11 ms·

I'm under the impression that there's one thing that works almost 100%: nominal payment for account creation. A few bucks. Or more, if you also want it to help

I'm under the impression that there's one thing that works almost 100%: nominal payment for account creation. A few bucks. Or more, if you also want it to help run the site. Bonus for the latter case is that you're also helping to protect your users from advertisers running a train on their browsers.

ajsnigrutin 5y ago
Yeah... this makes you lose all your privacy, and exclude all the people in the world who either don't have a credit card, or don't want to use one. Thank you, but no.
- rhizome 5y ago
  That's a separate problem. The topic is about running a site that crawls up your browser's ass as far as possible.
  - ajsnigrutin 5y ago
    This is assuming, that they wont profile/fingerprint you, if you pay. Surely no service like that would ever double dip
    - rhizome 5y ago
      It's still a separate problem.
- Nextgrid 5y ago
  > this makes you lose all your privacy The alternative (advertising) is not better. > exclude all the people in the world who either don't have a credit card, or don't want to use one. Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills.
  - ihateolives 5y ago
    >> this makes you lose all your privacy > The alternative (advertising) is not better. Umm, adblockers, tor and whatnot can help with ads tracking and but you can't take back your privacy once you've given identifying information. >> exclude all the people in the world who either don't have a credit card, or don't want to use one. > Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills. You have no idea how extremely white this part of the internet is that we're currently on. Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality.
    - Nextgrid 5y ago
      > adblockers, tor and whatnot can help with ads tracking Ad-blockers only work as long as there's a majority who does not use them. If everyone uses ad-blockers, the system collapses. Furthermore, ad-blockers encourage a game of cat & mouse where both the provider and the consumer are constantly at odds, with nasty side-effects like alternative clients being forbidden, etc. > you can't take back your privacy once you've given identifying information. My argument is that you should be able to give identifying information without it being abused for nefarious purposes. > You have no idea how extremely white this part of the internet is that we're currently on Oh come on, there was no need to bring race into this. But hey, if that's your argument, I'd say that having a bunch of white tech-bros in the ad & social media industry control the entire communications infrastructure and social fabric of "non-white" (to use your words) nations is not better. > Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality. Do you really think that ad-supported platforms just offer service to the credit-card-less third-world for free? No, they do so because there are advertisers who are happy to pay, and those advertisers in turn know how to get their money back (and more than that) from those people without credit cards.
- klabb3 5y ago
  Definitely not intending to shill crypto (on HN of all places), but it seems like a good (as good as it gets, possibly) use case for anonymous – zero-knowledge – cryptocurrency transactions.
  - gpm 5y ago
    Now you've just raised the barrier to entry even higher for normal people, and lowered the barrier to entry even lower for cybercriminals with crypto that they would need to launder if they were going to attach it to an actual identity. I doubt this is a win.
    - heavyset_go 5y ago
      It's important to recognize that there's a glut of cryptocurrency collected from illegal transactions, and that money needs to be laundered if the holders want to liquidate it. It would be dumb to go to exchanges, so they need to rely on shady groups to cash out, ensuring that there's a lot of cryptocurrency in the hands of questionable people or organizations.
    - klabb3 5y ago
      > Now you've just raised the barrier to entry even higher for normal people How so?
      - gpm 5y ago
        They have to figure out how to use a new (to them) payment system...
        klabb3 5y ago
        Oh, I misread as the barrier of entry to crypto. My bad. On topic, you could just have multiple payment methods side by side.
  - heavyset_go 5y ago
    It seems like the anonymizing cryptocurrencies get blackballed by exchanges, meaning most people won't have access to them. Coinbase, for example, only allows transfers of Zcash to transparent addresses, which can be traced, and buying Monero isn't possible.
dylan604 5y ago
If someone is running a bot farm to do malicious things, they are probably the same types to have a list of acquired card numbers as well. Using a site like this would allow for users to be created while validating a new acquired list of card numbers. A black hat's wet dream of a site.
- rhizome 5y ago
  So? Make them use those card#s, a limited asset, and put the banks to work protecting those interests instead of leaving all the load for us.
  - getcrunk 5y ago
    If only the banks cared
  - dylan604 5y ago
    If you are accepting credit cards, you are liable for the charge backs that occur. If you are only nominally charging <$1 for accounts, then maybe fraudulent charges wouldn't be noticed by the card holder as it wouldn't noticeably alter the balance on a quick glance. However, if you do get a lot of people challenging these charges, then the site owner can pottentially lose their privileages with which ever card processor they are using regardless of the values of those charges. Eventually, the site owners won't want to deal with that either. So, who's court do we put the ball in now?
