop a fake government ID. This new approach seeks to extend this feature to the entire internet .…

> so they can verify that you didn't photoshop a fake government ID. Huh. How?

By taking a publicly available template, and putting in your details and mugshot.

Re: Pwned or Bot

#24

Post by Buffout »

MonkeyClub wrote: post #23
Buffout wrote: post #19

Earlier quoted context omitted.

> so they can verify that you didn't photoshop a fake government ID. Huh. How?

By taking a publicly available template, and putting in your details and mugshot.

I mean how can Facebook check government ID if it is legit? ( not how to photoshop ID. )

Re: Pwned or Bot

#25

Post by vachina »

Semaphor wrote: post #10
commitpizza wrote: post #5

I pay for my email that gives me a lot of aliases and most of them have not been pwned yet. So with his tool I would be flagged as a bot. Honestly, doesn't sound like a great idea to be frank. There must be large swaths of people that have either been careful or have specific emails that they use for certain purposes that haven't been pwned. The question, what should happen if I haven't been pwned? Should I not be ab…

Edit: I misunderstood Troy. Original comment: No, it doesn't penalize them (at least not his idea, implementations might), it simply fast tracks pwned emails and doesn't apply the normal bot checks that would otherwise apply to everyone.

I wonder how many pwned email and password pair still match. Crooks can take control of these pwned accounts and pretend to be trustworthy.

Re: Pwned or Bot

#26

Post by jwally »

I'll be a contrarian: I like it.

Is it a black and white silver bullet one call destroys 'em all solution? Not even close. But, like he states in his article; from a "defence in depth" its another strong signal.

Are you a bad guy just because you have a weirdo email (which I do)? No.

Are you a bad guy just because you use tor? No.

Are you a bad guy just because you're trying to make a purchase during an extreme surge? No.

Are you PROBABLY a bad guy given a weirdo email, you're on tor, and you're trying to buy during a surge in purchases? I would say yes. I might not ban you outright, but you're going to jump through a lot more hoops than someone with an ancient email and a residential ip address.

Re: Pwned or Bot

#27

Post by robga »

rippercushions wrote: post #14
arjvik wrote: post #3

This is a cute "hack" for bot detection, but it's too unpredictable for the real world. Far too many users with good security hygiene are penalized by this system Plus, this might incentivize hackers to defeat the system by logging into and using email accounts pwned in these breaches.

The only security hygiene that can stop your email from leaking is using a different address for literally every service you ever log into. This is of course possible with your own domain, but in practice totally infeasible for the vast majority of people.

I now do this with iCloud Hide My Email. It’s very easy to do.

I’ve started converting all my heritage details for already registered accounts.

Re: Pwned or Bot

#28

Post by dustedcodes »

CGamesPlay wrote: post #6

Facebook and Twitter are basically closed to new users. If you've gone this far without an account, your new one will be shut down for being a bot within hours of creating a new account, or flagged for "extra verification" which requires sending a government ID to these companies so they can verify that you didn't photoshop a fake government ID. This new approach seeks to extend this feature to the entire internet .…

> If you've gone this far without an account

So they admit that new generations are not interested in FB or Twitter and they will die with the boomer generation? If not then this logic makes little sense :)

Re: Pwned or Bot

#29

Post by chrismorgan »

> it may be that they're uniquely subaddressing their email addresses (although this is extremely rare)

That “extremely rare” is about plus-addressing. My experience is that catch-all subaddressing (e.g. *@chrismorgan.info in my case) is considerably more popular, only rare rather than extremely rare.

Re: Pwned or Bot

#30

Post by nickip »

Ha I do this all the time for buying second hand concert tickets! Scammers usually use throw away email addresses. If the seller has a pwned account I trust them more ;)
Post reply on HN