Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting AI agent use and abuse

stytch.com

Post reply on HN
Print view View original

91–100 of 106 posts

Re: Detecting AI agent use and abuse

#91

Post by BoorishBears »

soco wrote: post #65
soulofmischief wrote: post #62

Earlier quoted context omitted.

> You write as if someone held a gun to your head and force you to sign up for Plaid. Plaid doesn't require anyone to use it. There is not a physical gun pointed at my head, but an increasing amount of digital online interactions are solely gated by Plaid. I've run into plenty cases where I simply had no choice, for example dealing with landlords. And you already know how long it takes for financial systems to evolve…

I think this anger with Plaid is unwarranted. Without them, or before them, you had zero API access because the banks (including yours) don't give a rat's ass on your fancy access needs. Now Plaid managed to gather together some kind of access. Are they to blame because they managed that? Do you still have any alternative with the bank? I think no, and no. You can get back to the "standard" situation of no API, no gu…

I think it's warranted if you don't look closely, unwarranted if you look deeper, and once again warranted if you look even deeper...

Before Plaid there, the floor to require a bank account to do something in your SaaS was high to impossible.

Now the floor is low, and we got a bunch of applications that take advantage of that, so good right?

The problem is most of those applications are not in your best interests as a person.

-

It mostly just enabling a bunch of junk BNPL debt and modern day payday loan schemes.

It allows offerings that are too risky to be good ideas to patch things up by just peeking into an account and making sure they'll be able to take their $X before some other rent-seeker drains the account for the month.

It also normalizes so much more access and visibility than is actually needed, so even in cases where the risk was acceptable before, now why not just peek really quickly and improve your bottom line at the expense of having yet another service with access to your financial data.

Overall Plaid probably has not been a net positive for the average person. Other countries have open banking platforms but they're also must stronger on regulation and oversight than the US, so you don't seem it become quite as much of a negative.

Re: Detecting AI agent use and abuse

#92

Post by golergka »

chii wrote: post #78
golergka wrote: post #37

Earlier quoted context omitted.

I'm building a service which needs to extract rss feeds from pages (hntorss.com if you're interested). Nothing else. From any rational point of view, website owner would actively want this parser to work as easily as possible — the whole point is for users to see the content you publish! Alas, I still get rate-limited, 400-ed and others because of user agent and other bot-detection mechanisms.

> the whole point is for users to see the content you publish! no, the whole point (for most sites) is to make money off the users visiting said site (currently via advertising). Another third party service which slurps the data, and redirect the users to a different site to consume the data means the original site lost the revenue, but paid the bandwidth cost. So it's understandable that many sites want to block suc…

Then you wouldn't have RSS feeds in the first place. I'm talking about sites that decide to have them for one reason or another.

Re: Detecting AI agent use and abuse

#94

Post by hiatus »

bsnnkv wrote: post #76
hiatus wrote: post #75

Earlier quoted context omitted.

Does your service respect robots.txt of the sites it crawls?

Look harder Simba, there is no crawling involved

I see this:

> This led me to my next and (currently) final stop, Kullish, which searches through a number of link aggregation and discussion websites (including Reddit) for a URL before providing a single feed of comments from everywhere.

But reddit for instance disallows everything in its robots.txt

Re: Detecting AI agent use and abuse

#95

Post by rendaw »

mcstempel wrote: post #9
diggan wrote: post #3

> it could present unacceptable risks for application developers or be used as a method for malicious attacks (e.g. credential stuffing or fake account creation). The article seems to want to distinguish between "bad" and "good" bots, yet beyond the introduction, seems to treat them exactly the same. Why are website authors so adamant I need to use whatever client they want to consume their content? If you put up a b…

Hey there, I'm the author of the post. I'm actually pretty sympathetic to your viewpoint, and I wanted to clarify my stance. I actually spent years working at a "good bot" company (Plaid), which focused on making users' financial data portable. The main reason Plaid existed was that banks made it hard for users to permission their data to other apps -- typically not solely out of security concerns, but to also active…

Why can't users revoke permissions if the service can't detect good bots? Those seem wholly unrelated.

