Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting AI agent use and abuse

stytch.com

Post reply on HN
Print view View original

61–70 of 106 posts

Re: Detecting AI agent use and abuse

#61

Post by Klonoar »

hansonkd wrote: post #4
diggan wrote: post #3

> it could present unacceptable risks for application developers or be used as a method for malicious attacks (e.g. credential stuffing or fake account creation). The article seems to want to distinguish between "bad" and "good" bots, yet beyond the introduction, seems to treat them exactly the same. Why are website authors so adamant I need to use whatever client they want to consume their content? If you put up a b…

> It seems like suddenly half the internet forgot about the term "user-agent", which up until recently was almost always our browsers, but sometimes feed readers, which was acceptable it seems. Was it really "suddenly"? it seems like for the past decade there has been an ongoing push to make everyone use "chromium" based browsers. I remember 10-15 years ago you would get blocked for not using IE or whatever, even tho…

…10-15 years ago?

Try like 20(~+)

Re: Detecting AI agent use and abuse

#62

Post by soulofmischief »

clint wrote: post #49
soulofmischief wrote: post #41

Earlier quoted context omitted.

Plaid is not a "good bot" company. Despite posturing from leadership, it is fundamentally unethical to build a pervasive banking middle-man service which requires users to surrender their private account credentials in order to operate. What if every business operated this way? It's disgusting that companies like Plaid have considerably set back public discourse on acceptable privacy tradeoffs.

You write as if someone held a gun to your head and force you to sign up for Plaid. Plaid doesn't require anyone to use it. Your bank is the entity you're ultimately upset with, don't malign a company that generated a _very good solution_ to a _huge problem_ and THEN worked with their industry peers to cajole these huge banks to let you have access to your data how you want to use it. Before Yodlee and Plaid came aro…

> You write as if someone held a gun to your head and force you to sign up for Plaid. Plaid doesn't require anyone to use it.

There is not a physical gun pointed at my head, but an increasing amount of digital online interactions are solely gated by Plaid. I've run into plenty cases where I simply had no choice, for example dealing with landlords.

And you already know how long it takes for financial systems to evolve once in place, as evidenced by your own frustration for them not embracing APIs and digital sovereignty. So once a solution like Plaid is in place, we're normalizing this kind of man-in-the-middle security nightmare for generations to come. Even if Plaid's founders did not have malicious intent, the company will eventually change hands to someone less ethical, and the door is open for other companies to seek the same kind of relationships with end users. If not malicious, Plaid is brazenly reckless and short-sighted.

And regardless... I as a consumer do not want to hand over my passwords to a man in the middle, I'm already angry enough at the security and password restrictions I encounter now with financial institutions. If I am in a position where I cannot rent a home or make an important purchase without interacting with a company like Plaid, where is my digital sovereignty?

Re: Detecting AI agent use and abuse

#63

Post by soco »

emgeee wrote: post #18
deadbabe wrote: post #11

Earlier quoted context omitted.

I asked a manager about this, the policy is that we do not need to differentiate between bots and people who sound similar to bots: both are considered low quality content/engagement. Delete them. Seems like wherever they delete bots, they will in the end, delete human beings.

I never really thought about this perspective but in some ways it makes sense. I think the ironic part is that LinkedIn now provides built-in AI tools that make you sound more like a bot. Maybe they could fingerprint slop generated with they tools and allow it through to incentivize upgrading

But "our" bots are always the good ones. Why does this sound like literature...

Re: Detecting AI agent use and abuse

#64

Post by jowea »

deadbabe wrote: post #13
ceejayoz wrote: post #2

I fully expect captchas to incorporate "type the racial slur / death threat into the box" soon, as the widely available models will balk at it.

It’s ironic that some of the first intelligent chatbots very quickly became Nazis and racists, and now we’ve swung the other way.

I am quite sure the people developing the current chatbots were well aware of what happened with Tay etc. I'd bet it's part of the reason for the safety stuff.

Re: Detecting AI agent use and abuse

#65

Post by soco »

soulofmischief wrote: post #62
clint wrote: post #49

Earlier quoted context omitted.

