5 ms·

I'm interested to know if HN can think of a technical solution to this problem ? (one that must be common to many sites). It seems you could filter access base

by whyleyc 18y ago

I'm interested to know if HN can think of a technical solution to this problem ? (one that must be common to many sites). It seems you could filter access based on IP address but that could be problematic if users were all coming out of the same company network.

inerte 18y ago
It can't be solved without additional software (like a browser plugin). The best you can do is logout the previous computer where an account was used. That means you can prevent simultaneous access but not multiple people using the same account on different times. That's the problem with the stateless part of HTTP. The server doesn't know much about the connection with the client. Once a document is delivered, it's done. And like you said, filtering by IP doesn't work. What if the costumer is using a desktop PC, 5 minutes later his laptop, a mobile in the afternoon? What if his OS crashes? So many problems. And that's the stateless nature... the server can't send to the client an "are you there?" message.
- Retric 18y ago
  You can use Javascript to keep pinging the server and then log people out if someone else logs into that act. Granted several people can still use the same act, but the annoyance is going to prompt them to want to get a full subscription. On the plus side the psychological push of "I want this data if only we had another act" would increase peoples perception of value. Edit: I am suggesting you let people use the service like this. Tell them your logging them out because someone else logged in but don't ban the account even if they do this 10 times a day. PS: I would also make it vary permissive so if the network is down they can still read the information etc. The idea is to promote your brand though exclusivity not annoy your users.
ryanwaggoner 18y ago
I wonder if you could develop behavioral tracking software that would flag accounts that exhibited symptoms of being used by multiple people, based on click patterns, reading habits, etc.
Angostura 18y ago
Weerl, off the top of my head, I suppose you could replace password with a 'something you know' challenge. Ask for 5 personal pieces of information (name of your first love, first school, etc.) then challenge for one of them at log-in. I suspect people would be less succeptable to share 5 pieces of such information with their colleagues, than a single password.
- whyleyc 18y ago
  Especially if it was personal stuff ...
- RiderOfGiraffes 18y ago
  They could just invent generic answers, and then share those.
- jerf 18y ago
  So, your belief is that you can deter cheaters by forcing them to truthfully divulge personal information, which they then won't want to share? Guess which word is going to cause a problem.
buro9 18y ago
I worked on a premium rate video site (sport, not porn) and developed some scheduled tasks for detecting sharing of logins. Our scenario was based around users sharing details on forums and over MSN or IRC. It was simple enough to log every login, and at the time of login collect basic identifiers which on their own are relatively useless identifiers (think one bit of DNA), but added up become quite effective identifiers (think 30 bits of DNA). We would then query the login against the number of login fingerprints spread across the day (were they really awake 24/7?) and across the globe (could they be in NYC and London at the same time?) and other such questions. We ignored a reasonably high rate of abuse (one person could share the details a few times) and only approached the accounts that were significantly compromised. To those that were compromised, the password would be automatically reset and emailed to the registered account holder letting them know that we feared their user credentials had been compromised and should it be compromised multiple times we would view this a risk to the content and would close the account. Note we did not accuse them, it's not good to do that to your customers. One thing we didn't do, but which was debated, was to publish under the account login, the details of the account. Basically it was suggested that by putting the personal details of the registered user in with the account, they wouldn't want to share them... i.e address, phone number, part of the credit card number... all under the payment details page and quite obvious from the header. Yes it was designed, but no it never got launched. Anyhow... detection and a way of handling it was both trivial and effective.
- bestes 18y ago
  Sounds like a nice solution. It does not sound trivial to me, though. Do you have any code to share or other pointers?Especially around the 'tuning' of this system (like, how many hours was too many, how much distance was OK, etc.)
  - buro9 18y ago
    It was trivial to collect the information. First you start with what the server knows, and log each data point. Then what can JavaScript tell us? Log each data point. What can common plugins tell us? Windows Media player has a UID cookie, call it twice from different IP's and see if we get the same number back. Flash could tell us a bit more too. Then there are the geospatial properties, where, when? Log those. We logged everything we could, and then pushed them over to an MIS layer. The MIS layer included views that ranked all users according to various basic criteria (number of hours when login has been performed per day, total amount of time spent on the system (windows media log files), number of unique machines used to access content). With those views the business could then use existing reporting tools to tweak the criteria or investigate a more severe anomaly in a set of data points. The result reports went back into the system and became the new benchmark for the next set of scheduled de-activations or emails. This way the computers could be left to do it 99% of the time, and people could come in and tweak it visually for the 1% of the time. We were purposefully tolerant of the issue as it is better to let a few people through and gain that marketing and audience than it was to have false positives and the bad marketing on the sport team forums. I can't share the various bits of code I'm afraid, it's a while ago and belongs to my employer at the time, though the technique I've outlined above.
run4yourlives 18y ago
You solve people problems with people, not technology.
- whyleyc 18y ago
  Agreed. People who are using technology creatively.
  - run4yourlives 18y ago
    Not really. People who see technology as one tool in a toolbox full of tools. When all you have is a hammer, and all that...
sgk284 18y ago
Require a credit card and display said information (anonymized to an extent) on the landing page after they log in. People will be very unlikely to purposefully give their credentials to your site to the public. This would work at companies too, because most companies would rather not have all of their employees see this information (it'd be more effective if you didn't anonymize any data... but the security implications could be too great, that's a choice for you too make though). It basically comes down to the fact that most people don't mind taking advantage of a business, until it means that they can be taken advantage too. As harsh as it sounds, the most direct solution is to simply make them put themselves at risk of being taken advantage of if they take advantage of you.
likpok 18y ago
Bloomberg uses biometric authentication in their terminals, which makes it fairly difficult to easily share credentials. However, they control the hardware in that case, which is not possible for most places.

by whyleyc 18y ago

inerte 18y ago

It can't be solved without additional software (like a browser plugin). The best you can do is logout the previous computer where an account was used. That means you can prevent simultaneous access but not multiple people using the same account on different times. That's the problem with the stateless part of HTTP. The server doesn't know much about the connection with the client. Once a document is delivered, it's done. And like you said, filtering by IP doesn't work. What if the costumer is using a desktop PC, 5 minutes later his laptop, a mobile in the afternoon? What if his OS crashes? So many problems. And that's the stateless nature... the server can't send to the client an "are you there?" message.

