Hacker News Reader

Comment by notlukesky | Hacker News Reader

I assume it will be a cost benefit analysis for unfortunate victims.

It's ok Google setup a form to communicate with AdSense partners.

> “We have a help center on our website with tips for AdSense publishers on sabotage,” the statement continues. “There’s also a form we provide for publishers to contact us if they believe they are the victims of sabotage. We encourage publishers to disengage from any communication or further action with parties that signal that they will drive invalid traffic to their web properties. If there are concerns about invalid traffic, they should communicate that to us, and our Ad Traffic Quality team will monitor and evaluate their accounts as needed.”

I wonder, has anyone contacted Google and somehow avoided getting banned?

Google seems to show no outward no interest in actually unbanning anyone once they're banned, do they care if you tell them beforehand that you're concerned someone is messing with your ads?

And if they do care, does that even help / wouldn't the "ban this guy" script just run anyway?

I highly doubt it.

I've had ~$150 sitting in my adsense account for about 4 years now because I'm unable to cash out. Their 'input bank information' page is broken, seems like my old banking information is stuck filled out and I can't remove it. Won't let me put new information in either. And the link to the help site leads to a 404.

I've tried various forms to reach a person and they've all been fruitless. Google is just holding my money hostage with no recourse.

They even send me a 'your payments are on hold' email every few months to basically say 'remember, we stole your money and theres nothing you can do about it!'. Thanks Google, I almost forgot that you're the definition of faceless corporation again.

I had a similar situation where I bought a domain for an old blogger blog years ago.

So anyway the credit card tied to that has expired (years ago I thought).

Then Google emails me their "update your payment information" email ... and points me to a Gsuite login.

Bro (Google) I don't have a Gsuite account ... and my regular Google account has valid payment options. Every form of help just points back to Gsuite...

Blogger doesn't appear to have any of the old information as far as the domain being purchased.

I managed to get the domain registrar to help. There was no way to contact Google, it was just an infinite loop telling me to login to Gsuite.

Can you bring them to small claims court?

Sounds like a good way to get banned from all Google services.

This would place them in contempt, I suspect, potentially open to equitable remedies.

Of course, IANAL, TINLA.

Why would they obligated to do business with someone who sues them?

Smells like a monopoly that needs a very harsh breakup.

I suppose logically, yeah. I have no idea how to do that though. I don't imagine writing 'Google' on the defendant line is going to work. And if it does they'll likely ban me from all Google services for life. Not really a path I want to go down.

I’ve gone Google free without really noticing. IMO a 150 check makes that an easy choice, but it’s up to you.

Unfortunately their unlimited storage for ~$14/month via gsuite is the best storage deal on the internet. I've got 13TB and counting in there and would prefer to not lose that account.

I've also got another grandfathered in free gsuite account I've been using for personal things for about 7 years, changing from that would be a nightmare.

I suppose I'm part of the problem, being unwilling to do something about it because I have more to lose than gain.

Ok, I had to look that up.

Business / $12 month

"Unlimited cloud storage (or 1TB per user if fewer than 5 users)"

Yeah that is what they write for the terms. In practice though they have never enforced the 1TB/user clause, can't find any references to them doing that ever. Many people claim to have many terabytes with no enforcement on the user clause, myself included at 13TB currently with 1 user for just under a year so far. Apparently it has been this way for years.

Effectively you get unlimited storage for $12 + taxes/month.

It's a pretty smoking deal if you don't mind the (seemingly minuscule) chance that one day they'll ask for more money or pull the plug. In my use case all the data is easily retrieved again so it would only be a minor inconvenience.

Well, if you tell them beforehand, it gives them a chance to ban your account before the illegitimate traffic even occurs. Sounds efficient!

Yeah, Google is well known for being responsive and helpful through their web forms. I've read many a story here on HN about users of Google services having judgements overturned by the friendly support agents who are definitely not robots.

Putting up a captcha would be another option.

captcha on what, the site? since there's basically nothing authenticating the site to the adsense iframe/script, can't the attacker serve a cached version locally?

Are you sure there is no authentication?

https://www.seroundtable.com/google-adsense-verify-sites-265...

That has nothing to do with the discussion at hand, and would do nothing to prevent a malicious ad clickbot

To actually enforce the policy described in that link, would require authenticating websites when rendering ads. Otherwise, one could just embed an ad from a different domain, and easily defeat this process.

I'm not sure why the parent (throwaway2048) is getting downvoted over this. He's correct. The attack is as follows:

You want to attack (send fake traffic to) example.com, but example.com has implemented a captcha system (think cloudflare interstitial). If you directed your bots to visit example.com, they'd have to solve the captcha to view the ads. However, there's nothing stopping you from solving the captcha once, getting the page source, and serving that to your bots. This works because example.com doesn't serve any ads directly, it only embeds a <script> or <iframe> element to adsense. Since the bots are under your control, it's trivial to set up the redirection (eg. hosts file or HTTP proxy). HTTPS isn't a problem either because you can MITMing yourself with a self signed certificate, which is not a problem either as you can get your bots to trust that certificate.

From the perspective of the adsense script, it's impossible to tell whether the bot is visiting the real example.com or a fake version, since the browser is under the attacker's control. The only way to mitigate this attack would be some sort of one time use token that's generated server-side by example.com, and authenticated by adsense each time it tries to display an ad, which I doubt adsense supports.

One solution could be some sort of DRM based device attached ad...but that will cause other problems.

"Nearly there - just complete this captcha to see our advert!"

I mean on the page content. Using something like Google's Recaptcha would reduce friction for legit users.

How would it "reduce friction for legit users"

I think there was a time that was true. Now reCAPTCHA is so prone to tagging someone as a bot if they employ any ad blocking or tracking prevention that it significantly interferes with web use. It's an overall harm to the web in my opinion.

AFAIK attackers only need to actually access your content once and extract the ad embed. Please correct me if I'm wrong.

I think parent comment meant putting up a captcha on the website for suspicious traffic, the way Cloudflare does.

I don't think anyone is silly enough to suggest putting captchas on ads.

Reply on news.ycombinator.com