You write as if someone held a gun to your head and force you to sign up for Plaid. Plaid doesn't require anyone to use it. Your bank is the entity you're ultimately upset with, don't malign a company that generated a _very good solution_ to a _huge problem_ and THEN worked with their industry peers to cajole these huge banks to let you have access to your data how you want to use it. Before Yodlee and Plaid came aro…

> You write as if someone held a gun to your head and force you to sign up for Plaid. Plaid doesn't require anyone to use it. There is not a physical gun pointed at my head, but an increasing amount of digital online interactions are solely gated by Plaid. I've run into plenty cases where I simply had no choice, for example dealing with landlords. And you already know how long it takes for financial systems to evolve…

I think this anger with Plaid is unwarranted. Without them, or before them, you had zero API access because the banks (including yours) don't give a rat's ass on your fancy access needs. Now Plaid managed to gather together some kind of access. Are they to blame because they managed that? Do you still have any alternative with the bank? I think no, and no. You can get back to the "standard" situation of no API, no guns involved, or you can use them as middlemen. Or you can create your own middleman service if you like and everybody will appreciate your Plaid alternative (except Plaid, I suppose).

Re: Detecting AI agent use and abuse

#66

Post by Xen9 »

Eventually the safest eay to be a human will be to hide from the best AI by mimicking the lesser & more quantitious AI mimicking the homo simulacra.

Example: Big AI outbids energy providers because its owners are hunting some person whose computational activity they do not like. If you consume unusually lots of energy because you are eccentric human & not having AI system guide your power use, you will stand out. The big AI might rationally buy you out from electricity because you didn't mimic how normal people's AI has them do their power expenses.

Re: Detecting AI agent use and abuse

#67

Post by bbor »

mcstempel wrote: post #48
bbor wrote: post #42

Great article, but the actual technical details of their current “browser fingerprinting” approach are linked at the bottom: https://stytch.com/docs/fraud/guides/device-fingerprinting/o... This seems semi-effective for professional actors working at scale, and pretty much useless for more careful, individual actors — especially those running an actual browser window! I agree that the paywalls around LinkedIn and Twit…

Ah, this is great feedback -- I don't think we do enough to articulate how much we're doing beyond that simplified explanation of device fingerprinting on those docs. I'll get that page updated, but 2 main things worth mentioning: 1. We have a few proprietary fingerprint methods that we don't publicly list (but do share with our customers under NDA), which feed into our ML-based browser detection that assesses those…

Thanks for the clarification, the second point is really smart and something that didn't occur to me! You can slow down a scraper and add real mouse movements, but at the end of the day, if you don't have it collecting data for more extended periods than a human would be able to do, what's the point?

And of course the swiss cheese model applies here, as always. Thanks for fighting the good fight! I'm a big hater of IP laws, but this cultural move towards "scraping is never immoral" seems like a big step too far in the other direction.

Re: Detecting AI agent use and abuse

#68

Post by int_19h »

SoftTalker wrote: post #35
diggan wrote: post #19

Earlier quoted context omitted.

> I remember 10-15 years ago you would get blocked for not using IE or whatever, even though the site worked fine and there was no technical reason for the block Reminds me of when I discovered that Google Inbox worked in Firefox, even though Google decided to only allow Chrome to access it: https://news.ycombinator.com/item?id=8606879 - "Why Is Google Blocking Inbox on Firefox?" - 213 points | Nov 14, 2014 | 208 com…

I don't remember Google (search, at least) ever not working in any browser I tried, and I used some oddball browsers over the years. Maybe apps like gmail and docs, but they simply would not work in other browsers. Remember in its early years Chrome was a darling because it was supporting the "modern" web. That was the whole stated reason Google developed Chrome: to support modern, rich web applications, and force ot…

Google has a very long history of downgrading or even outright blocking off their services based on User-Agent. Them doing it to Opera in particular was a big story back in those "early days". And no, it's not because it wouldn't work - people literally made it work by spoofing the UA.

Re: Detecting AI agent use and abuse

#70

Post by aqueueaqueue »

ATechGuy wrote: post #28

Looks like detecting real humans apart from agents is going to be an arms race if the detection is based on browser/device fingerprinting or visual/audio captchas; AI will only get better. What are captcha alternatives that can block resource consumption by bots?

A credit card.
Post reply on HN