3 ms·
>Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute-force attem
by ajfjsiqjwisjais 7y ago
>Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute-force attempts come from TOR, and other public proxies. In order to avoid information disclosure, we always captcha logins from these kinds of IPs, regardless of whether or not an account exists with the e-mail in question, whether the login credentials are correct, or there is 2fa enabled on the account. So, the "captchas" you notice are not really specific to your account, but rather, the origin of the login. Using TOR is not a crime, you are right - but - it's also our responsibility to our users to make it reasonably hard for their accounts to get compromised on our platform (even if they don't employ the best security practices - and reuse their passwords across the internet.)
Solution: add a checkbox "disable account security measures", so a user who doesn't want CAPTCHAs when logging into their account doesn't see them. It would have a warning so any user selecting it would know what they're doing.
- jhgg 7y agoNo, I don't believe that adding the ability to reduce the security of your account is necessarily a good idea.
- ajfjsiqjwisjais 7y agoA user can already choose to reduce their account security, by reusing passwords, choosing common passwords, not using 2fa, etc. Allowing a user to choose to not have to complete a CAPTCHA before a login attempt, or allowing the user to choose to not require their account to have a phone number in case of suspicious logins, is reasonable, and would make many people who care about their privacy respect Discord much more.
- wowaname 7y agoSee this from a provider standpoint and you will immediately groan at the users setting up their accounts for easy collection from spammers, who in turn use those accounts to spam your service to oblivion. You'll have to deal with the cleanup, not the spammers, not the compromised users. A lot of users don't value their accounts, and this is precisely why we have so many account breaches happen to this day.