3 ms·

Not specifically picking on you (thanks for replying) but may I rephrase that a little and then ask something; "Sinners look just like saints, so it's necess

Not specifically picking on you (thanks for replying) but may I rephrase that a little and then ask something; "Sinners look just like saints, so it's necessary to punish all, to destroy the riches of the many in order that wicked few do not escape." Is that a fair framing of the "ethics" of what you said? (I'm not attributing that as 'your' argument, I understand you're kinda just trying to 'explain' something as you see it). Do you think this kind of thinking can continue to stand if technology is ever going to be fair and useful to everyone? Or do we just accept that technology always amplifies as least as many problems and injustices as it solves?

qw3rty01 4y ago
No, because you're framing it like they're blocking or challenging every user that comes to their site. Instead, when 90% of your malicious traffic comes from VPNs/TOR, it makes way more sense to just block or challenge those specifically even if it causes an inconvenience on the ones who use those services in a non-malicious way.
- nonrandomstring 4y ago
  Just to be clear I was asking that of the parent poster brightball. I'm trying to map the technical explanations people give onto what may be going on for them at "ethical reasoning" level. You're welcome to add your interpretation of course. You probably guessed I'm looking to distinguish a Bentham from Mill sort of utilitarianism.
- Dylan16807 4y ago
  > block or challenge A reasonable challenge would probably be fine. But so many sites block, or sometimes use obnoxious unfair challenges.
brightball 4y ago
Short answer: I think companies will act to solve the problems they're experiencing. I added some of my own experience here: https://news.ycombinator.com/item?id=31252676 https://news.ycombinator.com/item?id=31252676 If an army is attacking your border and somebody walks through them saying, "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Enter from the direction where the attacks aren't coming from and your odds will increase significantly. Ultimately, companies will either adopt a very strict security policy on their own or they will respond to the problems that they are experiencing. If you are a US only company and you start getting malicious traffic from Romania, it's fairly common to just block all of Romania. When you're using tools like Maxmind for network identification, VPNs and Tor are just another traffic source that you can choose to block if it's causing you problems.
- nonrandomstring 4y ago
  Thanks, good response. What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning enemy/friendly identity and behaviour are lacking. The principle ethical stance is really self-preservation. > "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Nice analogy. I may have to steal that :) Given that we can't rely on identity [1], can we improve analysis and response to behaviour? [1] I see in an earlier response you talk a bit about fingerprinting, and of course anyone serious about privacy will modulate OS and browser FPs without malicious intent.
  - brightball 4y ago
    Again, also very situational. For example, at the site where I worked we needed much stricter protection but we didn't want to bother the established users of the site...so we setup trust scores and implemented stricter controls on a sliding scale. The higher your trust score, the less strict we would be with our policies. As a brand new user, your score was a flat 0. You could boost it by verifying a credit card, phone number and address (without using a VPN/Tor). Successful transactions rewarded your score. Transactions with established users are more valuable than transactions with other new users, etc. All the security was virtually invisible to the established users and it worked like a charm. Regarding the fingerprinting, at the time that we were doing this anti-fingerprinting technology barely existed. We had some other tricks in the bag too to fingerprint based on behavior. It was a lot of fun working on that stuff though. Very much a cat and mouse game.

qw3rty01 4y ago

No, because you're framing it like they're blocking or challenging every user that comes to their site. Instead, when 90% of your malicious traffic comes from VPNs/TOR, it makes way more sense to just block or challenge those specifically even if it causes an inconvenience on the ones who use those services in a non-malicious way.

nonrandomstring 4y ago
Just to be clear I was asking that of the parent poster brightball. I'm trying to map the technical explanations people give onto what may be going on for them at "ethical reasoning" level. You're welcome to add your interpretation of course. You probably guessed I'm looking to distinguish a Bentham from Mill sort of utilitarianism.
Dylan16807 4y ago
> block or challenge A reasonable challenge would probably be fine. But so many sites block, or sometimes use obnoxious unfair challenges.

brightball 4y ago

Short answer: I think companies will act to solve the problems they're experiencing. I added some of my own experience here: https://news.ycombinator.com/item?id=31252676 https://news.ycombinator.com/item?id=31252676 If an army is attacking your border and somebody walks through them saying, "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Enter from the direction where the attacks aren't coming from and your odds will increase significantly. Ultimately, companies will either adopt a very strict security policy on their own or they will respond to the problems that they are experiencing. If you are a US only company and you start getting malicious traffic from Romania, it's fairly common to just block all of Romania. When you're using tools like Maxmind for network identification, VPNs and Tor are just another traffic source that you can choose to block if it's causing you problems.

nonrandomstring 4y ago
Thanks, good response. What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning enemy/friendly identity and behaviour are lacking. The principle ethical stance is really self-preservation. > "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Nice analogy. I may have to steal that :) Given that we can't rely on identity [1], can we improve analysis and response to behaviour? [1] I see in an earlier response you talk a bit about fingerprinting, and of course anyone serious about privacy will modulate OS and browser FPs without malicious intent.
- brightball 4y ago
  Again, also very situational. For example, at the site where I worked we needed much stricter protection but we didn't want to bother the established users of the site...so we setup trust scores and implemented stricter controls on a sliding scale. The higher your trust score, the less strict we would be with our policies. As a brand new user, your score was a flat 0. You could boost it by verifying a credit card, phone number and address (without using a VPN/Tor). Successful transactions rewarded your score. Transactions with established users are more valuable than transactions with other new users, etc. All the security was virtually invisible to the established users and it worked like a charm. Regarding the fingerprinting, at the time that we were doing this anti-fingerprinting technology barely existed. We had some other tricks in the bag too to fingerprint based on behavior. It was a lot of fun working on that stuff though. Very much a cat and mouse game.