    - KMag 5y ago
      Yea, the incentives in the wrong place for credit card processors. They actually charge credit processing fees for fraudulent purchases, and then get to charge processing fees again for the chargeback when the fraud is discovered, even though the merchant sends all the info they have to the processor and the processor okays the transaction. The credit card processors have the most information, but the least incentive to fight fraud. At LimeWire, for a while, the price for LimeWire Pro was a hidden field in the order form, because the CTO (rightly) wanted to minimize the amount of logic running on anything that touched credit cards. The form was generated on one host and posted to another, and the logic for experimenting with lower prices at certain times, etc. was kept off of the host that processed credit cards. As a result, some more technical users could order LimeWire Pro for $1. But, they could also find LimeWire Pro using the free version, so no real loss there. However, some carding gangs also noticed, and would validate huge batches of credit card numbers by buying LimeWire Pro for $1. The cargebacks were a bit painful, but more importantly, if your fraud rate is above some threshold, your fees go up, and at some point our credit card processor gave us 2 months to bring down our fraud rate or they'd cancel our merchant account. The processor also refused to give us fraud information updates with any finer granularity than monthly, so we basically had two tries to bring the fraud rate down. All of the existing CAPTCHA systems I could find required a shared filesystem between the process generating the CAPTCHAs and the process checking the answers. That was a no-go with our policy of minimizing attack surface of our credit card processing host. So, I wrote a CAPTCHA that used HMAC to generate a 96-bit tag from a timestamp (at 1 minute granularity), the user's IPv4/24, and the price. The other 64 bits of SHA1-HMAC output were used to seed the prng that generated the CAPTCHA. The timestamp and 96-bit tag became hidden fields in the HTML purchase form. That way, the credit card processing box could validate the time, IP address, and price, and check the CAPTCHA answer, all from the submitted form data. Answers with timestamps more than 20 minutes old were rejected, so the processing box only needed to remember all of the correct CAPTCHA answers over the past 20 minutes to avoid replay attacks. Making the timestamp 1-minute granularity prevented bots from hammering the system until they got easy CAPTCHAs. The first day we put my CAPTCHA system in production, we saw an IP in Virginia very rapidly trying to make purchases without the CAPTCHA. Then it paused for a few minutes while the attacker figured out what was going on and manually solved one CAPTCHA. Then a rapid-fire batch of purchases came through with the same CAPTCHA answer, and only the first purchase came through. A couple minutes later, that exact same CAPTCHA 96-bit tag and answer came in from a UK IP address, but it was rejected because the 96-bit tag didn't match the HMAC. Those were fun days, but it's a shame incentives are so misaligned.
splonk 5y ago
That's true. The obvious tradeoff is that nobody wants to add friction to account creation, especially when they're first starting out and don't have network effects, and abuse detection is tomorrow's problem. And then if you try to add it afterwards when you've gotten popular you'll be deafened by the screams of everyone who's gotten used to a free experience. Plus, your support load goes way up because all your users are now paying customers. I've heard that it worked for Metafilter but I wouldn't be surprised if it prevents a site from scaling users past a certain point. (I mean, sounds great to me, but probably isn't what someone running something like Reddit wants.)
- rhizome 5y ago
  Not wanting to "add friction" means you're making it easy for bots, it's as simple as that. Bots don't have bank accounts and the people running bots don't want to be identified via bank information or using up all their stolen CC#s on simple account creation.
post-it 5y ago
This was one of the original use cases for crypto, before the ghouls moved in. You could pay $0.05 to sign up for an account, something that remains impossible to this day due to payment providers' transaction fees.
- swiftcoder 5y ago
  > something that remains impossible to this day due to payment providers' transaction fees. I wonder if you've looked at the Bitcoin transaction fees for a $0.05 payment lately...
8note 5y ago
That switches cheap attacks from registration to account take over. Highly profitable attacks, or using stolen credit cards bypasses this protection, since it's either still worth your while, or somebody else is paying
technobabbler 5y ago
Reddit's business model only works because there are people willing to spend their time posting content for free. If they start charging for accounts, even a few cents, they're going to lose a lot of new users. The psychology alone would completely change the site dynamics. Humans are weird.
- rhizome 5y ago
  It's probably worth it, given the alternative. Depends on the people making the decisions, though.

