Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting AI agent use and abuse

stytch.com

Post reply on HN
Print view View original

51–60 of 106 posts

Re: Detecting AI agent use and abuse

#51

Post by randunel »

soulofmischief wrote: post #41
mcstempel wrote: post #9

Earlier quoted context omitted.

Hey there, I'm the author of the post. I'm actually pretty sympathetic to your viewpoint, and I wanted to clarify my stance. I actually spent years working at a "good bot" company (Plaid), which focused on making users' financial data portable. The main reason Plaid existed was that banks made it hard for users to permission their data to other apps -- typically not solely out of security concerns, but to also active…

Plaid is not a "good bot" company. Despite posturing from leadership, it is fundamentally unethical to build a pervasive banking middle-man service which requires users to surrender their private account credentials in order to operate. What if every business operated this way? It's disgusting that companies like Plaid have considerably set back public discourse on acceptable privacy tradeoffs.

I'd assume they had to work with what was offered. As long as banks required usernames and passwords with no oauth possible, what's plaid to do? Their users wanted their service, but the banks used username password credentials.

In any case, "good bot" doesn't refer to best practices such as rejecting suppliers with antiquated auth and guiding users to others, it refers to not being intentionally malicious and acting as users' agents instead.

Re: Detecting AI agent use and abuse

#52

Post by xena »

jerpint wrote: post #50

The other day I tried an open source deep research implementation, and a ton of links returned 403s because I was using an agent. But it is for legitimate purposes. I think we need better ways of identifying legitimate agents working on my behalf vs spam bots

TBH if we want that to be a thing, we're gonna need to figure out how to pay server operators to cope with the additional load that AI agents can and will put on servers.

Re: Detecting AI agent use and abuse

#53

Post by oceanplexian »

deadbabe wrote: post #11
JohnMakin wrote: post #7

I've been flagged as a bot on pretty much every major platform. Most ridiculously lately, linkedin - I have to prove my identity using 2 different forms of ID, which they still won't accept, OR find a notary and somehow prove I own the account I no longer have access to. Maybe try refining this tech a little better before you start blasting legitimate users with it - I am extremely skeptical of the catch rate given w…

I asked a manager about this, the policy is that we do not need to differentiate between bots and people who sound similar to bots: both are considered low quality content/engagement. Delete them. Seems like wherever they delete bots, they will in the end, delete human beings.

Actually, they will only delete humans, because the bots can already far outpace low quality content posted by humans.

Re: Detecting AI agent use and abuse

#54

Post by yard2010 »

JohnMakin wrote: post #7

I've been flagged as a bot on pretty much every major platform. Most ridiculously lately, linkedin - I have to prove my identity using 2 different forms of ID, which they still won't accept, OR find a notary and somehow prove I own the account I no longer have access to. Maybe try refining this tech a little better before you start blasting legitimate users with it - I am extremely skeptical of the catch rate given w…

What you're describing is the end of the internet for some people. Good bots will evade everything (or at least try until they do), and some people like you (and me, this shit always happens to me) just stare at the screen, wondering what Kafka would say about this.

Re: Detecting AI agent use and abuse

#55

Post by ATechGuy »

cle wrote: post #45
ATechGuy wrote: post #28

Looks like detecting real humans apart from agents is going to be an arms race if the detection is based on browser/device fingerprinting or visual/audio captchas; AI will only get better. What are captcha alternatives that can block resource consumption by bots?

Web Environment Integrity. Eventually your hardware will rat you out via attestation.

And you think nobody (professional hackers?) can put together a "virtual TPM" that falsifies real hardware info? I think there are much simpler solutions, but the big tech wants to retain the control.

Re: Detecting AI agent use and abuse

#56

Post by [deleted] »

_moof wrote: post #36
AnotherGoodName wrote: post #34

Earlier quoted context omitted.

This is often due to network setup. If you're behind NAT where there's many users behind a single IP address you'll be hit. Eg. Many cell phone providers are 100% behind NAT for IPV4 internet. Corporate networks almost 100% likely to hit this too. VPNs are straight up almost always flagged for further authentication. A 'fun' thing that often happens to me is purchasing online via credit card at work and then going to…

> If you're behind NAT where there's many users behind a single IP address you'll be hit. Doesn't this describe the vast majority of networks in the world?

[deleted]

Re: Detecting AI agent use and abuse

#57

Post by randunel »

bbor wrote: post #42

Great article, but the actual technical details of their current “browser fingerprinting” approach are linked at the bottom: https://stytch.com/docs/fraud/guides/device-fingerprinting/o... This seems semi-effective for professional actors working at scale, and pretty much useless for more careful, individual actors — especially those running an actual browser window! I agree that the paywalls around LinkedIn and Twit…

I'm in a business tangential to the one the author is in and I've mostly encountered annoyances automating websites which perform browser fingerprinting including TLS fingerprinting, but outright blocks not really, not unless you also block real users like cloudflare and datadome frequently do (in their cases, automations have a marginally lower bypass rate than real users do).

In my experience, the level of sophistication to automate bypassing WAFs which do fingerprinting is much too high for those skills to be used to click ads. Seriously, it's not just about the compute cost of running real browsers and residential proxies, it's also the dev time invested, nobody clicks google ads when they can do much, much more with that knowledge.

Re: Detecting AI agent use and abuse

#58

Post by xyst »

It’s a bit disgusting that multi-billion dollar corporations are not properly compensating the individuals and groups that their “artificial intelligence” models rely on.

Meta/FB/Zuckerfuck was caught with their pants down when they were _torrenting_ a shit ton of books. It’s not a rogue engineer or group. It came from the top and signed off by legal.

Companies, C-level executives, and boards of these companies need to be held accountable for their actions.

No a class action lawsuit is not sufficient. _People_ need to start going to jail. Otherwise it will continue.

Re: Detecting AI agent use and abuse

#59

Post by petee »

AnotherGoodName wrote: post #34
JohnMakin wrote: post #7

I've been flagged as a bot on pretty much every major platform. Most ridiculously lately, linkedin - I have to prove my identity using 2 different forms of ID, which they still won't accept, OR find a notary and somehow prove I own the account I no longer have access to. Maybe try refining this tech a little better before you start blasting legitimate users with it - I am extremely skeptical of the catch rate given w…

This is often due to network setup. If you're behind NAT where there's many users behind a single IP address you'll be hit. Eg. Many cell phone providers are 100% behind NAT for IPV4 internet. Corporate networks almost 100% likely to hit this too. VPNs are straight up almost always flagged for further authentication. A 'fun' thing that often happens to me is purchasing online via credit card at work and then going to…

Cell tower/provider is a big part I think from my own experience; I'd get constant captchas and rejects only when near one specific tower at work, which happened to be right over a fedex ground building, take that how you will...

Re: Detecting AI agent use and abuse

#60

Post by digitaltrees »

diggan wrote: post #3

> it could present unacceptable risks for application developers or be used as a method for malicious attacks (e.g. credential stuffing or fake account creation). The article seems to want to distinguish between "bad" and "good" bots, yet beyond the introduction, seems to treat them exactly the same. Why are website authors so adamant I need to use whatever client they want to consume their content? If you put up a b…

thank you!!!! This is the right answer.
Post reply on HN