Retric 18y ago
You can use Javascript to keep pinging the server and then log people out if someone else logs into that act. Granted several people can still use the same act, but the annoyance is going to prompt them to want to get a full subscription. On the plus side the psychological push of "I want this data if only we had another act" would increase peoples perception of value. Edit: I am suggesting you let people use the service like this. Tell them your logging them out because someone else logged in but don't ban the account even if they do this 10 times a day. PS: I would also make it vary permissive so if the network is down they can still read the information etc. The idea is to promote your brand though exclusivity not annoy your users.

ryanwaggoner 18y ago

I wonder if you could develop behavioral tracking software that would flag accounts that exhibited symptoms of being used by multiple people, based on click patterns, reading habits, etc.

Angostura 18y ago

Weerl, off the top of my head, I suppose you could replace password with a 'something you know' challenge. Ask for 5 personal pieces of information (name of your first love, first school, etc.) then challenge for one of them at log-in. I suspect people would be less succeptable to share 5 pieces of such information with their colleagues, than a single password.

whyleyc 18y ago
Especially if it was personal stuff ...
RiderOfGiraffes 18y ago
They could just invent generic answers, and then share those.
jerf 18y ago
So, your belief is that you can deter cheaters by forcing them to truthfully divulge personal information, which they then won't want to share? Guess which word is going to cause a problem.

buro9 18y ago

I worked on a premium rate video site (sport, not porn) and developed some scheduled tasks for detecting sharing of logins. Our scenario was based around users sharing details on forums and over MSN or IRC. It was simple enough to log every login, and at the time of login collect basic identifiers which on their own are relatively useless identifiers (think one bit of DNA), but added up become quite effective identifiers (think 30 bits of DNA). We would then query the login against the number of login fingerprints spread across the day (were they really awake 24/7?) and across the globe (could they be in NYC and London at the same time?) and other such questions. We ignored a reasonably high rate of abuse (one person could share the details a few times) and only approached the accounts that were significantly compromised. To those that were compromised, the password would be automatically reset and emailed to the registered account holder letting them know that we feared their user credentials had been compromised and should it be compromised multiple times we would view this a risk to the content and would close the account. Note we did not accuse them, it's not good to do that to your customers. One thing we didn't do, but which was debated, was to publish under the account login, the details of the account. Basically it was suggested that by putting the personal details of the registered user in with the account, they wouldn't want to share them... i.e address, phone number, part of the credit card number... all under the payment details page and quite obvious from the header. Yes it was designed, but no it never got launched. Anyhow... detection and a way of handling it was both trivial and effective.

bestes 18y ago
Sounds like a nice solution. It does not sound trivial to me, though. Do you have any code to share or other pointers?Especially around the 'tuning' of this system (like, how many hours was too many, how much distance was OK, etc.)
- buro9 18y ago
  It was trivial to collect the information. First you start with what the server knows, and log each data point. Then what can JavaScript tell us? Log each data point. What can common plugins tell us? Windows Media player has a UID cookie, call it twice from different IP's and see if we get the same number back. Flash could tell us a bit more too. Then there are the geospatial properties, where, when? Log those. We logged everything we could, and then pushed them over to an MIS layer. The MIS layer included views that ranked all users according to various basic criteria (number of hours when login has been performed per day, total amount of time spent on the system (windows media log files), number of unique machines used to access content). With those views the business could then use existing reporting tools to tweak the criteria or investigate a more severe anomaly in a set of data points. The result reports went back into the system and became the new benchmark for the next set of scheduled de-activations or emails. This way the computers could be left to do it 99% of the time, and people could come in and tweak it visually for the 1% of the time. We were purposefully tolerant of the issue as it is better to let a few people through and gain that marketing and audience than it was to have false positives and the bad marketing on the sport team forums. I can't share the various bits of code I'm afraid, it's a while ago and belongs to my employer at the time, though the technique I've outlined above.

run4yourlives 18y ago

You solve people problems with people, not technology.

whyleyc 18y ago
Agreed. People who are using technology creatively.
- run4yourlives 18y ago
  Not really. People who see technology as one tool in a toolbox full of tools. When all you have is a hammer, and all that...

sgk284 18y ago

Require a credit card and display said information (anonymized to an extent) on the landing page after they log in. People will be very unlikely to purposefully give their credentials to your site to the public. This would work at companies too, because most companies would rather not have all of their employees see this information (it'd be more effective if you didn't anonymize any data... but the security implications could be too great, that's a choice for you too make though). It basically comes down to the fact that most people don't mind taking advantage of a business, until it means that they can be taken advantage too. As harsh as it sounds, the most direct solution is to simply make them put themselves at risk of being taken advantage of if they take advantage of you.

likpok 18y ago

Bloomberg uses biometric authentication in their terminals, which makes it fairly difficult to easily share credentials. However, they control the hardware in that case, which is not possible for most places.