6 ms·

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for sca

Ok, I have no issue with tactics like these when they're wasting spammers' time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers. A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just "can't verify their identity" for some reason. Where you go through a bunch of hoops and captchas, only to have some step fail or reach a dead end. They really seem like they're just set up to intentionally waste people's time. For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. It's a lot more annoying than just saying "you have been locked out of trying to log in for X hours". But this, this is fine. It's pretty clear that the person you're targeting is a spammer, and it's pretty clear to the user after about 60 seconds that you're password system is a joke.

duxup 4y ago
Google had me in an endless no right answers captcha after I left a vpn on one day. Lasted a few hours. I figure someone else on that vpn was doing something wrong and they just blocked anyone from there for a while. Super frustrating that your left to just … to get frustrated.
___8___ 4y ago
I tried to sign up for steam and my long complex password seemed to trigger a never ending stream of captures. Also, just today ticketmaster decided my firefox browser was a bot and blocked me. Fun times.
- ajimix 4y ago
  You are lucky. I haven’t been able to use Ticketmaster for 2 years because all IPs from my ISP are blocked as bots. Contacted their support on Twitter and they told me the only way to use their site is to change my ISP as even the VPNs I tried are blocked. Looks like they have enough money to have the luxury to block one of the biggest ISP where I live
- zerocrates 4y ago
  StubHub was just doing the same thing to me: Firefox and only Firefox was blocked entirely. Figure it was a mistake from some automated security framework type of deal.
bo1024 4y ago
> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.
- stepupmakeup 4y ago
  ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.
  - Bancakes 4y ago
    The worst cpatcha has got to be Rockstar games support. You have to click all the images of rolled dice that sum up to 13, 5 times in a row. Then another 5 for some reason. If you make one mistake, you go back to 0.
  - rudolph9 4y ago
    Would it be “Tor on Google” or “Google on Tor” unless you mean you’re running a Tor node on gcp I would think it would be the latter?
  - q-big 4y ago
    > ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". In such a situation, I often think: isn't the fact that one makes "stupid mistakes" when attempting to solve a ReCaptcha rather a sign that the entity that is attempting to solve it is a human?
    - jjoonathan 4y ago
      I'm sure they build in tolerance and even take advantage of this signal, yes. The result is still far from reliable, though. The smug gaslighting and intentional time wasting after an incorrect identification is the worst.
fjfbsufhdvfy 4y ago
They are indeed set up to waste people's time. Blocking people leads to them searching for ways around your block really quickly. Making them waste time not realizing they have been blocked, such as endless retries or shadow bans, is much more effective at making them stop bothering you for a while longer. Time spent doing this is time they can't spend being malicious on your platform. It's unfortunate when a non-malicious user gets caught in one of these traps...
- tpoacher 4y ago
  "Unfortunate" Sounds like something a film villain would say when asked about collateral damage.
- ImPostingOnHN 4y ago
  it is unfortunate that some people believe those pros outweigh the punishment inflicted on innocent users it is better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one essentially the companies are shifting their own pain (with spammers) onto innocent users ("it's your problem now, suck it users, lol!!!")
  - raverbashing 4y ago
    > better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one Sounds like you never had to actually deal with such a spammer problem yourself
    - dingleberry420 4y ago
      - raverbashing 4y ago
        Yes banning users from a website is exactly like sending them to the gulag, it's exactly that
donkarma 4y ago
steam censors passwords. if you have 88 in your password you will fail to register
- sdoering 4y ago
  I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo
  - null0pointer 4y ago
    I bet for every one neo-nazi they block hundreds of birthdays or Chinese [0]. Just seems overly sensitive to me when you wouldn’t even know a person is a neo-nazi unless they start saying neo-nazi shit. Saying neo-nazi shit is in itself grounds for a ban so why block the number 88 at all? How could anyone possibly be offended by the number 88 alone? 0: https://en.wikipedia.org/wiki/Chinese_numerology#Eight https://en.wikipedia.org/wiki/Chinese_numerology#Eight
    - deleted 4y ago
      [deleted]
  - fieryskiff11 4y ago
  - coffeeblack 4y ago
    88 is a lucky number in China and many Asian countries. Maybe time to claim “cultural insensivity” or something? Also, steam should never even see the password, they should only ever see the hash.
    - vanviegen 4y ago
      > Also, steam should never even see the password, they should only ever see the hash. Sites/apps will generally handle your plaintext password each time you login or set your password. They (hopefully) just don't store it.
artificialLimbs 4y ago
Verizon’s site times out your login after like 2 minutes. Just trying to manage my account on the site is a nightmare, and I’m on fiber.

duxup 4y ago

Google had me in an endless no right answers captcha after I left a vpn on one day. Lasted a few hours. I figure someone else on that vpn was doing something wrong and they just blocked anyone from there for a while. Super frustrating that your left to just … to get frustrated.

