Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sending spammers to password purgatory

troyhunt.com

Post reply on HN
Print view View original

71–80 of 170 posts

Re: Sending spammers to password purgatory

#71

Post by RalfWausE »

Pxtl wrote: post #13

I assume your starting password rules deliberately set the bar low to encourage PRs to improve it, since I can think of much more believable, infuriating, tedious ways to drag this out longer, keeping the user thinking they're always one step away from a valid password without being obviously silly. Believable, stupid requirements I've seen in the wild in the bad early days of complexity requirements. - your password…

Hah... this reminds me of the following (perhaps most interesting for people speaking german):

Bitte geben Sie ein sicheres Passwort ein.

Leberkas

Entschuldigung, Ihr Passwort ist zu kurz!

Leberkas-Semme

Entschuldigung, Ihr Passwort muss mindestens 1 Zahl enthalten.

1 Leberkas-Semme

Entschuldigung, Ihr Passwort darf keine Leerzeichen enthalten.

50drecksleberkassemmen

Entschuldigung, Ihr Passwort muss mindestens einen Umlaut enthalten.

50drecksleberkässemmelnzefix

Entschuldigung, Ihr Passwort muss mindestens 1 Grossbuchstaben enthalten.

50DRECKSleberkässemmelnZEFIX

Entschuldigung, Ihr Passwort muss mindestens 1 Sonderzeichen enthalten.

50DRECKSleberkässemmelnZERFIX!!!!!!!

Entschuldigung, Ihr Passwort darf nur Grossbuchstaben enthalten, die nicht aufeinanderfolgend sind.

KreizKruzeFixVerdammterScheissDrecklatzkannstMiGleiKreizWeisSonstWo WoslnDesFiaAScheissSystem50DrecksleberkässemmelnZeFix!!!!

Entschuldigung, dieses Passwort ist bereits in Verwendung. Bitte wählen Sie ein anderes.

Re: Sending spammers to password purgatory

#72

Post by numlock86 »

Nextgrid wrote: post #68
numlock86 wrote: post #66

Earlier quoted context omitted.

[flagged]

Legitimate interest would totally cover you here. The fear-mongering and misinformation about the GDPR is getting really annoying by now.

> The "legitimate interest" GDPR strawman

In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly over as it seems.

Re: Sending spammers to password purgatory

#73

Post by mrtksn »

vanviegen wrote: post #48

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addre…

> when we manually verified an account to be a scammer

This makes all the difference with other services that block out users only to let them guess why they were blocked.

If an automated system did that, I would have said it's evil. Yet, I hope you have a communication channel in case there was a human error.

Re: Sending spammers to password purgatory

#74

Post by ivanhoe »

numlock86 wrote: post #72
Nextgrid wrote: post #68

Earlier quoted context omitted.

Legitimate interest would totally cover you here. The fear-mongering and misinformation about the GDPR is getting really annoying by now.

> The "legitimate interest" GDPR strawman In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly…

any links/info on this 4 cases so that we can learn more about the subject?

Re: Sending spammers to password purgatory

#75

Post by brightball »

vanviegen wrote: post #48

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addre…

That is genius

Re: Sending spammers to password purgatory

#76

Post by ridgered4 »

alpaca128 wrote: post #55
thayne wrote: post #14

Earlier quoted context omitted.

I've seen a real site where the minimum password length was more than the maximum password length. Of course, if you know that you'll stop wasting your time. But if the error is just "your password is too short" or "your password is too long" it might take several tries to figure out it's impossible to satisfy the requirement.

Twitch complained that my password longer than 16 characters exceeded the 40 character limit. But the worst I've seen was a registration form that truncates long passwords to the (hidden) maximum length of ~10 without telling you, so anyone choosing a safe password cannot login and won't know why.

Paypal did the silent truncation to me at 20 characters once, what a nightmare. I can't even remember how I figured it out, probably some other poor soul left a breadcrumb for me.

Re: Sending spammers to password purgatory

#77

Post by brightball »

numlock86 wrote: post #72
Nextgrid wrote: post #68

Earlier quoted context omitted.

Legitimate interest would totally cover you here. The fear-mongering and misinformation about the GDPR is getting really annoying by now.

> The "legitimate interest" GDPR strawman In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly…

People can claim it all day long but it was determined that IP addresses are only PII in the hands of an entity who can actually associate it with a person, like an ISP.

https://www.jdsupra.com/legalnews/court-confirms-that-ip-add...

Re: Sending spammers to password purgatory

#78

Post by bornfreddy »

leshenka wrote: post #43
joshxyz wrote: post #18

Thats evil and hilarious lol. Password must start with a cat, end with a dog haha.

And then it must be a palindrome, how do you solve that?

The site doesn't seem to check if the conditions are met though. When the password was supposed to end with "dog", spammer used an invalid format and still got the next challenge.

Re: Sending spammers to password purgatory

#79

Post by QuantumGood »

archi42 wrote: post #64
quickthrower2 wrote: post #50

Earlier quoted context omitted.

And this would be a new way to attack him

He's triggering it manually. And I'm pretty sure he knows what backscattering is.

I had forgotten. Here's an explanation: https://help.returnpath.com/hc/en-us/articles/220568667-What....

Re: Sending spammers to password purgatory

#80

Post by GekkePrutser »

alpaca128 wrote: post #55
thayne wrote: post #14

Earlier quoted context omitted.

I've seen a real site where the minimum password length was more than the maximum password length. Of course, if you know that you'll stop wasting your time. But if the error is just "your password is too short" or "your password is too long" it might take several tries to figure out it's impossible to satisfy the requirement.

Twitch complained that my password longer than 16 characters exceeded the 40 character limit. But the worst I've seen was a registration form that truncates long passwords to the (hidden) maximum length of ~10 without telling you, so anyone choosing a safe password cannot login and won't know why.

Vnc does this too with it's 8 characters. Stupid design decision.

Even more stupid though is their declaration that encryption is 'out of scope' and anyone wanting it should arrange it out of band (eg VPN or SSH forwarding). Seriously... :/

Post reply on HN