Live data from Hacker News

Pwned or Bot

troyhunt.com

81–89 of 89 posts

Re: Pwned or Bot

#81
post #73

I have always wondered why pricing can’t fix the issue. On launch day, or for your first batch or whatever, start the pricing higher than you expect most anybody to pay. Target a constant rate of purchase by gradually lowering and raising the price to maintain some target sales per min/hour. Bots and scalpers get stuck holding the bag if they buy on launch day because the price will likely never be higher than what t…

> People who really really want the product get it at a fair price (they were willing to pay).

If people were content to get the product at a fair price, scalpers wouldn't be a problem in the first place. The whole reason scalpers are considered a problem is that people want the product at a cheaper than fair price, and scalpers prevent that by buying up any inventory that is being sold for below the market rate.

Basically, if companies employed the strategy you suggest, then they'd effectively become the scalpers in the eyes of people who consider scalping a problem, with all the PR issues associated with that.

That's not to say it's necessarily a bad idea though. Once you accept the fact that scalpers exist, it makes sense for companies to capture those profits themselves rather than let scalpers just have them for free.

Re: Pwned or Bot

#82

I pay for my email that gives me a lot of aliases and most of them have not been pwned yet. So with his tool I would be flagged as a bot. Honestly, doesn't sound like a great idea to be frank. There must be large swaths of people that have either been careful or have specific emails that they use for certain purposes that haven't been pwned. The question, what should happen if I haven't been pwned? Should I not be ab…

It's not his idea, he's saying that there are people out there who are already (mis)using the data for this.

This is a common investigative technique that predates HIBP, however more people are starting to automate it now (using non-HIBP datasets). I think this combined with the new request-based pricing on the HIBP API implies he just wants to make some money off being the quick to implement 75% solution.

Re: Pwned or Bot

#83
post #59

This feels a lot like email providers assuming that if you're running your own mail server, you must be spamming people. This depends on the lack of use of good tools like FF's relay to anonymize accounts. I mean, HIBP is great, but Troy is self-consciously not interested in handling subaddressing, which would improve his service and its (mis)use in detecting "humanness".

> but Troy is self-consciously not interested in handling subaddressing, which would improve his service

I don't think Troy is not interested in handling subadressing in the general sense, I think he just dismisses it as "not worth the time" given current statistics.

If it is worth the time and you were writing one of these "Pwned or Bot" "email credit score" detectors, it is easy: you could easily strip +whatever before an @ and check if that exists as well. (Check both!)

> which would improve his service

It's not actually his service he's talking about in this particular article. He doesn't run an explicit "Pwned or Bot" "email credit score" service. He's pointing out it is an interesting use of the HIBP API and also to do it right it needs some sort of value add/scoring system, which he hints at ways to do that but does not provide one (and especially not as a service).

HIBP itself doesn't support subaddressing as a feature, but that's on purpose for a different reason: many of the people that use subaddressing, especially consistent users, use HIBP to narrow down specific account threats and it is useful to them today that HIBP tracks all of their subaddresses independently.

Re: Pwned or Bot

#84
post #3

This is a cute "hack" for bot detection, but it's too unpredictable for the real world. Far too many users with good security hygiene are penalized by this system Plus, this might incentivize hackers to defeat the system by logging into and using email accounts pwned in these breaches.

The only security hygiene that can stop your email from leaking is using a different address for literally every service you ever log into. This is of course possible with your own domain, but in practice totally infeasible for the vast majority of people.

I've been doing this for 6 years now. Every service, bank and even person gets a separate address.

Takes less than 2 minutes to create one with my paid mail provider.

On 2 occasions, I knew a system was compromised before an announcement because suddenly I was getting spam to the specific email address.

Re: Pwned or Bot

#85
post #78

Snipers are just as much legitimate customers as anyone else. They only snipe under priced products so if you don't want people reselling them do not sell them for so cheap.

Astonishing how people will argue against their own interests in defence of a free market. If goods are underpriced and snipers are prevented, consumers pay the lower prices. If goods as "right-priced", the consumers pay a higher price.

>against their own interests.

Wanting an RNG / ping based system is not in everyone's interests. Plenty of people want to be able to just buy a product wherever they feel like and not have to spam refresh at specific time for a chance to get a product. Resellers offer this convince and clearly people are willing to pay for it.

It's either some consumers get a good deal while others get nothing, or all consumers pay a fair price and get it.

This isn't even getting to the higher resale price if resellers are blocked because there is less competition between resellers.

Re: Pwned or Bot

#86
post #81
post #73

I have always wondered why pricing can’t fix the issue. On launch day, or for your first batch or whatever, start the pricing higher than you expect most anybody to pay. Target a constant rate of purchase by gradually lowering and raising the price to maintain some target sales per min/hour. Bots and scalpers get stuck holding the bag if they buy on launch day because the price will likely never be higher than what t…

> People who really really want the product get it at a fair price (they were willing to pay). If people were content to get the product at a fair price, scalpers wouldn't be a problem in the first place. The whole reason scalpers are considered a problem is that people want the product at a cheaper than fair price, and scalpers prevent that by buying up any inventory that is being sold for below the market rate. Bas…

Yes I understand and I do see your point. I wonder if the problem can be solved semantically. Instead of thinking of the company as the scalpers you want people thinking of the launch event as an auction. I don't think people would be so fickle if you framed the practice as “launch auctions”. Then it would be clear to everyone that there is no msrp until the supply and demand stabilize. And people would be at liberty to pay whatever they thought a fair price for the item all things considered. If someone else bids higher, well, tough luck.

Re: Pwned or Bot

#87
post #40

Earlier quoted context omitted.

If you don't like somebody on Facebook you can report them for offensive content. I posted something that some asshole facebook friend didn't appreciate and they dug through my facebook feed and found one image that was borderline (somebody in politics in their drawers) and sent in a complaint to facebook. Got my account banned for a first strike. Same douche could have sent in more complaints and facebook would have…

What if my boss or neighbour didn't post anything that's against the TOS?

That would be unusual, so you could probably report them for being a bot.

After all, Meta's TOS stipulates that you must provide accurate information about yourself, and that you cannot share anything that is misleading.

It also prohibits making groundless reports or appeals, so maybe you could take an eye for an eye it you get unfairly targeted.

Re: Pwned or Bot

#88
How does this work with data protection laws? Is there a way for me to object to a company doing this, i.e. an automated background check on my email address with stolen personal data?

I guess I cannot effectively object to my email being included in data leaks…

Re: Pwned or Bot

#89
> Only 76% of transactions from the IP address had previously been authorised

Sounds like a self fulfilling prophecy, if they use these rules to authorize transactions.

Post reply on HN