3 ms·
Problem isn’t a bot traffic. I run an Ecommerce site and scammers run python scripts to test 1000s of cards per hour if there is no captcha. I hate it, my custo
by cryptoegorophy 2y ago
Problem isn’t a bot traffic. I run an Ecommerce site and scammers run python scripts to test 1000s of cards per hour if there is no captcha. I hate it, my customers hate it, scammers hate it, but it is the only thing that keeps my merchant account running. Any advise is welcome!
- technion 2y agoLogon forms are another whole issue. "Lock out the account" is just a DoS vector. People are quick to talk about systems that can defeat a captcha but if the brute force goes from 50 passwords/sec to one password/10 sec it's mission accomplished.
- LightHugger 2y agoCan't you just put a 5 second "loading bar" delay instead of a captcha then i wonder?
- deleted 2y ago[deleted]
- aja12 2y agoIf you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable
- aja12 2y agoIf you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable
- mike_hearn 2y agoNot easily: if it's enforced client side it may as well not exist, if it's enforced server side you just let anyone lock anyone else out of their account by running a constant brute force attack against their account (a DoS vuln). It also does nothing for attackers who try a giant list of accounts but only one or two passwords for each. I worked on Google's system for solving this. It's a pretty sophisticated analysis that decides whether to demand CAPTCHAs or not based on a lot of factors. The CAPTCHA was needed (at that time) because it's the only way to slow down the attacker without bothering the real user, who won't be shown one.
- account42 2y ago> without bothering the real user, who won't be shown one. bullshit
- mike_hearn 2y agoLots of signals used to prevent people seeing captchas when their passwords were being attacked, but you never see it so never think about it.
- LightHugger 2y agoServerside of course, but i would think the loading bar can be per connection rather than be per account right? Like a connection is attempted, starting the loading bar, and then 5s later you only allow that connection to continue the load? I do non-web dev stuff so maybe i'm missing something but it sounds like should be easy enough.
- mike_hearn 2y agoWhat stops you dropping the connection the moment you realize you're being loading barred.
- LightHugger 2y agoPresumably the point is that the user (or bot) wants to access the content, a connection would have to complete the load successfully to do what they came for. if they just drop it instantly then that's a bot turned away.
- mike_hearn 2y agoBut you don't want to throw an arbitrary five second delay into login for every good user, they hate that sort of thing whereas the bot doesn't care.
- onetokeoverthe 2y agowould requiring a un/pw sent to an email address work?