Hacker News Reader

Comment by mrep | Hacker News Reader

Do you have a better solution for differentiating yourself as an actual user from a robot spammer?

Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.

> Being allowed to pay for services with money, rather than being required to pay for services with your personal data

One possible big disadvantage for a site owner in letting people pay with money instead of data is dealing with taxes.

I'm not actually sure how most jurisdictions tend to classify it when someone comes to your site and you charge them to access your content. My guess would be it would be taxed the same way they tax digital goods such as downloadable software that does not include any physical components.

For such goods most jurisdictions that tax them seem to base the tax on the buyer's location rather than the seller's location, so the seller has to deal with charging the appropriate tax and filing returns for potentially a large number of jurisdictions.

If the seller is providing the content for "free" and making their money selling visitor data to advertisers then their income will probably only be subject to taxation in their own jurisdiction. It will simply be ordinary business income.

My experience with taxation out side of the US, currently Australia, is that they are ridiculously reasonable and probably more on my, that is the business owners, side that I would like them to be.

It would be a net benefit for everyone, including the US, if it's broken taxation system becomes a national emergency and finally gets fixed.

And for the "this is a real person" service, they really don't have to charge much. I should be able to go to the store and pay a dollar for a PIN that gets anonymized on use and lasts a long time if not indefinitely when not abused.

I would absolutely subscribe to a email service with a 5/10/15 dollars one time payment.

Email has recurring costs to run. They need to process every email you receive and send and therefore any email service that actually wants to continue running will need to charge a subscription fee.

A paid account is just as vulnerable to password theft as a free one.

This is only truly necessary as a mechanism to prevent automated signups.

It is less necessary, but can be useful, to prevent repeated login attempts (rate limiting works there).

For accessing a website it's completely inexcusable.

Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.

Only as long as you keep up the attack.

But an attack that keeps rate limits saturated doesn’t require much bandwidth (you know, because rate limits) and is therefore easy to keep up. Most services would consider it unacceptable if a script kiddie with a botnet and a generic list of usernames were able to prevent even 1% of their users from logging in.

So your solution is "sorry, come back later when the attacker hopefully stops"?

I can keep you out of your account indefinitely with a curl loop and a rotation of proxies?

Background: I spent years developing a product that currently defends F500 websites against automated attacks. If you live in the US you've more than likely used my software this week without knowing it.

Rate limiting is completely ineffective in preventing credential stuffing attacks from determined adversaries. The challenge is not brute-forcing, but credential leaks and password reuse. Attackers have access to vast seas of IP addresses and in my past life doing the defending, we would see an IP address involved in automation twice, and then it would go away forever.

I've covered this in a reply to another one of your comments, I think, so won't bother here.

> This is only truly necessary as a mechanism to prevent automated signups.

Only if there isn't some shared knowledge between the website and prospect.

For example some niche websites that I use have locally-based challenges such as 'how many engines can be fitted to a Boeing 747-400'* or a short mathematical algebra to solve.

Both approaches work without Javascript and without external support, just with a two-column table and a trusted group of challenge-creators.

* it's more than four

There's a solution here that's being used in email. The user has to provide a proof of work.

Where is it being used?

Because the reason why https://en.wikipedia.org/wiki/Hashcash wasn't useful for anti-spam after all is because attackers have access to the cheapest compute in the world: botnets and devices that aren't their own.

Honeypots take care of most basic bots. If you need captcha, you can use Math Question like in http://random.irb.hr/signup.php You can also add extra security with time elapsed between loading the page and form submission, if it's less than 5 seconds it's most likely a bot.

Reply on news.ycombinator.com