ajsnigrutin 5y ago

Yeah... this makes you lose all your privacy, and exclude all the people in the world who either don't have a credit card, or don't want to use one. Thank you, but no.

rhizome 5y ago
That's a separate problem. The topic is about running a site that crawls up your browser's ass as far as possible.
- ajsnigrutin 5y ago
  This is assuming, that they wont profile/fingerprint you, if you pay. Surely no service like that would ever double dip
  - rhizome 5y ago
    It's still a separate problem.
Nextgrid 5y ago
> this makes you lose all your privacy The alternative (advertising) is not better. > exclude all the people in the world who either don't have a credit card, or don't want to use one. Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills.
- ihateolives 5y ago
  >> this makes you lose all your privacy > The alternative (advertising) is not better. Umm, adblockers, tor and whatnot can help with ads tracking and but you can't take back your privacy once you've given identifying information. >> exclude all the people in the world who either don't have a credit card, or don't want to use one. > Advertising also excludes everyone except a tiny minority (the advertisers) who are allowed to call the shots because they’re paying the bills. You have no idea how extremely white this part of the internet is that we're currently on. Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality.
  - Nextgrid 5y ago
    > adblockers, tor and whatnot can help with ads tracking Ad-blockers only work as long as there's a majority who does not use them. If everyone uses ad-blockers, the system collapses. Furthermore, ad-blockers encourage a game of cat & mouse where both the provider and the consumer are constantly at odds, with nasty side-effects like alternative clients being forbidden, etc. > you can't take back your privacy once you've given identifying information. My argument is that you should be able to give identifying information without it being abused for nefarious purposes. > You have no idea how extremely white this part of the internet is that we're currently on Oh come on, there was no need to bring race into this. But hey, if that's your argument, I'd say that having a bunch of white tech-bros in the ad & social media industry control the entire communications infrastructure and social fabric of "non-white" (to use your words) nations is not better. > Comparing not having credit card to having ads in your browser is ridiculously out of touch with reality. Do you really think that ad-supported platforms just offer service to the credit-card-less third-world for free? No, they do so because there are advertisers who are happy to pay, and those advertisers in turn know how to get their money back (and more than that) from those people without credit cards.
klabb3 5y ago
Definitely not intending to shill crypto (on HN of all places), but it seems like a good (as good as it gets, possibly) use case for anonymous – zero-knowledge – cryptocurrency transactions.
- gpm 5y ago
  Now you've just raised the barrier to entry even higher for normal people, and lowered the barrier to entry even lower for cybercriminals with crypto that they would need to launder if they were going to attach it to an actual identity. I doubt this is a win.
  - heavyset_go 5y ago
    It's important to recognize that there's a glut of cryptocurrency collected from illegal transactions, and that money needs to be laundered if the holders want to liquidate it. It would be dumb to go to exchanges, so they need to rely on shady groups to cash out, ensuring that there's a lot of cryptocurrency in the hands of questionable people or organizations.
  - klabb3 5y ago
    > Now you've just raised the barrier to entry even higher for normal people How so?
    - gpm 5y ago
      They have to figure out how to use a new (to them) payment system...
      - klabb3 5y ago
        Oh, I misread as the barrier of entry to crypto. My bad. On topic, you could just have multiple payment methods side by side.
- heavyset_go 5y ago
  It seems like the anonymizing cryptocurrencies get blackballed by exchanges, meaning most people won't have access to them. Coinbase, for example, only allows transfers of Zcash to transparent addresses, which can be traced, and buying Monero isn't possible.

dylan604 5y ago

If someone is running a bot farm to do malicious things, they are probably the same types to have a list of acquired card numbers as well. Using a site like this would allow for users to be created while validating a new acquired list of card numbers. A black hat's wet dream of a site.

