Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

71–80 of 199 posts

Re: Subscription bombing and how to mitigate it

#71

Post by fragmede »

nobodywillobsrv wrote: post #59
jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

Yes it is insane. I am in same boat and have received mortgage applications, police details, applications for police jobs, massage receipts you name it. Many would be considered important leaks of customer data. I have even had founder level emails that presumably are confidential sent to me because I share the name of someone operating in tech. I respond or report when it's obviously some real person running a small…

What Google has done, is add profile pictures for users, so if I'm emailing girlfriend@gmail.com I get her picture, but if I email giirlfriend@gmail.com, I see someone else's pfp which is enough to get me to realize I've spelled it wrong. I'm sure there's more they could be doing, but they're aware of the problem at least.

Re: Subscription bombing and how to mitigate it

#72

Post by annie511266728 »

jb1991 wrote: post #47

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmatio…

[dead]

Re: Subscription bombing and how to mitigate it

#73

Post by jb1991 »

fragmede wrote: post #71
nobodywillobsrv wrote: post #59

Earlier quoted context omitted.

Yes it is insane. I am in same boat and have received mortgage applications, police details, applications for police jobs, massage receipts you name it. Many would be considered important leaks of customer data. I have even had founder level emails that presumably are confidential sent to me because I share the name of someone operating in tech. I respond or report when it's obviously some real person running a small…

What Google has done, is add profile pictures for users, so if I'm emailing girlfriend@gmail.com I get her picture, but if I email giirlfriend@gmail.com, I see someone else's pfp which is enough to get me to realize I've spelled it wrong. I'm sure there's more they could be doing, but they're aware of the problem at least.

But that only works if you’re emailing from another Gmail account yes?

Re: Subscription bombing and how to mitigate it

#74

Post by sdevonoes »

stingraycharles wrote: post #13
m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

So your solution would be to do nothing? Cloudflare is an excellent solution for many things. The internet was designed to withstand a nuclear war, but it also wasn’t designed for the level of hostility that goes on on the internet these days.

Cloudflare is not the solution

Re: Subscription bombing and how to mitigate it

#75

Post by radku »

wdutch wrote: post #19
nubg wrote: post #14

This post was written by AI, there are multiple clues. Author, why can you not use your own words? I am not sure what you meant to say, vs what is LLM garbage I could have prompted myself.

I can't comment on if it was written by AI or not but I found the OP informative and quite dense with useful information. Nothing stood out to me as garbage.

Agreed. Personally I think about it as massaging a text with LLM is like applying filters to your pictures.

The text probably have been based entirely on the internal notes and investigations and is very informative. Would it be better if the OP wrote it entirely by themselves? Not necessarily.

Re: Subscription bombing and how to mitigate it

#76

Post by latexr »

znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing

So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.

Re: Subscription bombing and how to mitigate it

#77

Post by eru »

gib444 wrote: post #46
pqdbr wrote: post #27

Recently we suffered a different kind of subscription bombing: a hacker using our 'change credit card' form to 'clean' a list of thousands credit cards to see which ones would go through and approve transactions. He ran the attack from midnight to 7AM, so there were no humans watching. IPs were rotated on every single request, so no rate limiter caught it. We had Cloudflare Turnstile installed in both the sign up for…

Ouch. Just one credit card change per account? This is one of those levels of monitoring that only gets put in place after such an event. Eg whole subsystem analysis - the change card feature being used 1000s of times (well, proportional to scale) in 7 hours is a massive red flag

> This is one of those levels of monitoring that only gets put in place after such an event.

For a website, yes. But honestly the credit card people and their infrastructure should probably _also_ watch out for this. They'd be in a much better place to detect these.

Re: Subscription bombing and how to mitigate it

#78

Post by simonkagedal »

paaradise wrote: post #65

> that meant each victim received three emails from us in under a minute: > Verify your email address > Welcome to Suga > Reset your password > Three emails they never asked for, from a product they may never have heard of. We were just one of potentially hundreds of sites being hit at the same time. @homelessdino Why would you send welcome and reset to some victim that DID NOT verify?

This is being addressed in the article. The service no longer does this, and he apologizes.
Post reply on HN