Live data from Hacker News

Pwned or Bot

troyhunt.com

31–40 of 89 posts

Re: Pwned or Bot

#31

Facebook and Twitter are basically closed to new users. If you've gone this far without an account, your new one will be shut down for being a bot within hours of creating a new account, or flagged for "extra verification" which requires sending a government ID to these companies so they can verify that you didn't photoshop a fake government ID. This new approach seeks to extend this feature to the entire internet .…

I create a new account every 6 months or so on Facebook when my old one gets banned for "violating the community guidelines" and I haven't been asked for an ID ever since 2019. Twitter, though, is way worse and I had to give up and I'm currently just buying aged accounts. Violates even more parts of the ToS than just ban evasion but at least the accounts last for years instead of weeks.

Re: Pwned or Bot

#32
post #3

This is a cute "hack" for bot detection, but it's too unpredictable for the real world. Far too many users with good security hygiene are penalized by this system Plus, this might incentivize hackers to defeat the system by logging into and using email accounts pwned in these breaches.

The only security hygiene that can stop your email from leaking is using a different address for literally every service you ever log into. This is of course possible with your own domain, but in practice totally infeasible for the vast majority of people.

Apart from icloud, this is also available for fastmail users as well so no it's not "totally infeasible for the vast majority of people".

Re: Pwned or Bot

#33
So the crux of the technique is to roughly date how long an email has existed for, using leaked databases as a timestamping measure. I'm not sure this metric is a good one though, as older and importantly "pwned" emails are far more likely to have been taken over.

Without an idea for the percentage of emails that are still in the original owners hands, this risks a high false negative rate.

Re: Pwned or Bot

#34
So a reverse bloom filter for identity. I imagine one day we will be KYC'd for buying pizza online.

Re: Pwned or Bot

#35
post #31

Facebook and Twitter are basically closed to new users. If you've gone this far without an account, your new one will be shut down for being a bot within hours of creating a new account, or flagged for "extra verification" which requires sending a government ID to these companies so they can verify that you didn't photoshop a fake government ID. This new approach seeks to extend this feature to the entire internet .…

I create a new account every 6 months or so on Facebook when my old one gets banned for "violating the community guidelines" and I haven't been asked for an ID ever since 2019. Twitter, though, is way worse and I had to give up and I'm currently just buying aged accounts. Violates even more parts of the ToS than just ban evasion but at least the accounts last for years instead of weeks.

I gave up on facebook (but I wasn't trying that hard) but it seemed to be using the extortion practices a lot of services use now. At first it appears to let you create an account but upon logging in for the first time it demands a phone number for 'verification'. Microsoft was even worse when they migrated my mojang account, it let me use it for a little while before demanding the number.

Back when I had a facebook account I recall it suddenly up and demanding I scan my drivers license one day or I couldn't log in again...on the same and only machine I actually had used facebook on.

Re: Pwned or Bot

#36
post #31

Facebook and Twitter are basically closed to new users. If you've gone this far without an account, your new one will be shut down for being a bot within hours of creating a new account, or flagged for "extra verification" which requires sending a government ID to these companies so they can verify that you didn't photoshop a fake government ID. This new approach seeks to extend this feature to the entire internet .…

I create a new account every 6 months or so on Facebook when my old one gets banned for "violating the community guidelines" and I haven't been asked for an ID ever since 2019. Twitter, though, is way worse and I had to give up and I'm currently just buying aged accounts. Violates even more parts of the ToS than just ban evasion but at least the accounts last for years instead of weeks.

What do you have to do to get banned? I've seen people getting banned temporarily but I haven't heard of anyone getting banned permanently.

Re: Pwned or Bot

#37
post #24

Earlier quoted context omitted.

By taking a publicly available template, and putting in your details and mugshot.

I mean how can Facebook check government ID if it is legit? ( not how to photoshop ID. )

You generally can't actually check the government databases directly, but you can still determine this.

First, companies can catch most fraudulent documents simply by looking at the document (eg. are the fonts all correct, does the checksum on the MRZ add up, does the data in the MRZ match the data on the face of the document, does the data on the document match previously collected data about the individual, etc.) Some will go further by combining this with a "liveness" check (eg. they might ask you to take a picture of yourself in a certain pose, or to record a short video looking side to side)

Second, companies can use a soft credit check (if authorised by the user, which would need to be in the fine print when you sign up or when you are asked for such a document). Such a credit check won't affect your credit score, but can be used by companies to see if an individual with your details exists. Companies which offer such credit data in the UK/US/other western countries typically boast of 90-95% match rates across a population, but obviously younger people are less likely to be found since they are less likely to have a credit history. This is typically aggregated with data from non credit sources (electoral roll information, county court judgements, etc.) to reach those high match rates. They might also geo-locate the IP address from which you accessed their site and compare it against any address information they have on you (which could come from you providing it on sign up, it could be extracted from the document if it's a driving license or something, or it could come from any credit records they found relating to you)

For Facebook specifically, they might look at other online activity - other social media accounts they can link to you, etc. And throw all of that into the mix.

If at the end of all that they don't have a clear answer, they might fall back to a manual process, or allow the account to be created but have content posted by the account flagged for manual review.

Re: Pwned or Bot

#38
post #19

Earlier quoted context omitted.

> so they can verify that you didn't photoshop a fake government ID. Huh. How?

By taking a publicly available template, and putting in your details and mugshot.

thete are actual id lookup verification services......

Re: Pwned or Bot

#40
post #36
post #31

Earlier quoted context omitted.

I create a new account every 6 months or so on Facebook when my old one gets banned for "violating the community guidelines" and I haven't been asked for an ID ever since 2019. Twitter, though, is way worse and I had to give up and I'm currently just buying aged accounts. Violates even more parts of the ToS than just ban evasion but at least the accounts last for years instead of weeks.

What do you have to do to get banned? I've seen people getting banned temporarily but I haven't heard of anyone getting banned permanently.

If you don't like somebody on Facebook you can report them for offensive content. I posted something that some asshole facebook friend didn't appreciate and they dug through my facebook feed and found one image that was borderline (somebody in politics in their drawers) and sent in a complaint to facebook. Got my account banned for a first strike. Same douche could have sent in more complaints and facebook would have happily given me three strikes. It's a Stasi system. Don't like your boss or your neighbor, report them...
Post reply on HN