4 ms·

FT.com sues company for sharing single subscription account

13 points by whyleyc 18y ago

whyleyc 18y ago
I'm interested to know if HN can think of a technical solution to this problem ? (one that must be common to many sites). It seems you could filter access based on IP address but that could be problematic if users were all coming out of the same company network.
- inerte 18y ago
  It can't be solved without additional software (like a browser plugin). The best you can do is logout the previous computer where an account was used. That means you can prevent simultaneous access but not multiple people using the same account on different times. That's the problem with the stateless part of HTTP. The server doesn't know much about the connection with the client. Once a document is delivered, it's done. And like you said, filtering by IP doesn't work. What if the costumer is using a desktop PC, 5 minutes later his laptop, a mobile in the afternoon? What if his OS crashes? So many problems. And that's the stateless nature... the server can't send to the client an "are you there?" message.
  - Retric 18y ago
    You can use Javascript to keep pinging the server and then log people out if someone else logs into that act. Granted several people can still use the same act, but the annoyance is going to prompt them to want to get a full subscription. On the plus side the psychological push of "I want this data if only we had another act" would increase peoples perception of value. Edit: I am suggesting you let people use the service like this. Tell them your logging them out because someone else logged in but don't ban the account even if they do this 10 times a day. PS: I would also make it vary permissive so if the network is down they can still read the information etc. The idea is to promote your brand though exclusivity not annoy your users.
- ryanwaggoner 18y ago
  I wonder if you could develop behavioral tracking software that would flag accounts that exhibited symptoms of being used by multiple people, based on click patterns, reading habits, etc.
- Angostura 18y ago
  Weerl, off the top of my head, I suppose you could replace password with a 'something you know' challenge. Ask for 5 personal pieces of information (name of your first love, first school, etc.) then challenge for one of them at log-in. I suspect people would be less succeptable to share 5 pieces of such information with their colleagues, than a single password.
  - whyleyc 18y ago
    Especially if it was personal stuff ...
  - RiderOfGiraffes 18y ago
    They could just invent generic answers, and then share those.
  - jerf 18y ago
    So, your belief is that you can deter cheaters by forcing them to truthfully divulge personal information, which they then won't want to share? Guess which word is going to cause a problem.
- buro9 18y ago
  I worked on a premium rate video site (sport, not porn) and developed some scheduled tasks for detecting sharing of logins. Our scenario was based around users sharing details on forums and over MSN or IRC. It was simple enough to log every login, and at the time of login collect basic identifiers which on their own are relatively useless identifiers (think one bit of DNA), but added up become quite effective identifiers (think 30 bits of DNA). We would then query the login against the number of login fingerprints spread across the day (were they really awake 24/7?) and across the globe (could they be in NYC and London at the same time?) and other such questions. We ignored a reasonably high rate of abuse (one person could share the details a few times) and only approached the accounts that were significantly compromised. To those that were compromised, the password would be automatically reset and emailed to the registered account holder letting them know that we feared their user credentials had been compromised and should it be compromised multiple times we would view this a risk to the content and would close the account. Note we did not accuse them, it's not good to do that to your customers. One thing we didn't do, but which was debated, was to publish under the account login, the details of the account. Basically it was suggested that by putting the personal details of the registered user in with the account, they wouldn't want to share them... i.e address, phone number, part of the credit card number... all under the payment details page and quite obvious from the header. Yes it was designed, but no it never got launched. Anyhow... detection and a way of handling it was both trivial and effective.
  - bestes 18y ago
    Sounds like a nice solution. It does not sound trivial to me, though. Do you have any code to share or other pointers?Especially around the 'tuning' of this system (like, how many hours was too many, how much distance was OK, etc.)
    - buro9 18y ago
      It was trivial to collect the information. First you start with what the server knows, and log each data point. Then what can JavaScript tell us? Log each data point. What can common plugins tell us? Windows Media player has a UID cookie, call it twice from different IP's and see if we get the same number back. Flash could tell us a bit more too. Then there are the geospatial properties, where, when? Log those. We logged everything we could, and then pushed them over to an MIS layer. The MIS layer included views that ranked all users according to various basic criteria (number of hours when login has been performed per day, total amount of time spent on the system (windows media log files), number of unique machines used to access content). With those views the business could then use existing reporting tools to tweak the criteria or investigate a more severe anomaly in a set of data points. The result reports went back into the system and became the new benchmark for the next set of scheduled de-activations or emails. This way the computers could be left to do it 99% of the time, and people could come in and tweak it visually for the 1% of the time. We were purposefully tolerant of the issue as it is better to let a few people through and gain that marketing and audience than it was to have false positives and the bad marketing on the sport team forums. I can't share the various bits of code I'm afraid, it's a while ago and belongs to my employer at the time, though the technique I've outlined above.
