12 ms·

I would speculate that this is mostly meant to be used for identifying bot rings and ATO (account takeover). Brand new accounts on a site with open signups are

• rhizome 5y ago
  I'm under the impression that there's one thing that works almost 100%: nominal payment for account creation. A few bucks. Or more, if you also want it to help run the site. Bonus for the latter case is that you're also helping to protect your users from advertisers running a train on their browsers.
  • ajsnigrutin 5y ago
    Yeah... this makes you lose all your privacy, and exclude all the people in the world who either don't have a credit card, or don't want to use one. Thank you, but no.
    • rhizome 5y ago
      That's a separate problem. The topic is about running a site that crawls up your browser's ass as far as possible.
      • ajsnigrutin 5y ago
        This is assuming, that they wont profile/fingerprint you, if you pay. Surely no service like that would ever double dip
        • rhizome 5y ago
          It's still a separate problem.
    • Nextgrid 5y ago
      > this makes you lose all your privacy The alternative (advertising) is not better. > exclude all the people in the world who either don't have a credit card, or don't want to use one. Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills.
      • ihateolives 5y ago
        >> this makes you lose all your privacy > The alternative (advertising) is not better. Umm, adblockers, tor and whatnot can help with ads tracking and but you can't take back your privacy once you've given identifying information. >> exclude all the people in the world who either don't have a credit card, or don't want to use one. > Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills. You have no idea how extremely white this part of the internet is that we're currently on. Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality.
        • Nextgrid 5y ago
          > adblockers, tor and whatnot can help with ads tracking Ad-blockers only work as long as there's a majority who does not use them. If everyone uses ad-blockers, the system collapses. Furthermore, ad-blockers encourage a game of cat & mouse where both the provider and the consumer are constantly at odds, with nasty side-effects like alternative clients being forbidden, etc. > you can't take back your privacy once you've given identifying information. My argument is that you should be able to give identifying information without it being abused for nefarious purposes. > You have no idea how extremely white this part of the internet is that we're currently on Oh come on, there was no need to bring race into this. But hey, if that's your argument, I'd say that having a bunch of white tech-bros in the ad & social media industry control the entire communications infrastructure and social fabric of "non-white" (to use your words) nations is not better. > Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality. Do you really think that ad-supported platforms just offer service to the credit-card-less third-world for free? No, they do so because there are advertisers who are happy to pay, and those advertisers in turn know how to get their money back (and more than that) from those people without credit cards.
    • klabb3 5y ago
      Definitely not intending to shill crypto (on HN of all places), but it seems like a good (as good as it gets, possibly) use case for anonymous – zero-knowledge – cryptocurrency transactions.
      • gpm 5y ago
        Now you've just raised the barrier to entry even higher for normal people, and lowered the barrier to entry even lower for cybercriminals with crypto that they would need to launder if they were going to attach it to an actual identity. I doubt this is a win.
        • heavyset_go 5y ago
          It's important to recognize that there's a glut of cryptocurrency collected from illegal transactions, and that money needs to be laundered if the holders want to liquidate it. It would be dumb to go to exchanges, so they need to rely on shady groups to cash out, ensuring that there's a lot of cryptocurrency in the hands of questionable people or organizations.
        • klabb3 5y ago
          > Now you've just raised the barrier to entry even higher for normal people How so?
          • gpm 5y ago
            They have to figure out how to use a new (to them) payment system...
            • klabb3 5y ago
              Oh, I misread as the barrier of entry to crypto. My bad. On topic, you could just have multiple payment methods side by side.
      • heavyset_go 5y ago
        It seems like the anonymizing cryptocurrencies get blackballed by exchanges, meaning most people won't have access to them. Coinbase, for example, only allows transfers of Zcash to transparent addresses, which can be traced, and buying Monero isn't possible.
  • dylan604 5y ago
    If someone is running a bot farm to do malicious things, they are probably the same types to have a list of acquired card numbers as well. Using a site like this would allow for users to be created while validating a new acquired list of card numbers. A black hat's wet dream of a site.
    • rhizome 5y ago
      So? Make them use those card#s, a limited asset, and put the banks to work protecting those interests instead of leaving all the load for us.
      • getcrunk 5y ago
        If only the banks cared
      • dylan604 5y ago
        If you are accepting credit cards, you are liable for the charge backs that occur. If you are only nominally charging <$1 for accounts, then maybe fraudulent charges wouldn't be noticed by the card holder as it wouldn't noticeably alter the balance on a quick glance. However, if you do get a lot of people challenging these charges, then the site owner can pottentially lose their privileages with which ever card processor they are using regardless of the values of those charges. Eventually, the site owners won't want to deal with that either. So, who's court do we put the ball in now?