___8___ 4y ago

I tried to sign up for steam and my long complex password seemed to trigger a never ending stream of captures. Also, just today ticketmaster decided my firefox browser was a bot and blocked me. Fun times.

ajimix 4y ago
You are lucky. I haven’t been able to use Ticketmaster for 2 years because all IPs from my ISP are blocked as bots. Contacted their support on Twitter and they told me the only way to use their site is to change my ISP as even the VPNs I tried are blocked. Looks like they have enough money to have the luxury to block one of the biggest ISP where I live
zerocrates 4y ago
StubHub was just doing the same thing to me: Firefox and only Firefox was blocked entirely. Figure it was a mistake from some automated security framework type of deal.

bo1024 4y ago

> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.

stepupmakeup 4y ago
ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.
- Bancakes 4y ago
  The worst cpatcha has got to be Rockstar games support. You have to click all the images of rolled dice that sum up to 13, 5 times in a row. Then another 5 for some reason. If you make one mistake, you go back to 0.
- rudolph9 4y ago
  Would it be “Tor on Google” or “Google on Tor” unless you mean you’re running a Tor node on gcp I would think it would be the latter?
- q-big 4y ago
  > ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". In such a situation, I often think: isn't the fact that one makes "stupid mistakes" when attempting to solve a ReCaptcha rather a sign that the entity that is attempting to solve it is a human?
  - jjoonathan 4y ago
    I'm sure they build in tolerance and even take advantage of this signal, yes. The result is still far from reliable, though. The smug gaslighting and intentional time wasting after an incorrect identification is the worst.

fjfbsufhdvfy 4y ago

They are indeed set up to waste people's time. Blocking people leads to them searching for ways around your block really quickly. Making them waste time not realizing they have been blocked, such as endless retries or shadow bans, is much more effective at making them stop bothering you for a while longer. Time spent doing this is time they can't spend being malicious on your platform. It's unfortunate when a non-malicious user gets caught in one of these traps...

tpoacher 4y ago
"Unfortunate" Sounds like something a film villain would say when asked about collateral damage.
ImPostingOnHN 4y ago
it is unfortunate that some people believe those pros outweigh the punishment inflicted on innocent users it is better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one essentially the companies are shifting their own pain (with spammers) onto innocent users ("it's your problem now, suck it users, lol!!!")
- raverbashing 4y ago
  > better a thousand criminals/ spammers go free than a single innocent non-spammer be treated as if they are one Sounds like you never had to actually deal with such a spammer problem yourself
  - dingleberry420 4y ago
    - raverbashing 4y ago
      Yes banning users from a website is exactly like sending them to the gulag, it's exactly that

donkarma 4y ago

steam censors passwords. if you have 88 in your password you will fail to register

sdoering 4y ago
I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo
- null0pointer 4y ago
  I bet for every one neo-nazi they block hundreds of birthdays or Chinese [0]. Just seems overly sensitive to me when you wouldn’t even know a person is a neo-nazi unless they start saying neo-nazi shit. Saying neo-nazi shit is in itself grounds for a ban so why block the number 88 at all? How could anyone possibly be offended by the number 88 alone? 0: https://en.wikipedia.org/wiki/Chinese_numerology#Eight https://en.wikipedia.org/wiki/Chinese_numerology#Eight
  - deleted 4y ago
    [deleted]
- fieryskiff11 4y ago
- coffeeblack 4y ago
  88 is a lucky number in China and many Asian countries. Maybe time to claim “cultural insensivity” or something? Also, steam should never even see the password, they should only ever see the hash.
  - vanviegen 4y ago
    > Also, steam should never even see the password, they should only ever see the hash. Sites/apps will generally handle your plaintext password each time you login or set your password. They (hopefully) just don't store it.

artificialLimbs 4y ago

Verizon’s site times out your login after like 2 minutes. Just trying to manage my account on the site is a nightmare, and I’m on fiber.