7 ms·

Do you also look at - or have a chance to look at - timezones as reported by the user's browser, or as selected by the user? One of my services, TweetingMachin

Do you also look at - or have a chance to look at - timezones as reported by the user's browser, or as selected by the user? One of my services, TweetingMachine, used to have a massive problem with spammers going out of their way to abuse it. However, before a user can schedule a tweet, they have to select their timezone. Problem solved! There are three or four specific timezones always chosen by the bad guys, and every ten minutes a script ran through the database banning users whose timezones fell into this list. The surprisingly thing for me was that given the effort of constantly trying to get past my other detection scripts, the spammers either never worked out what was happening, or simply didn't choose a different timezone. In hindsight, it's quite a cute test, and one that it looks like few of the bad guys bother to adjust (i.e. the time their browser reports via JS) or are aware of.

Evbn 14y ago
This is why legitimate Nigerians and Chinese are banned from half the Internet.
- mootothemax 14y ago
  It's not ideal, but past a certain point, as a saas operator you're caught between a rock and a hard place. The best I've been able to come up with is a "do you think this is a mistake" button, which spammers tend to not click. Still not nice to know that I'm treating people like second-class Internet citizens. At the same time, my available time is extremely limited, so lessor or two evils - for me - it is.
  - derleth 14y ago
    > lessor or two evils I'm going to guess this is an autocorrect error.
    - mootothemax 14y ago
      Hehe, thanks, you're right :-)
    - MaysonL 14y ago
      I'm going to guess that it's two autocorrect errors. :-)
  - adgar2 14y ago
    Users on HN complain every single day about service companies like Google who remove content or close accounts that haven't broken any rules. Do you have anything to say to those users, as an operator of a large SaaS provider that deals with fraud/spammers daily?
    - Dylan16807 14y ago
      That's mostly because Google has zero customer support. They rely purely on their automated systems. False positives by themselves are not the issue.
      - adgar2 14y ago
        It sounds like the person I'm asking is doing the exact same thing, but they haven't scaled up to the tens of billions yet. I'm asking how he intends to scale his model.
        mootothemax 14y ago
        I'm asking how he intends to scale his model. Heh, as I alluded to in my reply to your other comment, for TweetingMachine at least, I have zero intent of scaling; tt's a small tool, and will remain a small tool (can't even remember if I've done any work on it in the whole of 2012) whilst I focus my energies elsewhere. So, being quite so harsh was a means to an end. At the same time, if I experience abuse of any of my other services, it'll definitely be a marker I'll use for more manual investigation.
    - brandonb 14y ago
      I think it's really important to have an "appeals process." Many of our customers don't use Sift to block users unilaterally, but rather to ask for further verification. For example, if the Sift score is high, they might call the user to verify their identity. That's a great way to get rid of most of the fraudsters, while giving good users a "way out" for those cases where the algorithms get it wrong.
    - mootothemax 14y ago
- brandonb 14y ago
  That's a huge issue, and it's part of our motivation to use machine learning to combine lots of signals. It's not fair to the legitimate users in Nigeria and other countries to be blocked entirely from booking airline tickets, posting blogs, or booking reservations, but that's the status quo. It's hard to blame the site owners; given the number of attacks, and the difficulty of building a good detection system, it's the best they can do given the time and resources available. Our hope is that by pooling data and technology across all sites on the internet, we can build a better system that keeps the bad users out without causing "collateral damage" and harming perfectly legitimate users. And in response to the grandparent, we absolutely look at timezone! It's a great signal. We've found 3am is the most popular time to create a fake account. But note that creating an account at 3am, all by itself, is not enough to condemn you. It has to be combined with many other behavioral signals.
dougb5 14y ago
(Doug here, also from Sift.) Yes indeed -- timezone, as reported by the client, does factor into our predictions. Our observations definitely resonate with your experience with TweetingMachine -- while fraudsters may be able to appear natural in certain ways, they usually miss a way or two :-) Thanks for the info, mootothemax!
btilly 14y ago
Any test like this will work so long as not everyone is doing it. Once enough companies use that as a filter, the bar will be raised.
duskwuff 14y ago
I used to see this exact same issue (wrong timezone selection) on some phpBB spammers. They all chose GMT-12:00, which contains no permanently inhabited landmasses. Easy block. :)

Evbn 14y ago

This is why legitimate Nigerians and Chinese are banned from half the Internet.

mootothemax 14y ago
It's not ideal, but past a certain point, as a saas operator you're caught between a rock and a hard place. The best I've been able to come up with is a "do you think this is a mistake" button, which spammers tend to not click. Still not nice to know that I'm treating people like second-class Internet citizens. At the same time, my available time is extremely limited, so lessor or two evils - for me - it is.
- derleth 14y ago
  > lessor or two evils I'm going to guess this is an autocorrect error.
  - mootothemax 14y ago
    Hehe, thanks, you're right :-)
  - MaysonL 14y ago
    I'm going to guess that it's two autocorrect errors. :-)
- adgar2 14y ago
  Users on HN complain every single day about service companies like Google who remove content or close accounts that haven't broken any rules. Do you have anything to say to those users, as an operator of a large SaaS provider that deals with fraud/spammers daily?
  - Dylan16807 14y ago
    That's mostly because Google has zero customer support. They rely purely on their automated systems. False positives by themselves are not the issue.
    - adgar2 14y ago
      It sounds like the person I'm asking is doing the exact same thing, but they haven't scaled up to the tens of billions yet. I'm asking how he intends to scale his model.
      - mootothemax 14y ago
        I'm asking how he intends to scale his model. Heh, as I alluded to in my reply to your other comment, for TweetingMachine at least, I have zero intent of scaling; tt's a small tool, and will remain a small tool (can't even remember if I've done any work on it in the whole of 2012) whilst I focus my energies elsewhere. So, being quite so harsh was a means to an end. At the same time, if I experience abuse of any of my other services, it'll definitely be a marker I'll use for more manual investigation.
  - brandonb 14y ago
    I think it's really important to have an "appeals process." Many of our customers don't use Sift to block users unilaterally, but rather to ask for further verification. For example, if the Sift score is high, they might call the user to verify their identity. That's a great way to get rid of most of the fraudsters, while giving good users a "way out" for those cases where the algorithms get it wrong.
  - mootothemax 14y ago
brandonb 14y ago
That's a huge issue, and it's part of our motivation to use machine learning to combine lots of signals. It's not fair to the legitimate users in Nigeria and other countries to be blocked entirely from booking airline tickets, posting blogs, or booking reservations, but that's the status quo. It's hard to blame the site owners; given the number of attacks, and the difficulty of building a good detection system, it's the best they can do given the time and resources available. Our hope is that by pooling data and technology across all sites on the internet, we can build a better system that keeps the bad users out without causing "collateral damage" and harming perfectly legitimate users. And in response to the grandparent, we absolutely look at timezone! It's a great signal. We've found 3am is the most popular time to create a fake account. But note that creating an account at 3am, all by itself, is not enough to condemn you. It has to be combined with many other behavioral signals.

dougb5 14y ago

(Doug here, also from Sift.) Yes indeed -- timezone, as reported by the client, does factor into our predictions. Our observations definitely resonate with your experience with TweetingMachine -- while fraudsters may be able to appear natural in certain ways, they usually miss a way or two :-) Thanks for the info, mootothemax!

btilly 14y ago

Any test like this will work so long as not everyone is doing it. Once enough companies use that as a filter, the bar will be raised.

duskwuff 14y ago

I used to see this exact same issue (wrong timezone selection) on some phpBB spammers. They all chose GMT-12:00, which contains no permanently inhabited landmasses. Easy block. :)