4 ms·
If this catches on I will make sure to buy and abuse a few of these tokens every month just to get them banned. Doing a little trolling, 100k+ banned tokens at
by no_time 5y ago
If this catches on I will make sure to buy and abuse a few of these tokens every month just to get them banned.
Doing a little trolling, 100k+ banned tokens at a time.
- ec109685 5y agoThey don’t have to ban the tokens worldwide. They can start with your IP address.
- gtsteve 5y agoThe author points out that you can detect this by finding keys that have an unusually high signature counter. It becomes one signal amongst many, including IP addresses, user agents, etc that are correlated with bot-like activity. You still also get to track other things such as whether the user is moving their mouse and how realistic that looks, as well as past behaviour from that user. I guess in the edge case where you are a legitimate but very heavy user of u2f keys and you happen to share one with a batch that is being abused for bad activity... you just get shown a regular captcha and continue with your day I guess. The design of the system will surely reduce the percentage of people that get that experience however.
- no_time 5y ago>The author points out that you can detect this by finding keys that have an unusually high signature counter. Ah that makes sense. No evil fun for me then :^(