        • KMag 5y ago
          Yea, the incentives in the wrong place for credit card processors. They actually charge credit processing fees for fraudulent purchases, and then get to charge processing fees again for the chargeback when the fraud is discovered, even though the merchant sends all the info they have to the processor and the processor okays the transaction. The credit card processors have the most information, but the least incentive to fight fraud. At LimeWire, for a while, the price for LimeWire Pro was a hidden field in the order form, because the CTO (rightly) wanted to minimize the amount of logic running on anything that touched credit cards. The form was generated on one host and posted to another, and the logic for experimenting with lower prices at certain times, etc. was kept off of the host that processed credit cards. As a result, some more technical users could order LimeWire Pro for $1. But, they could also find LimeWire Pro using the free version, so no real loss there. However, some carding gangs also noticed, and would validate huge batches of credit card numbers by buying LimeWire Pro for $1. The cargebacks were a bit painful, but more importantly, if your fraud rate is above some threshold, your fees go up, and at some point our credit card processor gave us 2 months to bring down our fraud rate or they'd cancel our merchant account. The processor also refused to give us fraud information updates with any finer granularity than monthly, so we basically had two tries to bring the fraud rate down. All of the existing CAPTCHA systems I could find required a shared filesystem between the process generating the CAPTCHAs and the process checking the answers. That was a no-go with our policy of minimizing attack surface of our credit card processing host. So, I wrote a CAPTCHA that used HMAC to generate a 96-bit tag from a timestamp (at 1 minute granularity), the user's IPv4/24, and the price. The other 64 bits of SHA1-HMAC output were used to seed the prng that generated the CAPTCHA. The timestamp and 96-bit tag became hidden fields in the HTML purchase form. That way, the credit card processing box could validate the time, IP address, and price, and check the CAPTCHA answer, all from the submitted form data. Answers with timestamps more than 20 minutes old were rejected, so the processing box only needed to remember all of the correct CAPTCHA answers over the past 20 minutes to avoid replay attacks. Making the timestamp 1-minute granularity prevented bots from hammering the system until they got easy CAPTCHAs. The first day we put my CAPTCHA system in production, we saw an IP in Virginia very rapidly trying to make purchases without the CAPTCHA. Then it paused for a few minutes while the attacker figured out what was going on and manually solved one CAPTCHA. Then a rapid-fire batch of purchases came through with the same CAPTCHA answer, and only the first purchase came through. A couple minutes later, that exact same CAPTCHA 96-bit tag and answer came in from a UK IP address, but it was rejected because the 96-bit tag didn't match the HMAC. Those were fun days, but it's a shame incentives are so misaligned.
  • splonk 5y ago
    That's true. The obvious tradeoff is that nobody wants to add friction to account creation, especially when they're first starting out and don't have network effects, and abuse detection is tomorrow's problem. And then if you try to add it afterwards when you've gotten popular you'll be deafened by the screams of everyone who's gotten used to a free experience. Plus, your support load goes way up because all your users are now paying customers. I've heard that it worked for Metafilter but I wouldn't be surprised if it prevents a site from scaling users past a certain point. (I mean, sounds great to me, but probably isn't what someone running something like Reddit wants.)
    • rhizome 5y ago
      Not wanting to "add friction" means you're making it easy for bots, it's as simple as that. Bots don't have bank accounts and the people running bots don't want to be identified via bank information or using up all their stolen CC#s on simple account creation.
  • post-it 5y ago
    This was one of the original use cases for crypto, before the ghouls moved in. You could pay $0.05 to sign up for an account, something that remains impossible to this day due to payment providers' transaction fees.
    • swiftcoder 5y ago
      > something that remains impossible to this day due to payment providers' transaction fees. I wonder if you've looked at the Bitcoin transaction fees for a $0.05 payment lately...
  • 8note 5y ago
    That switches cheap attacks from registration to account take over. Highly profitable attacks, or using stolen credit cards bypasses this protection, since it's either still worth your while, or somebody else is paying
  • technobabbler 5y ago
    Reddit's business model only works because there are people willing to spend their time posting content for free. If they start charging for accounts, even a few cents, they're going to lose a lot of new users. The psychology alone would completely change the site dynamics. Humans are weird.
    • rhizome 5y ago
      It's probably worth it, given the alternative. Depends on the people making the decisions, though.
• dillondoyle 5y ago
  Yup. their ad targeting is context. super basic 'interests' and specific sub reddit placements. I haven't found it to be valuable. I just looked to double check nothing changed since I last bought something and it looks like the have a customer match but only as a holdout/narrow. Which is weird if true? as in can't upload a list and target those users if i'm reading their page correctly pushing their s*t redisign and mobile app on us with more feed ads might mean they are trying to push for 1st party data based targeting though
  • eek2121 5y ago
    I use Apollo on iOS to avoid this nonsense. However, since I do happen to use reddit A LOT, I also pay for a premium subscription. An added perk (above no ads, etc.) of the subscription is you are awarded 500 reddit coins a month, so you can reward others for good content.
    • Forgeties79 5y ago
      The Reddit award system is so flagrantly abused. It needs to be dismantled. People use alts (which still get daily free awards) to convince the folks their comments are “good” or “correct” all the time. I’ve sat in marketing meetings where folks talk about buying awards to push their content. Unlike the vote system there is nothing the admins do to counter this problem.
• deleted 5y ago
  [deleted]
• Forgeties79 5y ago
  >there’s a significant demand for aged accounts I kid you not, I had an offer for $500 to sell my account.
  • splonk 5y ago
    Okay, I guess I didn't mean quite _that_ significant. At that level I'm curious if you have some sort of special high value account (ton of karma, a mod of major subreddits, or have a lot of domain specific reputation), or if that offer is coming from someone who's trying to scam you in some way. Edit: From a sketchy account buying site that I wouldn't trust too much, the price for Reddit accounts runs from ~$3-16 per thousand accounts, depending on age. For comparison, Twitter accounts with 100 followers are ~$4, Instagram accounts with 500 followers are ~$12, Hotmail accounts are ~$100, and GMail accounts are several times that, depending on age and provenance.
    • Forgeties79 5y ago
      This was actually a “legit” site I’d seen before. My account was over a decade with all sort of Reddit gifts awards and mod of a few subs, one of which is over a million people (back when I had the patience to mod subs haha). They also tend to value email verified accounts. They offered $200 and I haggled to $500 then ghosted them just to see how far I could take it for kicks. Definitely didn’t sell it. I don’t drink the Reddit kool-aid but I’d rather not directly contribute to astroturfing for pay.