Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ban me at the IP level if you don't like me

boston.conman.org

Post reply on HN
Print view View original

251–260 of 516 posts

Re: Ban me at the IP level if you don't like me

#251

Post by runroader »

lxgr wrote: post #31
lwansbrough wrote: post #17

We solved a lot of our problems by blocking all Chinese ASNs. Admittedly, not the friendliest solution, but there were so many issues originating from Chinese clients that it was easier to just ban the entire country. It's not like we can capitalize on commerce in China anyway, so I think it's a fairly pragmatic approach.

Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?

Oddly, my bank has no problem with non-US IPs, but my City's municipal payments site doesn't. I always think it's broken for a moment before realizing I have my VPN turned on.

Re: Ban me at the IP level if you don't like me

#252

Post by [deleted] »

wvbdmp wrote: post #148
dmesg wrote: post #141

Earlier quoted context omitted.

Yes and it makes reading your logs needlessly harder. Sometimes I find an odd password being probed, search for it on the web and find an interesting story, that a new backdoor was discovered in a commercial appliance. In that regard reading my logs led me sometimes to interesting articles about cyber security. Also log flooding may result in your journaling service truncating the log and you miss something important…

You log passwords?

[deleted]

Re: Ban me at the IP level if you don't like me

#253

Post by rollcat »

Thorrez wrote: post #221
rollcat wrote: post #210

Earlier quoted context omitted.

> Sometimes I find an odd password being probed, search for it on the web and find an interesting story [...]. Yeah, this is beyond irresponsible. You know the moment you're pwned, __you__ become the new interesting story? For everyone else, use a password manager to pick a random password for everything.

What is beyond irresponsible? Monitoring logs and researching odd things found there?

The way to handle a password:

    plaintextPassword = POST["password"]
    ok = bcryptCompare(hashedPassword, plaintextPassword)
    // (now throw away POST and plaintextPassword)
    if (ok) { ... }
Bonus points: on user lookup, when no user is found, fetch a dummy hashedPassword, compare, and ignore the result. This will partially mitigate username enumeration via timing attacks.

Re: Ban me at the IP level if you don't like me

#254

Post by lukan »

sylware wrote: post #164
grandinj wrote: post #60

Earlier quoted context omitted.

There is a Chinese player that has taken effective control of various internet-related entities in the Seychelles. Various ongoing court-cases currently. So the seychelles traffic is likely really disguised chinese traffic.

I forgot about that: all the nice game binaries from them running directly on nearly all systems...

Huh? Who is them in this case?

Re: Ban me at the IP level if you don't like me

#255

Post by dmesg »

JohnFen wrote: post #244
Thorrez wrote: post #221

Earlier quoted context omitted.

What is beyond irresponsible? Monitoring logs and researching odd things found there?

How are passwords ending up in your logs? Something is very, very wrong there.

Does an attacking bot know your webserver is not a misconfigured router exposing its web interface to the net? I often am baffled what conclusions people come up with from half reading posts. I had bots attack me with SSH 2.0 login attempts on port 80 and 443. Some people underestimate how bad at computer science some skids are.

Re: Ban me at the IP level if you don't like me

#256

Post by closewith »

lxgr wrote: post #224
closewith wrote: post #170

Earlier quoted context omitted.

No, outside the US, both Visa and Mastercard regularly side with the retailer/supplier. If you process a chargeback simply because a UK company blocks your IP, you will be denied.

Visa and Mastercard aren't even involved in most disputes. Almost all disputes are settled between issuing and acquiring bank, and the networks only step in after some back and forth if the two really can't figure out liability. I've seen some European issuing banks completely misinterpret the dispute rules and as a result deny cardholder claims that other issuers won without any discussion.

> Visa and Mastercard aren't even involved in most disputes. Almost all disputes are settled between issuing and acquiring bank, and the networks only step in after some back and forth if the two really can't figure out liability.

Yes, the issuing and acquiring banks perform an arbitration process, and it's generally a very fair process.

We disputed every chargeback and post PSD2 SCA, we won almost all and had a 90%+ net recovery rate. Similar US businesses were lucky to hit 10% and were terrified of chargeback limits.

> I've seen some European issuing banks completely misinterpret the dispute rules and as a result deny cardholder claims that other issuers won without any discussion.

Are you sure? More likely, the vendor didn't dispute the successful chargebacks.

Re: Ban me at the IP level if you don't like me

#257

Post by ordu »

lxgr wrote: post #166
ordu wrote: post #81

Earlier quoted context omitted.

It is not silly pseudo-security, it is economics. Ban Chinese, lower your costs while not losing any revenue. It is capitalism working as intended.

Not sure I'd call dumping externalities on a minority of your customer base without recourse "capitalism working as intended". Capitalism is a means to an end, and allowable business practices are a two-way street between corporations and consumers, mediated by regulatory bodies and consumer protection agencies, at least in most functioning democracies.

Maybe, but it doesn't change the fact, that no one is going to forbid me to ban IPs. Therefore I will ban IPs and IPs ranges because it is the cheapest solution.

Re: Ban me at the IP level if you don't like me

#259

Post by ralferoo »

nailer wrote: post #213
tmp123456au wrote: post #207

Earlier quoted context omitted.

This is wrong. Unless maybe you're from the east end of london.

I’m not claiming everyone pronounces it that way. But he’s an ero, we need to find an ospital, ninety miles an our. You will find government documents and serious newspapers that refer to an hospital.

Likewise, when I was at school, many of my older teachers would say things like "an hotel" although I've not heard anyone say anything but "a hotel" for decades now. I think I've heard "an hospital" relatively recently though.

Weirdly, in certain expressions I say "before mine eyes" even though that fell out of common usage centuries ago, and hasn't really appeared in literature for around a century. So while I wouldn't have encountered it in speech, I've come across enough literary references that it somehow still passed into my diction. I only ever use it for "eyes" though, never anything else starting with a vowel. I also wouldn't use it for something mundane like "My eyes are sore", but I'm not too clear on when or why I use the obsolete form at other times - it just happens!

Re: Ban me at the IP level if you don't like me

#260

Post by alphazard »

I'm always a little surprised to see how many people take robots.txt seriously on HN. It's nice to see so many folks with good intentions.

However, it's obviously not a real solution. It depends on people knowing about it, and adding the complexity of checking it to their crawler. Are there other more serious solutions? It seems like we've heard about "micropayments" and "a big merkle tree of real people" type solutions forever and they've never materialized.

Post reply on HN