Sending spammers to password purgatory
troyhunt.com
Sending spammers to password purgatory
1–10 of 170 posts
Re: Sending spammers to password purgatory
#2I had to change Microsoft -> MS and Cloudflare to CF otherwise the title wouldn't submit.
Original title in full is: Sending Spammers to Password Purgatory with Microsoft Power Automate and Cloudflare Workers KV
Re: Sending spammers to password purgatory
#3This is hilarious but I wonder if many actually fall for it.
Re: Sending spammers to password purgatory
#4This is hilarious but I wonder if many actually fall for it.
In the grand scheme probably not. The whole idea of spam is a lot of misses and few hits.
I'm sure it's great fun to design and build and occasionally get to watch.
Re: Sending spammers to password purgatory
#5Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers.
A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to have some step fail or reach a dead end. They really seem like they're just set up to intentionally waste people's time.
For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. It's a lot more annoying than just saying "you have been locked out of trying to log in for X hours".
But this, this is fine. It's pretty clear that the person you're targeting is a spammer, and it's pretty clear to the user after about 60 seconds that you're password system is a joke.
Re: Sending spammers to password purgatory
#6This is a cool project, but I would more concerned that replying to spammers confirms you are real and that could result in much more spam. So is the net increase in pain your own?
Re: Sending spammers to password purgatory
#7This is awesome and it works!
I did the same thing 10 years ago and it was one of the best morale builders for our team after all the time we spent dealing with these folks.
https://www.brightball.com/articles/waste-spammers-time-to-r...
Re: Sending spammers to password purgatory
#8Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…
I tried to sign up for steam and my long complex password seemed to trigger a never ending stream of captures. Also, just today ticketmaster decided my firefox browser was a bot and blocked me. Fun times.
Re: Sending spammers to password purgatory
#9Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to hav…
> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve.
I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.
Re: Sending spammers to password purgatory
#10I wouldn't be comfortable doing this, for one thing, we know people tend to re-use passwords. So any email/password info you collect should be treated with security like they just gave you their bank login, because some of them did. So then Troy has to report himself to his own service (haveibeenpwned).