Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sending spammers to password purgatory

troyhunt.com

Post reply on HN
Print view View original

41–50 of 170 posts

Re: Sending spammers to password purgatory

#41

Post by zasdffaa »

bo1024 wrote: post #9
armchairhacker wrote: post #5

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…

> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.

So that's what that was... Was trying to do something legit, MS gave me a puzzle to solve, it was unsolvable in the time given, it wasted maybe 20 mins. Can't remember what it was, I think create an account for visual studio (you had to sign in to an MS account to keep using free VS, the wankers).

Re: Sending spammers to password purgatory

#42

Post by hyakosm »

legalcorrection wrote: post #16

This is wrong. You are logging their password attempts and then sharing them with the world. It doesn’t matter that you think you know they are scammers. What gives you the right to dispense vigilante justice by disclosing people’s passwords? Shame on you.

He's not sharing the email adresses, only anonymous password attempts.

Re: Sending spammers to password purgatory

#45

Post by figmaheart255 »

thomassmith65 wrote: post #24

Spammer burned a total of 80 seconds in Password Purgatory The ability to deal with a bad actor by wasting a minute and 20 seconds of his/her time isn't cause for fist-pumping or high-fiving. The internet needs a better way to verify user identity. The lack of online accountability isn't worth the cost anymore.

People are working on this. You've heard of proof-of-work and proof-of-stake right? Well my personal favorite is "proof of Apple" [1]

[1]: https://news.ycombinator.com/item?id=31751203

Re: Sending spammers to password purgatory

#46

Post by q-big »

stepupmakeup wrote: post #29
bo1024 wrote: post #9

Earlier quoted context omitted.

> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.

ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.

> ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left".

In such a situation, I often think: isn't the fact that one makes "stupid mistakes" when attempting to solve a ReCaptcha rather a sign that the entity that is attempting to solve it is a human?

Re: Sending spammers to password purgatory

#47

Post by vanviegen »

coffeeblack wrote: post #35
sdoering wrote: post #25

Earlier quoted context omitted.

I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo

88 is a lucky number in China and many Asian countries. Maybe time to claim “cultural insensivity” or something? Also, steam should never even see the password, they should only ever see the hash.

> Also, steam should never even see the password, they should only ever see the hash.

Sites/apps will generally handle your plaintext password each time you login or set your password. They (hopefully) just don't store it.

Re: Sending spammers to password purgatory

#48

Post by vanviegen »

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all.

We'll manually review all accounts that use (more than one of) those ip addresses. Works like a charm! :-)

Re: Sending spammers to password purgatory

#49

Post by raverbashing »

ImPostingOnHN wrote: post #30
fjfbsufhdvfy wrote: post #11

Earlier quoted context omitted.

They are indeed set up to waste people's time. Blocking people leads to them searching for ways around your block really quickly. Making them waste time not realizing they have been blocked, such as endless retries or shadow bans, is much more effective at making them stop bothering you for a while longer. Time spent doing this is time they can't spend being malicious on your platform. It's unfortunate when a non-mal…

it is unfortunate that some people believe those pros outweigh the punishment inflicted on innocent users it is better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one essentially the companies are shifting their own pain (with spammers) onto innocent users ("it's your problem now, suck it users, lol!!!")

> better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one

Sounds like you never had to actually deal with such a spammer problem yourself

Re: Sending spammers to password purgatory

#50

Post by quickthrower2 »

Ueland wrote: post #31
drfuchs wrote: post #22

Troy, watch out you don't open yourself up for an attack from the bad guys: They'll start sending you solicitations with ReplyTo addresses of industry honeypots, and before you know it, you'll become a known spammer and your regular outgoing emails will be routed to recipient's spam folders or maybe even dropped entirely.

I'm not sure if you're joking or not so: He already gets attacked from the bad guys.

And this would be a new way to attack him
Post reply on HN