rhizome 5y ago
So? Make them use those card#s, a limited asset, and put the banks to work protecting those interests instead of leaving all the load for us.
- getcrunk 5y ago
  If only the banks cared
- dylan604 5y ago
  If you are accepting credit cards, you are liable for the charge backs that occur. If you are only nominally charging <$1 for accounts, then maybe fraudulent charges wouldn't be noticed by the card holder as it wouldn't noticeably alter the balance on a quick glance. However, if you do get a lot of people challenging these charges, then the site owner can pottentially lose their privileages with which ever card processor they are using regardless of the values of those charges. Eventually, the site owners won't want to deal with that either. So, who's court do we put the ball in now?
  - KMag 5y ago
    Yea, the incentives in the wrong place for credit card processors. They actually charge credit processing fees for fraudulent purchases, and then get to charge processing fees again for the chargeback when the fraud is discovered, even though the merchant sends all the info they have to the processor and the processor okays the transaction. The credit card processors have the most information, but the least incentive to fight fraud. At LimeWire, for a while, the price for LimeWire Pro was a hidden field in the order form, because the CTO (rightly) wanted to minimize the amount of logic running on anything that touched credit cards. The form was generated on one host and posted to another, and the logic for experimenting with lower prices at certain times, etc. was kept off of the host that processed credit cards. As a result, some more technical users could order LimeWire Pro for $1. But, they could also find LimeWire Pro using the free version, so no real loss there. However, some carding gangs also noticed, and would validate huge batches of credit card numbers by buying LimeWire Pro for $1. The cargebacks were a bit painful, but more importantly, if your fraud rate is above some threshold, your fees go up, and at some point our credit card processor gave us 2 months to bring down our fraud rate or they'd cancel our merchant account. The processor also refused to give us fraud information updates with any finer granularity than monthly, so we basically had two tries to bring the fraud rate down. All of the existing CAPTCHA systems I could find required a shared filesystem between the process generating the CAPTCHAs and the process checking the answers. That was a no-go with our policy of minimizing attack surface of our credit card processing host. So, I wrote a CAPTCHA that used HMAC to generate a 96-bit tag from a timestamp (at 1 minute granularity), the user's IPv4/24, and the price. The other 64 bits of SHA1-HMAC output were used to seed the prng that generated the CAPTCHA. The timestamp and 96-bit tag became hidden fields in the HTML purchase form. That way, the credit card processing box could validate the time, IP address, and price, and check the CAPTCHA answer, all from the submitted form data. Answers with timestamps more than 20 minutes old were rejected, so the processing box only needed to remember all of the correct CAPTCHA answers over the past 20 minutes to avoid replay attacks. Making the timestamp 1-minute granularity prevented bots from hammering the system until they got easy CAPTCHAs. The first day we put my CAPTCHA system in production, we saw an IP in Virginia very rapidly trying to make purchases without the CAPTCHA. Then it paused for a few minutes while the attacker figured out what was going on and manually solved one CAPTCHA. Then a rapid-fire batch of purchases came through with the same CAPTCHA answer, and only the first purchase came through. A couple minutes later, that exact same CAPTCHA 96-bit tag and answer came in from a UK IP address, but it was rejected because the 96-bit tag didn't match the HMAC. Those were fun days, but it's a shame incentives are so misaligned.

splonk 5y ago

That's true. The obvious tradeoff is that nobody wants to add friction to account creation, especially when they're first starting out and don't have network effects, and abuse detection is tomorrow's problem. And then if you try to add it afterwards when you've gotten popular you'll be deafened by the screams of everyone who's gotten used to a free experience. Plus, your support load goes way up because all your users are now paying customers. I've heard that it worked for Metafilter but I wouldn't be surprised if it prevents a site from scaling users past a certain point. (I mean, sounds great to me, but probably isn't what someone running something like Reddit wants.)

rhizome 5y ago
Not wanting to "add friction" means you're making it easy for bots, it's as simple as that. Bots don't have bank accounts and the people running bots don't want to be identified via bank information or using up all their stolen CC#s on simple account creation.

post-it 5y ago

This was one of the original use cases for crypto, before the ghouls moved in. You could pay $0.05 to sign up for an account, something that remains impossible to this day due to payment providers' transaction fees.

swiftcoder 5y ago
> something that remains impossible to this day due to payment providers' transaction fees. I wonder if you've looked at the Bitcoin transaction fees for a $0.05 payment lately...

8note 5y ago

That switches cheap attacks from registration to account take over. Highly profitable attacks, or using stolen credit cards bypasses this protection, since it's either still worth your while, or somebody else is paying

technobabbler 5y ago

Reddit's business model only works because there are people willing to spend their time posting content for free. If they start charging for accounts, even a few cents, they're going to lose a lot of new users. The psychology alone would completely change the site dynamics. Humans are weird.

rhizome 5y ago
It's probably worth it, given the alternative. Depends on the people making the decisions, though.