Re: Detecting AI agent use and abuse

#96

Post by bsnnkv »

hiatus wrote: post #94
bsnnkv wrote: post #76

Earlier quoted context omitted.

Look harder Simba, there is no crawling involved

I see this: > This led me to my next and (currently) final stop, Kullish, which searches through a number of link aggregation and discussion websites (including Reddit) for a URL before providing a single feed of comments from everywhere. But reddit for instance disallows everything in its robots.txt

In this specific case, Reddit makes an API[1] available for developers.

And again, there is no crawling involved.

Crawling is a very specific, well defined behavior. I'll assume with good intent that you aren't familiar with the definition of crawling, in which case you probably should become familiar with it before making inaccurate comments like these in the future.

If you had taken the time to do some relevant reading before writing your inaccurate comments, you would have seen:

> Our [Reddit] robots.txt is for search engines, not Data API users.

[1]: https://old.reddit.com/r/reddit.com/wiki/api

Re: Detecting AI agent use and abuse

#97

Post by A1kmm »

ATechGuy wrote: post #28

Looks like detecting real humans apart from agents is going to be an arms race if the detection is based on browser/device fingerprinting or visual/audio captchas; AI will only get better. What are captcha alternatives that can block resource consumption by bots?

Setting request quotas per natural human. However, that has some problems to solve:

1. Who gets to decide who is a different natural human? I'm working on uniquonym (https://lemmy.amxl.com/c/project_uniquonym) that will leverage governments to decide this; other solutions include https://proofofhumanity.id/ and Worldcoin.

2. How do you avoid this becoming a supercookie tracking solution that badly impacts privacy? Zero-knowledge proofs provide some help here - there are ways to create an ID that changes on a certain frequency and is different per site, but different IDs can't be correlated, preventing long term tracking and cross-site tracking, while still providing enough to rate-limit per natural person.

3. How do you stop people selling their identity to scrapers? This is a hard one to solve, but there are protocols that make it harder without giving up sensitive information or being interactively involved on an ongoing basis.

Re: Detecting AI agent use and abuse

#98

Post by gloosx »

Looking at user-agents or IPs is the most shallow and non-deterministic way possible. They are arbitrary, I'm not a bot, but I'm using a highly customised one in order to enhance my browsing experience.

>They use genuine IP addresses, user agents, and even simulate mouse movements.

From the list above, only simulating mouse movements part seems like the hardest thing to fake correctly, which genuine IP addresses and user agents is something you can 100% fake. Why focusing on the ip addresses and user agent string then if you can just see that AI Agent is moving it's mouse in a perfect straight line between buttons and doing nothing else with it. Obviously human mouse movement patterns on every webpage are quite chaotic and having it mechanised is an obvious red flag which you should train your model on.

I think the future of ai agent/bot detection is a model trained on user behaviour patters when he is interacting with the page UI.

Re: Detecting AI agent use and abuse

#100

Post by immibis »

soulofmischief wrote: post #88
immibis wrote: post #87

Earlier quoted context omitted.

Well then banks should offer a proper API with tokens and permissions. What's that? They don't? Guess I'll just have to give Plaid my password then. Stupid banks. btw this is the exact same way Facebook got people to migrate off MySpace.

I remember Facebook's shady user acquisition tactics, and I also do not use Facebook and similarly think their business model is morally bankrupt. > Guess I'll just have to give Plaid my password then. Learned helplessness, trading digital sovereignty for convenience. There is a larger war being fought here that is bigger than you or me. Had Plaid not been forced upon me, I would never have used it willingly.

You think digital sovereignty is when you are not allowed to do what you like with your account, but must follow someone else's terms and conditions?
Post reply on HN