Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

31–40 of 199 posts

Re: Subscription bombing and how to mitigate it

#31

Post by nubg »

wdutch wrote: post #19
nubg wrote: post #14

This post was written by AI, there are multiple clues. Author, why can you not use your own words? I am not sure what you meant to say, vs what is LLM garbage I could have prompted myself.

I can't comment on if it was written by AI or not but I found the OP informative and quite dense with useful information. Nothing stood out to me as garbage.

I agree the topic and most of the content is legit!

Which makes is even more annoying. Because you don't know which are the good bits where somebody is sharing his unique insight, and which is just taken from the LLMs world knowledge.

Re: Subscription bombing and how to mitigate it

#32

Post by bevr1337 »

mads_quist wrote: post #10
grey-area wrote: post #9

Earlier quoted context omitted.

Can you expand on that? A separate honey pot sign up page invisible to real users, or something else?

You add "hidden" inputs to your HTML form that are named like "First Name" or "Family Name". Bots will fill them out. You will either expect them to be empty or you fill by JavaScript with sth you expect. It's of course reverse-engineerable, but does the trick.

Do you test this against password managers? Seems like this approach could generate false positives

Re: Subscription bombing and how to mitigate it

#33

Post by snowe2010 »

znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

Then you’re also blocking legitimate users that don’t want to be tracked and use services like iCloud Hide my Emails

Re: Subscription bombing and how to mitigate it

#34

Post by nubg »

denismi wrote: post #28
nubg wrote: post #14

This post was written by AI, there are multiple clues. Author, why can you not use your own words? I am not sure what you meant to say, vs what is LLM garbage I could have prompted myself.

I am quite confident that the following was NOT LLM: > New users were signing up but not doing anything, they weren’t creating an org, a project, or a deployment, they just left an account sitting there. Surely the LLM version is: > New users were signing up but not doing anything; they weren't creating an org, a project, or a deployment—they just left an account sitting there.

It really depends on the LLM and the wrapper prompt. There are many other giveaways though - which I am not going to name to burn them.

Re: Subscription bombing and how to mitigate it

#35

Post by chii »

nubg wrote: post #31
wdutch wrote: post #19

Earlier quoted context omitted.

I can't comment on if it was written by AI or not but I found the OP informative and quite dense with useful information. Nothing stood out to me as garbage.

I agree the topic and most of the content is legit! Which makes is even more annoying. Because you don't know which are the good bits where somebody is sharing his unique insight, and which is just taken from the LLMs world knowledge.

so you are merely just prejudiced against LLM generated content, even if it was good?

Why not accept that it is good, and forget about it being LLM?

Re: Subscription bombing and how to mitigate it

#36

Post by pverheggen »

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

I wouldn't call this "known security issues", it's an inherent problem with any signup or forgot password page.

Also, I doubt this is going to be pissing users off since they added Turnstile in invisible mode, and selectively to certain pages in the auth flow. Already signed in users will not be affected, even if the service is down. This is way different from sites like Reddit who use their site-wide bot protection, which creates those interstitial captcha pages.

Re: Subscription bombing and how to mitigate it

#37

Post by chicagojoe »

HexDecOctBin wrote: post #24

I was attacked in this way a couple of months back. I use a different email address for each account (of the pattern product@example.com), and use a separate address for Git commits (like git@example.com). It was this second one that was attacked and I ended up with some 500 emails within 12 hours. Fortunately, since I don't expect anyone to actually email me on the Git address, I just put up a filter to send them al…

I had this happen recently too, also not covering up any email activity (I combed through 3000+ spam emails).

Double check that there are no forwarding rules added to your inbox and add some protection against a SIM swap.

In my case, they didn't compromise any of my accounts but did attempt to open a new credit card so it would be worth double checking your credit reports.

Re: Subscription bombing and how to mitigate it

#38

Post by somat »

tariky wrote: post #12

I had similar situation on WooCommerce shop. But it was much more signups per hour. Putting turnstile in front fixed problem. My conclusion is to move from WordPress software as fast as possible, every WordPress site I manage gets bombarded by bots.

Hell every non wordpress software I manage also gets bombarded by wordpress bots.(not really, I am stretching the term to refer to wordpress attack attempts for dramatic purpose. But that still ends up being about 99% of my personal site traffic)

Re: Subscription bombing and how to mitigate it

#39

Post by tomjen3 »

cuu508 wrote: post #3

> If a bot creates an account with someone else’s email, the victim gets one email, if they ignore it that’s the end of it. The welcome email and everything after it only fires once the user verifies. As a user, I would prefer no welcome email at all.

Yeah, thats part of why I hate "login with SERVICE". The big benefit would be not spamming me, but they always insist on getting my email.

There was a time were you would have to select "sign me up for your newsletter" then you had to uncheck it. Then you had to check to not get an email and now you don't even get that choice.

And lately? You have to go dig through your email because you can't set a password (looking at you Claude), so you can't filter email.

Post reply on HN