Hacker News Reader

Comment by splonk | Hacker News Reader

I would speculate that this is mostly meant to be used for identifying bot rings and ATO (account takeover). Brand new accounts on a site with open signups are, on average, quite a lot more suspicious than older accounts. There's a significant demand for aged accounts to use for various banned activities (mostly spam first and vote manipulation second), and fingerprinting is likely a high value signal in combating it. Two easy ways to generate aged accounts in bulk - create a whole lot of them and wait (and optionally do some activity on them to make them look real), or take over abandoned or compromised accounts. Fingerprinting is very good at identifying clusters of the former, and at least helpful for the latter.

EFF appears to have rebranded Panopticlick as "Cover Your Tracks", but it's usually a fun thing to look at in discussions of this type as an example of what can go into a fingerprint and the informational value of various parts:

https://coveryourtracks.eff.org

View on HN

I'm under the impression that there's one thing that works almost 100%: nominal payment for account creation. A few bucks. Or more, if you also want it to help run the site. Bonus for the latter case is that you're also helping to protect your users from advertisers running a train on their browsers.

If someone is running a bot farm to do malicious things, they are probably the same types to have a list of acquired card numbers as well. Using a site like this would allow for users to be created while validating a new acquired list of card numbers.

A black hat's wet dream of a site.

So? Make them use those card#s, a limited asset, and put the banks to work protecting those interests instead of leaving all the load for us.

If you are accepting credit cards, you are liable for the charge backs that occur. If you are only nominally charging <$1 for accounts, then maybe fraudulent charges wouldn't be noticed by the card holder as it wouldn't noticeably alter the balance on a quick glance. However, if you do get a lot of people challenging these charges, then the site owner can pottentially lose their privileages with which ever card processor they are using regardless of the values of those charges.

Eventually, the site owners won't want to deal with that either. So, who's court do we put the ball in now?

Not just that processor, but potentially across all of Mastercard.

Google tmf match for more info. One such result: https://stripe.com/docs/disputes/match

Yea, the incentives in the wrong place for credit card processors. They actually charge credit processing fees for fraudulent purchases, and then get to charge processing fees again for the chargeback when the fraud is discovered, even though the merchant sends all the info they have to the processor and the processor okays the transaction. The credit card processors have the most information, but the least incentive to fight fraud.

At LimeWire, for a while, the price for LimeWire Pro was a hidden field in the order form, because the CTO (rightly) wanted to minimize the amount of logic running on anything that touched credit cards. The form was generated on one host and posted to another, and the logic for experimenting with lower prices at certain times, etc. was kept off of the host that processed credit cards.

As a result, some more technical users could order LimeWire Pro for $1. But, they could also find LimeWire Pro using the free version, so no real loss there. However, some carding gangs also noticed, and would validate huge batches of credit card numbers by buying LimeWire Pro for $1. The cargebacks were a bit painful, but more importantly, if your fraud rate is above some threshold, your fees go up, and at some point our credit card processor gave us 2 months to bring down our fraud rate or they'd cancel our merchant account. The processor also refused to give us fraud information updates with any finer granularity than monthly, so we basically had two tries to bring the fraud rate down.

All of the existing CAPTCHA systems I could find required a shared filesystem between the process generating the CAPTCHAs and the process checking the answers. That was a no-go with our policy of minimizing attack surface of our credit card processing host. So, I wrote a CAPTCHA that used HMAC to generate a 96-bit tag from a timestamp (at 1 minute granularity), the user's IPv4/24, and the price. The other 64 bits of SHA1-HMAC output were used to seed the prng that generated the CAPTCHA. The timestamp and 96-bit tag became hidden fields in the HTML purchase form. That way, the credit card processing box could validate the time, IP address, and price, and check the CAPTCHA answer, all from the submitted form data. Answers with timestamps more than 20 minutes old were rejected, so the processing box only needed to remember all of the correct CAPTCHA answers over the past 20 minutes to avoid replay attacks. Making the timestamp 1-minute granularity prevented bots from hammering the system until they got easy CAPTCHAs.

The first day we put my CAPTCHA system in production, we saw an IP in Virginia very rapidly trying to make purchases without the CAPTCHA. Then it paused for a few minutes while the attacker figured out what was going on and manually solved one CAPTCHA. Then a rapid-fire batch of purchases came through with the same CAPTCHA answer, and only the first purchase came through. A couple minutes later, that exact same CAPTCHA 96-bit tag and answer came in from a UK IP address, but it was rejected because the 96-bit tag didn't match the HMAC.

Those were fun days, but it's a shame incentives are so misaligned.

