It's a sad state of affairs when a vendor will reject your email address as being invalid if it HASN'T been compromised elsewhere.
Pwned or Bot
61–70 of 89 posts
Re: Pwned or Bot
#62Very bad idea. Most people are not terminally online like HN folks, and they barely register and barely appear in leaks. Unless every single facebook and instagram and wechat etc user is leaked, it will already have too false positives.
Re: Pwned or Bot
#63Earlier quoted context omitted.
Edit: I misunderstood Troy. Original comment: No, it doesn't penalize them (at least not his idea, implementations might), it simply fast tracks pwned emails and doesn't apply the normal bot checks that would otherwise apply to everyone.
That's not how he's suggesting it would work. All checks would normally be applied to build a "how human are you" or "humanness" score. He's suggesting a pwned email test and arguing it would be a good signal for "humanness". The implementation might not make it an explicit penalty (-1 to your "humanness" score), but not being pwned might not help your case (+1 if you are pwned, but +0 if you're not).
Yeah it would definitely be good to integrate it into a Bayesian approach where it is mixed with other factors to generate a % chance of being human vs. bot.
Re: Pwned or Bot
#64I pay for my email that gives me a lot of aliases and most of them have not been pwned yet. So with his tool I would be flagged as a bot. Honestly, doesn't sound like a great idea to be frank. There must be large swaths of people that have either been careful or have specific emails that they use for certain purposes that haven't been pwned. The question, what should happen if I haven't been pwned? Should I not be ab…
This also seems to fast-track stolen accounts, by design. What a weird idea.
Re: Pwned or Bot
#65Earlier quoted context omitted.
It's not his idea, he's saying that there are people out there who are already (mis)using the data for this.
Sort of. He does encourage this use-case in the final paragraph. > Applying "Pwned or Bot" to your own risk assessment is dead simple with the HIBP API and hopefully, this approach will help more people do precisely what HIBP is there for in the first place: to help "do good things after bad things happen".
Yeah it seems clear to me that he's recommending it to be one portion of a risk assessment for a given email address.
Re: Pwned or Bot
#66I think the problem bot vs real-person needs to be solved by the governments. Every government doing its own thing to tackle this wouldn't work, it would be great if they created an open-source project/standard that they implement. Alternative would be using bank accounts which is actually what Scandinavian countries do (e.g. in Sweden it is Bank ID) to verify that you are a real person. All these methods of trying t…
What about the unbanked (i.e. people who don’t have bank accounts)?
And even if bank accounts were free, getting a bank account means accepting the terms and conditions written by the bank. Not to mention the laws and regulations regarding banking, which include sending your bank details to the US government, even if you are a European using a European bank.
Re: Pwned or Bot
#67I think the problem bot vs real-person needs to be solved by the governments. Every government doing its own thing to tackle this wouldn't work, it would be great if they created an open-source project/standard that they implement. Alternative would be using bank accounts which is actually what Scandinavian countries do (e.g. in Sweden it is Bank ID) to verify that you are a real person. All these methods of trying t…
I would rather not have to send every crappy website on the internet my ID or bank account information.
Re: Pwned or Bot
#68Wouldn't bad actors just push their fake email addressess to haveibeenpwned in fake leaks? Steps: 1- periodically set up a legitimate looking service, possibly proxying real services. 2- wait a year or two for your fake service to premiate throughout the www and for seach engines to index it. 3. Mix your bot email addresses with legitimate previously pwned addresses. 4- proclame "woe is me, for thyself hasth been pwn…
At that point you'd be better off making those emails and signing up to a bunch of services. Bot emails aren't fresh for 2 years, and if they are somebody isn't doing their job properly.
I think the point is bot emails shouldn't be fresh.
Same way some people just set up businesses with random names in tax-shelter territories and sell the company 10 years later to add a sense if legitimacy.
Re: Pwned or Bot
#69This feels a lot like email providers assuming that if you're running your own mail server, you must be spamming people. This depends on the lack of use of good tools like FF's relay to anonymize accounts. I mean, HIBP is great, but Troy is self-consciously not interested in handling subaddressing, which would improve his service and its (mis)use in detecting "humanness".
I think it's because they do: https://cfenollosa.com/blog/after-self-hosting-my-email-for-...
Re: Pwned or Bot
#70> If an email address hasn't been seen in a data breach before, it may be a newly created one especially for the purpose of gaming your system. I’ve started using iCloud Hide My Email which generates a random email that forwards to my account email. This assumption is going to cause issues.
It can, but that's kind of the nature of anti-spam systems these days. Come in on a Tor IP with a randomly-generated burner e-mail with a Curl user-agent and you're gonna get blocked from almost anything that spammers have an interest in. Come in on the e-mail address, aged cookies, and a geolocation associated with your credit card for years and you're gonna be fine. Do things in the middle and expect some amount of false positives.