- run4yourlives 18y ago
  You solve people problems with people, not technology.
  - whyleyc 18y ago
    Agreed. People who are using technology creatively.
    - run4yourlives 18y ago
      Not really. People who see technology as one tool in a toolbox full of tools. When all you have is a hammer, and all that...
- sgk284 18y ago
  Require a credit card and display said information (anonymized to an extent) on the landing page after they log in. People will be very unlikely to purposefully give their credentials to your site to the public. This would work at companies too, because most companies would rather not have all of their employees see this information (it'd be more effective if you didn't anonymize any data... but the security implications could be too great, that's a choice for you too make though). It basically comes down to the fact that most people don't mind taking advantage of a business, until it means that they can be taken advantage too. As harsh as it sounds, the most direct solution is to simply make them put themselves at risk of being taken advantage of if they take advantage of you.
- likpok 18y ago
  Bloomberg uses biometric authentication in their terminals, which makes it fairly difficult to easily share credentials. However, they control the hardware in that case, which is not possible for most places.
josefresco 18y ago
Why are they suing? Can't they just kill the account, or block the other users?
- whyleyc 18y ago
  I think it's a shot across the bows of any other companies thinking of doing likewise (which would be a direct hit on FT revenue).
lionhearted 18y ago
"Full subscribers pay £199 per year" is $285 USD at current market rates, a bit higher based on last year's rates. The Financial Times is huge - that whole finance thing has never been my cup of tea, but this is England's Wall Street Journal. Very prestigious, and probably a bit more recession-proof than papers for the masses. So I'm scratching my head, thinking why they're suing for relative peanuts. Certainly a couple phone calls and Blackstone cuts them a check, no? So I can only come up with two ideas on why they'd sue: Deterrence or publicity. Probably both. I suppose you're not likely to have the sort of backlash that anti-piracy measures generate from consumers, and the kind of institutions that subscribe to the FT are unlikely to leave in protest. I guess it's a good business play, though it did surprise me and seem a bit strange at first.
- jacquesm 18y ago
  I wonder if the FT will sue me because I gave their paper to a friend... Scarcity of information is not a good business model in a time when transporting and copying information has a cost approaching 0.
  - electromagnetic 18y ago
    "... when transporting and copying information has a cost approaching 0." The cost is relatively approaching 0. The true cost of copying and transporting information is phenomenal, I mean I want to copy a VHS it used to cost me $400 max if I bought everything new! If I do similar for a DVD it's running me at least past $1000. However that's the actual cost, the relative cost is in fact near zero. We all have computers/laptops now because we need them, which means the extra cost to rip a DVD now is all of about $2.99 for the rental fee from Blockbuster with an additional like $0.50 to burn copies for people. It's also the value of the object you're ripping. It'd still be considered cost-effective if you bought a $1000 computer to use once to rip the full Adobe suite rather than actually buy the Adobe suite! The FT shouldn't be suing a single user, it's absurd and will cost them money. They should be using a business model that forces institutions to pay. Adobe doesn't expect me to pay $2000 for CS3, they do however expect a design firm to pay probably a hell of a lot more than $2000 to kit out all of their computers.
fallentimes 18y ago
Suing your customers and users usually doesn't end well. Just ask the RIAA. Even if they win the lawsuit and scare some more people/companies in to paying, I have trouble believing this will be a net win.
- helveticaman 18y ago
  Yeah...eventually ill will catches up with you because even the judges think you're an asshole. Don't shit where you eat.
chris11 18y ago
I wonder if this is a sign that bugmenot.com might get sued.They have some paid sites on there right now. In fact they have working ft.com info.http://www.bugmenot.com/view/ft.com http://www.bugmenot.com/view/ft.com
numair 18y ago
A lot of the commenters, and the writer of the article, seem to miss the major point here. We are talking about BLACKSTONE, whose founder paid millions of dollars to have Rod Stewart sing at his 60th birthday, among other ridiculous displays of tacky financial dick-swinging. The company that paid 40-something billion for Equity Office, and 20-something billion for Hilton Hotels. This is the LAST company you'd allow to get away with this sort of ridiculous, cheap behavior. And for those spouting the usual information wants to be free nonsense, you're probably not in the demographic of those reading the Financial Times. The FT and WSJ are two publications that tend to have exclusive, market-moving information that is extremely critical to the careers of many people (for example, the interview with Wen Jiabao of China this week had a lot of people involved in the Treasury market talking). This information is NOT available all over the web. If a blogger were to obtain just a single day's worth of FT scoops, he/she would be considered a genius.