We had the same issue for our $3 price point plan. We never used CAPTCHAS. We fingerprinted browsers, used proxy detection, and other methods to detect them. They would script the page, so we would move live url to a new one and then feed bad data on old page which polluted their data set. It was quite fun messing with them. Most of the bot nets would get caught on browser fingerprinting and that they were falsifying their user agent. Our browse fingerprint ban would say their IP was banned so we would watch them jump from bot net computer to not bot net computer.

> It was quite fun messing with them.

While I can appreciate that, how much time did this take, of how many people, for how long? I ask all of that as someone about to launch a public facing retail site, and absolutely dread this type of stuff. It's a side hustle project on top of my actual day job/contract jobs, AKA I don't have a lot of time to dedicate to this.

Not much time. Probably a couple days. We used maxmind proxy detection and FingerPrint.js. We also used source of traffic. Bots never come in on ads. They come in direct.

Stuff we built at a neoBank to prevent credential stuff from password leaks was a lot more sophisticated. Couldn’t trust email based 2fa because people re-used passwords. We did invasive hashing of internal networks with webRTC and also pierced proxies with STUN. Along with using a commercial waf that did real time profiling.

The day we turned on our CAPTCHA, I also remember being horrified at the number of people likely running LimeWire on US Navy vessels. One IP address in the DC metro area had multiple purchases per minute, with half of the email addresses ending in .navy.mil, so I added an IP address whitelist to not drop those CAPTCHA answers into the replay-prevention cache. I'm pretty sure that IP address was the base station for a US Navy satellite.

I mean, not horrified enough to prevent them from paying my company $18.88, but still horrified.

In retrospect, given that we were a 13 person company selling software with a marginal cost near zero, we should have left the system in place and never processed the $1 charges. Instead, we should have used a CRC32 of the upper-cased name and credit card number (in case they verified consistency) to accept 98% of $1 purchases without ever charging any of the cards. Even better would be to do a 2-part credit card transaction, first placing a hold on the credit card for the full purchase price, and waiting one minute to see how many different credit card numbers came from the same IP address in the next minute. If less than 4 different numbers came in the past minute, go ahead and complete those transactions, otherwise put the IP on the hellban list to start getting randomized results. Injecting pure noise into the carding ecosystem would have cost us nearly nothing (and given a 100% discount to a bunch of active duty sailors).

Something like a Stripe Payment Link [1] would help with this, right? The payment is directly on Stripe.com so they have the best chance at stopping fraud across the whole platform.

[1]: https://stripe.com/payments/payment-links

I'm pinning my hopes on that. It's the only 3rd party JS library I'm using, and hope to not have to deal with the nightmare of fighting these battles

Me too. Stripe's chargeback protection is just 0.4% per transaction, which is well-worth it when the products are under ~$5 and chargebacks cost $15, but it's unavailable for payment links as per customer support just now :/

Interesting. Is Stripe itself not available or just this chargeback protection? Mind sharing what type of business?

Stripe offers Payment Links [0], which makes it really easy to accept payments (just paste a link into your product page and handle a webhook serverside; a single href is adequate).

They also have a separate "Checkout" offering [1], which requires some code client- and server-side to generate the page.

So far, Stripe has been awesome for me selling $2.50/mo subscriptions using just the link [2], and as far as I know, suspicious transactions are very likely to be blocked by Stripe Radar which is across all of Stripe.

However, their chargeback protection service (0.4%/tx for total protection for any chargeback) [3] is only offered for the Checkout version. This means I won't be protected in the case of a chargeback, whether by a customer or fraud that slipped past Radar. ("Currently, Chargeback Protection is only available on the new version of Checkout" is what I was told by support)

[0]: https://stripe.com/payments/payment-links

[1]: https://stripe.com/docs/checkout/quickstart

[2]: As a student I get fees waived for the first $1000 in volume, otherwise fees would eat through 20% of my revenue immediately at this price point. I posted about this side business recently as a Show HN if you would like to know more :)

[3]: https://stripe.com/radar/chargeback-protection

I was unware that the Links mentioned originally was a specific Stripe product. It makes sense now. I've been integrating with the Checkout API, and was hoping Radar would be worth including the stripe.js on every page as they recommend.

I've had the displeasure of getting hit with a bunch of fraud charges and the resulting chargebacks. It literally ended our small 2-person operation as we not only lost the money from the sale but also the product that had been shipped. This was early '00s, and online merchant accounts back then were not any where like Stripe. This is the one area of a trying a new online biz that concerns me the most.

For sure, chargebacks are really worrying especially to a small business. I can only hope Radar is as good as they say :/

A sad state of affairs in finance when this is a legitimate concern.

