4 ms·

Short answer: I think companies will act to solve the problems they're experiencing. I added some of my own experience here: https://news.ycombinator.com/item?

Short answer: I think companies will act to solve the problems they're experiencing. I added some of my own experience here: https://news.ycombinator.com/item?id=31252676 https://news.ycombinator.com/item?id=31252676 If an army is attacking your border and somebody walks through them saying, "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Enter from the direction where the attacks aren't coming from and your odds will increase significantly. Ultimately, companies will either adopt a very strict security policy on their own or they will respond to the problems that they are experiencing. If you are a US only company and you start getting malicious traffic from Romania, it's fairly common to just block all of Romania. When you're using tools like Maxmind for network identification, VPNs and Tor are just another traffic source that you can choose to block if it's causing you problems.

nonrandomstring 5y ago
Thanks, good response. What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning enemy/friendly identity and behaviour are lacking. The principle ethical stance is really self-preservation. > "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Nice analogy. I may have to steal that :) Given that we can't rely on identity [1], can we improve analysis and response to behaviour? [1] I see in an earlier response you talk a bit about fingerprinting, and of course anyone serious about privacy will modulate OS and browser FPs without malicious intent.
- brightball 5y ago
  Again, also very situational. For example, at the site where I worked we needed much stricter protection but we didn't want to bother the established users of the site...so we setup trust scores and implemented stricter controls on a sliding scale. The higher your trust score, the less strict we would be with our policies. As a brand new user, your score was a flat 0. You could boost it by verifying a credit card, phone number and address (without using a VPN/Tor). Successful transactions rewarded your score. Transactions with established users are more valuable than transactions with other new users, etc. All the security was virtually invisible to the established users and it worked like a charm. Regarding the fingerprinting, at the time that we were doing this anti-fingerprinting technology barely existed. We had some other tricks in the bag too to fingerprint based on behavior. It was a lot of fun working on that stuff though. Very much a cat and mouse game.

nonrandomstring 5y ago

Thanks, good response. What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning enemy/friendly identity and behaviour are lacking. The principle ethical stance is really self-preservation. > "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Nice analogy. I may have to steal that :) Given that we can't rely on identity [1], can we improve analysis and response to behaviour? [1] I see in an earlier response you talk a bit about fingerprinting, and of course anyone serious about privacy will modulate OS and browser FPs without malicious intent.

brightball 5y ago
Again, also very situational. For example, at the site where I worked we needed much stricter protection but we didn't want to bother the established users of the site...so we setup trust scores and implemented stricter controls on a sliding scale. The higher your trust score, the less strict we would be with our policies. As a brand new user, your score was a flat 0. You could boost it by verifying a credit card, phone number and address (without using a VPN/Tor). Successful transactions rewarded your score. Transactions with established users are more valuable than transactions with other new users, etc. All the security was virtually invisible to the established users and it worked like a charm. Regarding the fingerprinting, at the time that we were doing this anti-fingerprinting technology barely existed. We had some other tricks in the bag too to fingerprint based on behavior. It was a lot of fun working on that stuff though. Very much a cat and mouse game.