13 points by whyleyc 18y ago

I'm interested to know if HN can think of a technical solution to this problem ? (one that must be common to many sites). It seems you could filter access based on IP address but that could be problematic if users were all coming out of the same company network.

inerte 18y ago
It can't be solved without additional software (like a browser plugin). The best you can do is logout the previous computer where an account was used. That means you can prevent simultaneous access but not multiple people using the same account on different times. That's the problem with the stateless part of HTTP. The server doesn't know much about the connection with the client. Once a document is delivered, it's done. And like you said, filtering by IP doesn't work. What if the costumer is using a desktop PC, 5 minutes later his laptop, a mobile in the afternoon? What if his OS crashes? So many problems. And that's the stateless nature... the server can't send to the client an "are you there?" message.
- Retric 18y ago
  You can use Javascript to keep pinging the server and then log people out if someone else logs into that act. Granted several people can still use the same act, but the annoyance is going to prompt them to want to get a full subscription. On the plus side the psychological push of "I want this data if only we had another act" would increase peoples perception of value. Edit: I am suggesting you let people use the service like this. Tell them your logging them out because someone else logged in but don't ban the account even if they do this 10 times a day. PS: I would also make it vary permissive so if the network is down they can still read the information etc. The idea is to promote your brand though exclusivity not annoy your users.
ryanwaggoner 18y ago
I wonder if you could develop behavioral tracking software that would flag accounts that exhibited symptoms of being used by multiple people, based on click patterns, reading habits, etc.
Angostura 18y ago
Weerl, off the top of my head, I suppose you could replace password with a 'something you know' challenge. Ask for 5 personal pieces of information (name of your first love, first school, etc.) then challenge for one of them at log-in. I suspect people would be less succeptable to share 5 pieces of such information with their colleagues, than a single password.
- whyleyc 18y ago
  Especially if it was personal stuff ...
- RiderOfGiraffes 18y ago
  They could just invent generic answers, and then share those.
- jerf 18y ago
  So, your belief is that you can deter cheaters by forcing them to truthfully divulge personal information, which they then won't want to share? Guess which word is going to cause a problem.
buro9 18y ago
I worked on a premium rate video site (sport, not porn) and developed some scheduled tasks for detecting sharing of logins. Our scenario was based around users sharing details on forums and over MSN or IRC. It was simple enough to log every login, and at the time of login collect basic identifiers which on their own are relatively useless identifiers (think one bit of DNA), but added up become quite effective identifiers (think 30 bits of DNA). We would then query the login against the number of login fingerprints spread across the day (were they really awake 24/7?) and across the globe (could they be in NYC and London at the same time?) and other such questions. We ignored a reasonably high rate of abuse (one person could share the details a few times) and only approached the accounts that were significantly compromised. To those that were compromised, the password would be automatically reset and emailed to the registered account holder letting them know that we feared their user credentials had been compromised and should it be compromised multiple times we would view this a risk to the content and would close the account. Note we did not accuse them, it's not good to do that to your customers. One thing we didn't do, but which was debated, was to publish under the account login, the details of the account. Basically it was suggested that by putting the personal details of the registered user in with the account, they wouldn't want to share them... i.e address, phone number, part of the credit card number... all under the payment details page and quite obvious from the header. Yes it was designed, but no it never got launched. Anyhow... detection and a way of handling it was both trivial and effective.
- bestes 18y ago
  Sounds like a nice solution. It does not sound trivial to me, though. Do you have any code to share or other pointers?Especially around the 'tuning' of this system (like, how many hours was too many, how much distance was OK, etc.)
  - buro9 18y ago
    It was trivial to collect the information. First you start with what the server knows, and log each data point. Then what can JavaScript tell us? Log each data point. What can common plugins tell us? Windows Media player has a UID cookie, call it twice from different IP's and see if we get the same number back. Flash could tell us a bit more too. Then there are the geospatial properties, where, when? Log those. We logged everything we could, and then pushed them over to an MIS layer. The MIS layer included views that ranked all users according to various basic criteria (number of hours when login has been performed per day, total amount of time spent on the system (windows media log files), number of unique machines used to access content). With those views the business could then use existing reporting tools to tweak the criteria or investigate a more severe anomaly in a set of data points. The result reports went back into the system and became the new benchmark for the next set of scheduled de-activations or emails. This way the computers could be left to do it 99% of the time, and people could come in and tweak it visually for the 1% of the time. We were purposefully tolerant of the issue as it is better to let a few people through and gain that marketing and audience than it was to have false positives and the bad marketing on the sport team forums. I can't share the various bits of code I'm afraid, it's a while ago and belongs to my employer at the time, though the technique I've outlined above.
run4yourlives 18y ago
You solve people problems with people, not technology.
- whyleyc 18y ago
  Agreed. People who are using technology creatively.
  - run4yourlives 18y ago
    Not really. People who see technology as one tool in a toolbox full of tools. When all you have is a hammer, and all that...
sgk284 18y ago
Require a credit card and display said information (anonymized to an extent) on the landing page after they log in. People will be very unlikely to purposefully give their credentials to your site to the public. This would work at companies too, because most companies would rather not have all of their employees see this information (it'd be more effective if you didn't anonymize any data... but the security implications could be too great, that's a choice for you too make though). It basically comes down to the fact that most people don't mind taking advantage of a business, until it means that they can be taken advantage too. As harsh as it sounds, the most direct solution is to simply make them put themselves at risk of being taken advantage of if they take advantage of you.
likpok 18y ago
Bloomberg uses biometric authentication in their terminals, which makes it fairly difficult to easily share credentials. However, they control the hardware in that case, which is not possible for most places.

