4 ms·

Thanks, good response. What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning

Thanks, good response. What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning enemy/friendly identity and behaviour are lacking. The principle ethical stance is really self-preservation. > "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Nice analogy. I may have to steal that :) Given that we can't rely on identity [1], can we improve analysis and response to behaviour? [1] I see in an earlier response you talk a bit about fingerprinting, and of course anyone serious about privacy will modulate OS and browser FPs without malicious intent.

brightball 4y ago
Again, also very situational. For example, at the site where I worked we needed much stricter protection but we didn't want to bother the established users of the site...so we setup trust scores and implemented stricter controls on a sliding scale. The higher your trust score, the less strict we would be with our policies. As a brand new user, your score was a flat 0. You could boost it by verifying a credit card, phone number and address (without using a VPN/Tor). Successful transactions rewarded your score. Transactions with established users are more valuable than transactions with other new users, etc. All the security was virtually invisible to the established users and it worked like a charm. Regarding the fingerprinting, at the time that we were doing this anti-fingerprinting technology barely existed. We had some other tricks in the bag too to fingerprint based on behavior. It was a lot of fun working on that stuff though. Very much a cat and mouse game.