Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

91–100 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#91

Post by acdha »

codeonline wrote: post #78
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

They are useful for links that need to outlive the infrastructure they are hosted on. Think about them as a layer of abstraction. Ie. Links in paper published to a journal like nature. It might be valid for 10 years but the links embedded in it will rot quickly as organisations change cms's, domains names change. Organisations merge and disappear. Also places where the cost to change the url is expensive, bus shelter…

I think this is important but also hits the trust problem: open shorteners are basically training users to be phished but a controlled namespace doesn’t have that problem. Ideally you can use a domain you control for everything to get full control of your reputation while still retaining the flexibility to redirect links as needed.

Re: I accidentally made my link shortener into a malware honeypot

#92

Post by laurent123456 »

Getting a chargeback in Stripe is costly. As soon as a dispute is started there's a fixed $25 that won't be refunded even if you win the dispute.

So for a service at $4 a month which is likely to get a lot of fraudulent payments I wonder if it's really viable.

One thing he should do is immediately cancel accounts and refund subscriptions when there's an early fraud warning. They are usually accurate and help avoiding those fees.

Re: I accidentally made my link shortener into a malware honeypot

#93

Post by heleninboodler »

mik3y wrote: post #23

A big problem that came up at the domain level was what I'd call a _trustworthy domain with untrustworthy subdomains_, specifically where those subdomains represent user-generated content. The Public Suffix List (PSL) [1] to the rescue! It can help with this kind of disambiguation. Paraphrasing, it's a list of domains where subdomains should be treated as separate sites (e.g. for cookie purposes). So `blogger.com` on…

How current is this? It doesn't actually have *.blogger.com in it, nor the other two examples I checked.

Re: I accidentally made my link shortener into a malware honeypot

#94

Post by infotainment »

63stack wrote: post #89
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

I don't understand why shadowbanning would be so effective. It's trivial for any competent spammer to check their submissions from different ip addresses, they will very quickly discover if they are shadowbanned. The risk of misidentifying legit users and shadowbanning them outweighs the potential gain.

It may be trivial, but I think the answer is: they don’t double check. Possibly that’s too much effort to do so?

Re: I accidentally made my link shortener into a malware honeypot

#95

Post by mik3y »

heleninboodler wrote: post #93
mik3y wrote: post #23

A big problem that came up at the domain level was what I'd call a _trustworthy domain with untrustworthy subdomains_, specifically where those subdomains represent user-generated content. The Public Suffix List (PSL) [1] to the rescue! It can help with this kind of disambiguation. Paraphrasing, it's a list of domains where subdomains should be treated as separate sites (e.g. for cookie purposes). So `blogger.com` on…

How current is this? It doesn't actually have *.blogger.com in it, nor the other two examples I checked.

I just made up `blogger.com` as an example. I probably could have picked a better one. `blogspot.com` & its many TLD variations are on the list.

It looks like the repo where the list is maintained [1] is pretty active. YMMV, I'm not a maintainer or anything..

[1] https://github.com/publicsuffix/list

Re: I accidentally made my link shortener into a malware honeypot

#97

Post by chmod775 »

pants2 wrote: post #73
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

Shadowbanning is extremely hostile to users that have been mis-identified as spammers (which will happen) while spammers will quickly and easily figure out a way to determine if they've been shadowbanned. That approach needs to stop.

I've employed shadow banning on an online service deal with some deranged ban-evading individuals. It does help a lot. Granted, some of the more savvy users may figure out what you're doing, but you're often not dealing with the brightest minds. Given that your typical online service will maybe employ one moderator per 100k people, any reduction in workload is welcome.

> Shadowbanning is extremely hostile to users that have been mis-identified as spammers (which will happen)

It should always be a manual action and moderators should continue to see messages of shadowbanned users. You can always lift it in case of a mistake.

If you're going to have a free tier on your service and your service has any sort of interaction going on between users that could be degraded by spammers and the mentally insane, you're going to need shadowbanning. It's either shadowbanning or upping the hurdle to creating an account considerably.

Re: I accidentally made my link shortener into a malware honeypot

#98

Post by pquki4 »

My first thought after reading the title: I would never create a link shortener service, too complex and too much responsibility -- can it handle the traffic? what analytics can I provide? should it be a paid service (or rather, can it survive without being a paid service)? how to fight off scammers? what if some day the site goes down or permanently stops running, does that mean all those links are now useless?

My thoughts after reading the article: I was so right.

Re: I accidentally made my link shortener into a malware honeypot

#99

Post by StayTrue »

laurent123456 wrote: post #92

Getting a chargeback in Stripe is costly. As soon as a dispute is started there's a fixed $25 that won't be refunded even if you win the dispute. So for a service at $4 a month which is likely to get a lot of fraudulent payments I wonder if it's really viable. One thing he should do is immediately cancel accounts and refund subscriptions when there's an early fraud warning. They are usually accurate and help avoiding…

This was my thought as well. I wonder if the author couldn’t achieve similar friction without charging. Require a card for signup but only authorize it in the case of “free tier” users. PayPal will let me do that for free, not sure about Stripe.

Re: I accidentally made my link shortener into a malware honeypot

#100

Post by 15457345234 »

63stack wrote: post #89
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

I don't understand why shadowbanning would be so effective. It's trivial for any competent spammer to check their submissions from different ip addresses, they will very quickly discover if they are shadowbanned. The risk of misidentifying legit users and shadowbanning them outweighs the potential gain.

> The risk of misidentifying legit users and shadowbanning them

What's the risk?

Post reply on HN