Stripe payments are available only in US, Canada, EU + few other select countries and that's it, maybe 40 total out of 195.

Just force 3d secure. It shifts the liability from you to the customer’s bank

I don't know how you "just force" something like this. I had to look up what it even is. If I visited a website that "forced" this, I would be unable to complete the transaction. I've never seen this to even see how it would work. Doesn't seem like it's one of those things that should "just" be done and expect it to not negatively impact things.

All banks in the EU support 3ds (SCA is mandatory since 2019). The majority of banks which don't support 3ds are located in the US, but even there it's only a *zero point x percentage. Turns out that banks don't like fraud either :P

You can manually trigger a 3ds authentication flow when setting up the payment intent: just set payment_method_options[card][request_three_d_secure] to "any".

Ran a 3.000+ tx/day business with this and got less than double digit disputes per month which are usually lost by the customer. Those disputes are also not for "stolen credit card", but "not delivered product" or similar bs.

Fun fact: If three_d_secure.authenticated is false but three_d_secure.succeeded is true, the bank did not authenticate the payment but you are still protected from chargebacks since the bank accepted the liability shift. (Happens for smaller purchases, e.g. < 30€ && known device && customer authenticated another purchase in the last three purchases he did with the card)

If you are using a no-code solution and are not setting up your payment intents manually, you can also subscribe to radar and create a rule for 3ds if amount >= 0€.

* These numbers are from my experience of running our shop for a software company.

Not <$1. $5.

If you make 30k per successfully abused account, you can spend a lot on stolen credit cards.

Or if you want, use virtual credit cards that give you a new number every time, and will pass without a name/address match

If only the banks cared

The amount of people that have access (and pay for access) to stolen cards is far less than the amount of people running bots. Running bots is seen as harmless. Using stolen credit card numbers is credit card fraud and will lead to imprisonment if you are caught.

I don't think it is about the number of people, but the type of people. These people are much better funded to do things than I am to fight against it. If they succeed using my site, I'm then on the hook to refund the money and other fees. It cost the fraudsters nothing. They more than likely aren't even afraid of criminal prosecution as they are in a location protecting them.

For small business, this kind of thing could be the death of that small company.

That switches cheap attacks from registration to account take over.

Highly profitable attacks, or using stolen credit cards bypasses this protection, since it's either still worth your while, or somebody else is paying

Yeah... this makes you lose all your privacy, and exclude all the people in the world who either don't have a credit card, or don't want to use one.

Thank you, but no.

Definitely not intending to shill crypto (on HN of all places), but it seems like a good (as good as it gets, possibly) use case for anonymous – zero-knowledge – cryptocurrency transactions.

Now you've just raised the barrier to entry even higher for normal people, and lowered the barrier to entry even lower for cybercriminals with crypto that they would need to launder if they were going to attach it to an actual identity.

I doubt this is a win.

It's important to recognize that there's a glut of cryptocurrency collected from illegal transactions, and that money needs to be laundered if the holders want to liquidate it. It would be dumb to go to exchanges, so they need to rely on shady groups to cash out, ensuring that there's a lot of cryptocurrency in the hands of questionable people or organizations.

> Now you've just raised the barrier to entry even higher for normal people

How so?

They have to figure out how to use a new (to them) payment system...

Oh, I misread as the barrier of entry to crypto. My bad.

On topic, you could just have multiple payment methods side by side.

It seems like the anonymizing cryptocurrencies get blackballed by exchanges, meaning most people won't have access to them.

Coinbase, for example, only allows transfers of Zcash to transparent addresses, which can be traced, and buying Monero isn't possible.

That's not really an impediment in the Zcash case you're mentioning. Upon making a withdrawal to a transparent address, you can immediately do another transfer to a shielded address. Some wallet apps explicitly include a feature to automate exactly this ("auto-shielding") [1].

Exchanges don't need to have this limitation, and some others don't have such a limitation. Gemini, to name probably the most prominent example, supports withdrawing to shielded addresses [2].

  [1] https://f-droid.org/en/packages/com.nighthawkapps.wallet.android/
  [2] https://www.gemini.com/blog/youre-one-step-closer-to-financial-freedom-with-shielded-zec-withdrawals

As we all know, it's impossible to automate a crypto transaction.

That's a separate problem. The topic is about running a site that crawls up your browser's ass as far as possible.

This is assuming, that they wont profile/fingerprint you, if you pay. Surely no service like that would ever double dip

It's still a separate problem.

> this makes you lose all your privacy

The alternative (advertising) is not better.

> exclude all the people in the world who either don't have a credit card, or don't want to use one.

Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills.

>> this makes you lose all your privacy

> The alternative (advertising) is not better.