josefresco 18y ago

Why are they suing? Can't they just kill the account, or block the other users?

whyleyc 18y ago
I think it's a shot across the bows of any other companies thinking of doing likewise (which would be a direct hit on FT revenue).

lionhearted 18y ago

"Full subscribers pay £199 per year" is $285 USD at current market rates, a bit higher based on last year's rates. The Financial Times is huge - that whole finance thing has never been my cup of tea, but this is England's Wall Street Journal. Very prestigious, and probably a bit more recession-proof than papers for the masses. So I'm scratching my head, thinking why they're suing for relative peanuts. Certainly a couple phone calls and Blackstone cuts them a check, no? So I can only come up with two ideas on why they'd sue: Deterrence or publicity. Probably both. I suppose you're not likely to have the sort of backlash that anti-piracy measures generate from consumers, and the kind of institutions that subscribe to the FT are unlikely to leave in protest. I guess it's a good business play, though it did surprise me and seem a bit strange at first.

jacquesm 18y ago
I wonder if the FT will sue me because I gave their paper to a friend... Scarcity of information is not a good business model in a time when transporting and copying information has a cost approaching 0.
- electromagnetic 18y ago
  "... when transporting and copying information has a cost approaching 0." The cost is relatively approaching 0. The true cost of copying and transporting information is phenomenal, I mean I want to copy a VHS it used to cost me $400 max if I bought everything new! If I do similar for a DVD it's running me at least past $1000. However that's the actual cost, the relative cost is in fact near zero. We all have computers/laptops now because we need them, which means the extra cost to rip a DVD now is all of about $2.99 for the rental fee from Blockbuster with an additional like $0.50 to burn copies for people. It's also the value of the object you're ripping. It'd still be considered cost-effective if you bought a $1000 computer to use once to rip the full Adobe suite rather than actually buy the Adobe suite! The FT shouldn't be suing a single user, it's absurd and will cost them money. They should be using a business model that forces institutions to pay. Adobe doesn't expect me to pay $2000 for CS3, they do however expect a design firm to pay probably a hell of a lot more than $2000 to kit out all of their computers.

fallentimes 18y ago

Suing your customers and users usually doesn't end well. Just ask the RIAA. Even if they win the lawsuit and scare some more people/companies in to paying, I have trouble believing this will be a net win.

helveticaman 18y ago
Yeah...eventually ill will catches up with you because even the judges think you're an asshole. Don't shit where you eat.

chris11 18y ago

I wonder if this is a sign that bugmenot.com might get sued.They have some paid sites on there right now. In fact they have working ft.com info.http://www.bugmenot.com/view/ft.com http://www.bugmenot.com/view/ft.com

numair 18y ago

A lot of the commenters, and the writer of the article, seem to miss the major point here. We are talking about BLACKSTONE, whose founder paid millions of dollars to have Rod Stewart sing at his 60th birthday, among other ridiculous displays of tacky financial dick-swinging. The company that paid 40-something billion for Equity Office, and 20-something billion for Hilton Hotels. This is the LAST company you'd allow to get away with this sort of ridiculous, cheap behavior. And for those spouting the usual information wants to be free nonsense, you're probably not in the demographic of those reading the Financial Times. The FT and WSJ are two publications that tend to have exclusive, market-moving information that is extremely critical to the careers of many people (for example, the interview with Wen Jiabao of China this week had a lot of people involved in the Treasury market talking). This information is NOT available all over the web. If a blogger were to obtain just a single day's worth of FT scoops, he/she would be considered a genius.