Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sending spammers to password purgatory

troyhunt.com

Post reply on HN
Print view View original

91–100 of 170 posts

Re: Sending spammers to password purgatory

#91

Post by dingleberry420 »

raverbashing wrote: post #49
ImPostingOnHN wrote: post #30

Earlier quoted context omitted.

it is unfortunate that some people believe those pros outweigh the punishment inflicted on innocent users it is better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one essentially the companies are shifting their own pain (with spammers) onto innocent users ("it's your problem now, suck it users, lol!!!")

> better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one Sounds like you never had to actually deal with such a spammer problem yourself

No post body was provided.

Re: Sending spammers to password purgatory

#92

Post by jjoonathan »

q-big wrote: post #46
stepupmakeup wrote: post #29

Earlier quoted context omitted.

ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.

> ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". In such a situation, I often think: isn't the fact that one makes "stupid mistakes" when attempting to solve a ReCaptcha rather a sign that the entity that is attempting to solve it is a human?

I'm sure they build in tolerance and even take advantage of this signal, yes. The result is still far from reliable, though.

The smug gaslighting and intentional time wasting after an incorrect identification is the worst.

Re: Sending spammers to password purgatory

#93

Post by jaclaz »

Pxtl wrote: post #13

I assume your starting password rules deliberately set the bar low to encourage PRs to improve it, since I can think of much more believable, infuriating, tedious ways to drag this out longer, keeping the user thinking they're always one step away from a valid password without being obviously silly. Believable, stupid requirements I've seen in the wild in the bad early days of complexity requirements. - your password…

Just in case:

Dumb Password Rules

Shaming sites with dumb password rules.

https://github.com/duffn/dumb-password-rules

Re: Sending spammers to password purgatory

#94

Post by tialaramex »

ivanbakel wrote: post #59
coffeeblack wrote: post #35

Earlier quoted context omitted.

88 is a lucky number in China and many Asian countries. Maybe time to claim “cultural insensivity” or something? Also, steam should never even see the password, they should only ever see the hash.

If Steam never saw your real password, the hash of the password would itself become the password, and Steam would be storing your password in plaintext. In order for password security to work, you have to send Steam your actual password, which they then check against the hash themselves. So at some point, Steam will have your password in plaintext.

No. In order for password authentication to be something a five year old can do by pasting PHP code they found in a Stack Overflow search, that is how it works.

But algorithmically even if you want passwords (you don't in most cases, get WebAuthn for example for web site authentication) you can use an asymmetric PAKE such as OPAQUE:

https://tools.ietf.org/id/draft-krawczyk-cfrg-opaque-03.html

This is quite a bit more complicated than the one line PHP password stuff you pasted from Stack Overflow, but the user's password never leaves their machine, and so the Relying Party doesn't know the password, and yet they can verify that the user does know the password which they originally chose for the site.

Re: Sending spammers to password purgatory

#95

Post by [deleted] »

sdoering wrote: post #25
donkarma wrote: post #17

Earlier quoted context omitted.

steam censors passwords. if you have 88 in your password you will fail to register

I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo

[deleted]

Re: Sending spammers to password purgatory

#96

Post by [deleted] »

null0pointer wrote: post #26
sdoering wrote: post #25

Earlier quoted context omitted.

I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo

I bet for every one neo-nazi they block hundreds of birthdays or Chinese [0]. Just seems overly sensitive to me when you wouldn’t even know a person is a neo-nazi unless they start saying neo-nazi shit. Saying neo-nazi shit is in itself grounds for a ban so why block the number 88 at all? How could anyone possibly be offended by the number 88 alone? 0: https://en.wikipedia.org/wiki/Chinese_numerology#Eight

[deleted]

Re: Sending spammers to password purgatory

#97

Post by jjoonathan »

mrtksn wrote: post #73
vanviegen wrote: post #48

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addre…

> when we manually verified an account to be a scammer This makes all the difference with other services that block out users only to let them guess why they were blocked. If an automated system did that, I would have said it's evil. Yet, I hope you have a communication channel in case there was a human error.

Yes, although I would add an attention threshold too, as it's not entirely unknown for hired manual review to just spam the "guilty" button so they can get to lunch. In any case: your false positive rate needs to be massively low if you want to be a massive asshole to the people it flags -- or else you are just an asshole.

If you can afford to get the FPR down, sure, have fun, but if not, please have the decency to not pretend.

Re: Sending spammers to password purgatory

#98

Post by raverbashing »

dingleberry420 wrote: post #91
raverbashing wrote: post #49

Earlier quoted context omitted.

> better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one Sounds like you never had to actually deal with such a spammer problem yourself

Quoted post unavailable.

Yes banning users from a website is exactly like sending them to the gulag, it's exactly that

Re: Sending spammers to password purgatory

#99

Post by brk »

ghgr wrote: post #89

You can check in their GitHub repo [1] the list of reasons to reject your password (classified by level of "InfuriationLevel"). Some examples: 'Password must contain at least 1 primary Simpsons family character' 'Password must contain at least 1 Nordic character' 'Password must contain at least 1 Greek character' 'Password must contain at least 1 primary Griffin family character' 'Password must contain at least one e…

My favorite was "password must be a palindrome".

Re: Sending spammers to password purgatory

#100

Post by dingleberry420 »

raverbashing wrote: post #98
dingleberry420 wrote: post #91

Earlier quoted context omitted.

Quoted post unavailable.

Yes banning users from a website is exactly like sending them to the gulag, it's exactly that

So you don't believe in guilty until proven innocent? Or do you? How do you justify banning innocent users?
Post reply on HN