Umm, adblockers, tor and whatnot can help with ads tracking and but you can't take back your privacy once you've given identifying information.

>> exclude all the people in the world who either don't have a credit card, or don't want to use one.

> Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills.

You have no idea how extremely white this part of the internet is that we're currently on. Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality.

> adblockers, tor and whatnot can help with ads tracking

Ad-blockers only work as long as there's a majority who does not use them. If everyone uses ad-blockers, the system collapses. Furthermore, ad-blockers encourage a game of cat & mouse where both the provider and the consumer are constantly at odds, with nasty side-effects like alternative clients being forbidden, etc.

> you can't take back your privacy once you've given identifying information.

My argument is that you should be able to give identifying information without it being abused for nefarious purposes.

> You have no idea how extremely white this part of the internet is that we're currently on

Oh come on, there was no need to bring race into this. But hey, if that's your argument, I'd say that having a bunch of white tech-bros in the ad & social media industry control the entire communications infrastructure and social fabric of "non-white" (to use your words) nations is not better.

> Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality.

Do you really think that ad-supported platforms just offer service to the credit-card-less third-world for free? No, they do so because there are advertisers who are happy to pay, and those advertisers in turn know how to get their money back (and more than that) from those people without credit cards.

This was one of the original use cases for crypto, before the ghouls moved in. You could pay $0.05 to sign up for an account, something that remains impossible to this day due to payment providers' transaction fees.

> something that remains impossible to this day due to payment providers' transaction fees.

I wonder if you've looked at the Bitcoin transaction fees for a $0.05 payment lately...

Reddit's business model only works because there are people willing to spend their time posting content for free. If they start charging for accounts, even a few cents, they're going to lose a lot of new users. The psychology alone would completely change the site dynamics. Humans are weird.

It's probably worth it, given the alternative. Depends on the people making the decisions, though.

That's true. The obvious tradeoff is that nobody wants to add friction to account creation, especially when they're first starting out and don't have network effects, and abuse detection is tomorrow's problem. And then if you try to add it afterwards when you've gotten popular you'll be deafened by the screams of everyone who's gotten used to a free experience. Plus, your support load goes way up because all your users are now paying customers.

I've heard that it worked for Metafilter but I wouldn't be surprised if it prevents a site from scaling users past a certain point. (I mean, sounds great to me, but probably isn't what someone running something like Reddit wants.)

Not wanting to "add friction" means you're making it easy for bots, it's as simple as that. Bots don't have bank accounts and the people running bots don't want to be identified via bank information or using up all their stolen CC#s on simple account creation.

>there’s a significant demand for aged accounts

I kid you not, I had an offer for $500 to sell my account.

Okay, I guess I didn't mean quite _that_ significant.

At that level I'm curious if you have some sort of special high value account (ton of karma, a mod of major subreddits, or have a lot of domain specific reputation), or if that offer is coming from someone who's trying to scam you in some way.

Edit: From a sketchy account buying site that I wouldn't trust too much, the price for Reddit accounts runs from ~$3-16 per thousand accounts, depending on age. For comparison, Twitter accounts with 100 followers are ~$4, Instagram accounts with 500 followers are ~$12, Hotmail accounts are ~$100, and GMail accounts are several times that, depending on age and provenance.

This was actually a “legit” site I’d seen before. My account was over a decade with all sort of Reddit gifts awards and mod of a few subs, one of which is over a million people (back when I had the patience to mod subs haha). They also tend to value email verified accounts.

They offered $200 and I haggled to $500 then ghosted them just to see how far I could take it for kicks. Definitely didn’t sell it. I don’t drink the Reddit kool-aid but I’d rather not directly contribute to astroturfing for pay.

Yup. their ad targeting is context. super basic 'interests' and specific sub reddit placements. I haven't found it to be valuable.

I just looked to double check nothing changed since I last bought something and it looks like the have a customer match but only as a holdout/narrow. Which is weird if true? as in can't upload a list and target those users if i'm reading their page correctly

pushing their s*t redisign and mobile app on us with more feed ads might mean they are trying to push for 1st party data based targeting though

I use Apollo on iOS to avoid this nonsense. However, since I do happen to use reddit A LOT, I also pay for a premium subscription. An added perk (above no ads, etc.) of the subscription is you are awarded 500 reddit coins a month, so you can reward others for good content.

The Reddit award system is so flagrantly abused. It needs to be dismantled. People use alts (which still get daily free awards) to convince the folks their comments are “good” or “correct” all the time. I’ve sat in marketing meetings where folks talk about buying awards to push their content.

Unlike the vote system there is nothing the admins do to counter this problem.

Reply on news.ycombinator.com