5 ms·

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject login

For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs/bots in order to try to login, allowing our system to flag them all. We'll manually review all accounts that use (more than one of) those ip addresses. Works like a charm! :-)

Chilinot 4y ago
That's a really smart idea!
efitz 4y ago
That is truly evil. I love it!
numlock86 4y ago
[flagged]
- Nextgrid 4y ago
  Legitimate interest would totally cover you here. The fear-mongering and misinformation about the GDPR is getting really annoying by now.
  - numlock86 4y ago
    > The "legitimate interest" GDPR strawman In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly over as it seems.
    - ivanhoe 4y ago
      any links/info on this 4 cases so that we can learn more about the subject?
    - brightball 4y ago
      People can claim it all day long but it was determined that IP addresses are only PII in the hands of an entity who can actually associate it with a person, like an ISP. https://www.jdsupra.com/legalnews/court-confirms-that-ip-addresses-are-35566/ https://www.jdsupra.com/legalnews/court-confirms-that-ip-add...
      - numlock86 4y ago
        Yes, you are right. No way for a dating site for example (as stated by the original comment) to make a relation between an IP address and the person behind it. It's all fake profiles or some other strawman argument anyway, right? Like who uses his real name, address or even picture for something like that?! That'd be just ridiculous ...
        marcinzm 4y ago
        ...you're assuming they're keeping the IP linked to a specific profile and then making a strawman argument based on that assumption.
        0xFF0123 4y ago
        It sounds like that's what they're doing, in order to find other spam accounts: > We'll manually review all accounts that use (more than one of) those ip addresses.
        brightball 4y ago
        Review is the key. They're using it as an indicator of bad behavior to provide direction where other bad behavior may be. The IP didn't identify the person, but it did potentially implicate accounts that needed to be reviewed or that may have been compromised.
  - vanviegen 4y ago
    Indeed. Dating sites have a legitimate (and I'd say moral) need to protect their customers from all kinds of nasty business. If the only way to do that is through the use of PII, and that use is well-documented in the privacy statement, and the data is not being used for unrelated purposes, this should be well within the bounds of GDPR.
- jabroni_salad 4y ago
  You can just anonymize stuff, right? dbo.naughty_ips does not need to be linked to any real people and I do not need to keep records of why any IP address got placed on that table.
mrtksn 4y ago
> when we manually verified an account to be a scammer This makes all the difference with other services that block out users only to let them guess why they were blocked. If an automated system did that, I would have said it's evil. Yet, I hope you have a communication channel in case there was a human error.
- jjoonathan 4y ago
  Yes, although I would add an attention threshold too, as it's not entirely unknown for hired manual review to just spam the "guilty" button so they can get to lunch. In any case: your false positive rate needs to be massively low if you want to be a massive asshole to the people it flags -- or else you are just an asshole. If you can afford to get the FPR down, sure, have fun, but if not, please have the decency to not pretend.
  - leshenka 4y ago
    You can implement a jury trial system - have a pool of moderators, select a few at random and have them look at the account, only flagging it if there is a consensus that it’s a scam account
    - SQueeeeeL 4y ago
      That scale doesn't really work for small startups
- vanviegen 4y ago
  Admittedly, there is the occasional false positive. For such cases, we display an email address right underneath the error message. Scammers rarely dare to complain, and when they do, they are usually not very convincing.
  - jjoonathan 4y ago
    These humane touches make all the difference. Thanks for taking the time.
brightball 4y ago
That is genius
bradknowles 4y ago
So, the problem I see here is when spammers abuse someone else's machine to conduct activity like this, and all those random people get their IP addresses blocked by your system. And how would the legitimate owner of that IP address ever know how to contact you to get removed from your blacklist?
- vanviegen 4y ago
  No, the IP addresses won't be blocked, but the accounts will be reviewed. Legitimate users would be able to contact us using the email address that is shown right underneath the error message.

Chilinot 4y ago

That's a really smart idea!

efitz 4y ago

That is truly evil. I love it!

numlock86 4y ago

[flagged]

Nextgrid 4y ago
Legitimate interest would totally cover you here. The fear-mongering and misinformation about the GDPR is getting really annoying by now.
- numlock86 4y ago
  > The "legitimate interest" GDPR strawman In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly over as it seems.
  - ivanhoe 4y ago
    any links/info on this 4 cases so that we can learn more about the subject?
  - brightball 4y ago
    People can claim it all day long but it was determined that IP addresses are only PII in the hands of an entity who can actually associate it with a person, like an ISP. https://www.jdsupra.com/legalnews/court-confirms-that-ip-addresses-are-35566/ https://www.jdsupra.com/legalnews/court-confirms-that-ip-add...
    - numlock86 4y ago
      Yes, you are right. No way for a dating site for example (as stated by the original comment) to make a relation between an IP address and the person behind it. It's all fake profiles or some other strawman argument anyway, right? Like who uses his real name, address or even picture for something like that?! That'd be just ridiculous ...
      - marcinzm 4y ago
        ...you're assuming they're keeping the IP linked to a specific profile and then making a strawman argument based on that assumption.
        0xFF0123 4y ago
        It sounds like that's what they're doing, in order to find other spam accounts: > We'll manually review all accounts that use (more than one of) those ip addresses.
        brightball 4y ago
        Review is the key. They're using it as an indicator of bad behavior to provide direction where other bad behavior may be. The IP didn't identify the person, but it did potentially implicate accounts that needed to be reviewed or that may have been compromised.
- vanviegen 4y ago
  Indeed. Dating sites have a legitimate (and I'd say moral) need to protect their customers from all kinds of nasty business. If the only way to do that is through the use of PII, and that use is well-documented in the privacy statement, and the data is not being used for unrelated purposes, this should be well within the bounds of GDPR.
jabroni_salad 4y ago
You can just anonymize stuff, right? dbo.naughty_ips does not need to be linked to any real people and I do not need to keep records of why any IP address got placed on that table.

mrtksn 4y ago

> when we manually verified an account to be a scammer This makes all the difference with other services that block out users only to let them guess why they were blocked. If an automated system did that, I would have said it's evil. Yet, I hope you have a communication channel in case there was a human error.

jjoonathan 4y ago
Yes, although I would add an attention threshold too, as it's not entirely unknown for hired manual review to just spam the "guilty" button so they can get to lunch. In any case: your false positive rate needs to be massively low if you want to be a massive asshole to the people it flags -- or else you are just an asshole. If you can afford to get the FPR down, sure, have fun, but if not, please have the decency to not pretend.
- leshenka 4y ago
  You can implement a jury trial system - have a pool of moderators, select a few at random and have them look at the account, only flagging it if there is a consensus that it’s a scam account
  - SQueeeeeL 4y ago
    That scale doesn't really work for small startups
vanviegen 4y ago
Admittedly, there is the occasional false positive. For such cases, we display an email address right underneath the error message. Scammers rarely dare to complain, and when they do, they are usually not very convincing.
- jjoonathan 4y ago
  These humane touches make all the difference. Thanks for taking the time.

brightball 4y ago

That is genius

bradknowles 4y ago

So, the problem I see here is when spammers abuse someone else's machine to conduct activity like this, and all those random people get their IP addresses blocked by your system. And how would the legitimate owner of that IP address ever know how to contact you to get removed from your blacklist?

vanviegen 4y ago
No, the IP addresses won't be blocked, but the accounts will be reviewed. Legitimate users would be able to contact us using the email address that is shown right underneath the error message.