Mechanical Turk is Insecure | Hacker News Reader

Mechanical Turk is Insecure

medium.com

45 pointsukd19 comments

Mechanical Turk is Amazon's Google Reader. I had to write a whole guide[1] on not getting screwed over by scam requesters because all the tools for it don't exist as part of Mechanical Turk. I don't think Amazon has touched the service since they launched it.

[1] http://mkronline.com/2013/09/17/how-to-make-money-with-mecha...

This is absurd.

What is the work-around/alternative? Well written post.

The only one I've thought of since writing this is to have a separate AWS account and link it as a sub account for billing. Solves someone shutting down your main servers, but still means they can spin stuff up / use lots of cash. This would be a massive pain for us as we'd loose our worker pool. I could do it the other way, move our infrastructure to a new account...but that sounds equally painful.

Or have it charged to an entirely separate card, one that gets reloaded with money every month to cover planned MT expenses. Annoying, but the safest option, I suspect

I would like to see IAM as well, but I would say that the solution right now is using a seperate account and using AWS MFA:

http://aws.amazon.com/mfa/

A new account doesn't have all AWS services enabled by default, so the impact seems minimal to start with. Not sure if you can lock this down further as I haven't looked into it.

All in all this is not perfect, but "securer".

Worse yet, the tasks are public on the web, and anyone can see what's being posted: there's not even a minimal level of privacy.

Well this is the same for most services, I've seen - including MobileWorks? If you register as a worker and you can accept tasks, if you meet the requirements.

It's avoided to some extent by us due to the way we issue training / challenge work before any actual work is given to new workers.

Not quite: in MobileWorks, work is assigned to private workers, so nothing is public. The same goes for CloudFactory, TaskUs, and the other non-marketplace crowd platforms.

You're right that challenge work does a reasonable job of screening tasks from search engines, though!

Hopefully this draws enough attention for amazon to want to fix the problem.

Reply on news.ycombinator.com