3 ms·
I worked on a premium rate video site (sport, not porn) and developed some scheduled tasks for detecting sharing of logins. Our scenario was based around users
by buro9 18y ago
I worked on a premium rate video site (sport, not porn) and developed some scheduled tasks for detecting sharing of logins.
Our scenario was based around users sharing details on forums and over MSN or IRC.
It was simple enough to log every login, and at the time of login collect basic identifiers which on their own are relatively useless identifiers (think one bit of DNA), but added up become quite effective identifiers (think 30 bits of DNA).
We would then query the login against the number of login fingerprints spread across the day (were they really awake 24/7?) and across the globe (could they be in NYC and London at the same time?) and other such questions.
We ignored a reasonably high rate of abuse (one person could share the details a few times) and only approached the accounts that were significantly compromised.
To those that were compromised, the password would be automatically reset and emailed to the registered account holder letting them know that we feared their user credentials had been compromised and should it be compromised multiple times we would view this a risk to the content and would close the account. Note we did not accuse them, it's not good to do that to your customers.
One thing we didn't do, but which was debated, was to publish under the account login, the details of the account. Basically it was suggested that by putting the personal details of the registered user in with the account, they wouldn't want to share them... i.e address, phone number, part of the credit card number... all under the payment details page and quite obvious from the header. Yes it was designed, but no it never got launched.
Anyhow... detection and a way of handling it was both trivial and effective.
- bestes 18y agoSounds like a nice solution. It does not sound trivial to me, though. Do you have any code to share or other pointers?Especially around the 'tuning' of this system (like, how many hours was too many, how much distance was OK, etc.)
- buro9 18y agoIt was trivial to collect the information. First you start with what the server knows, and log each data point. Then what can JavaScript tell us? Log each data point. What can common plugins tell us? Windows Media player has a UID cookie, call it twice from different IP's and see if we get the same number back. Flash could tell us a bit more too. Then there are the geospatial properties, where, when? Log those. We logged everything we could, and then pushed them over to an MIS layer. The MIS layer included views that ranked all users according to various basic criteria (number of hours when login has been performed per day, total amount of time spent on the system (windows media log files), number of unique machines used to access content). With those views the business could then use existing reporting tools to tweak the criteria or investigate a more severe anomaly in a set of data points. The result reports went back into the system and became the new benchmark for the next set of scheduled de-activations or emails. This way the computers could be left to do it 99% of the time, and people could come in and tweak it visually for the 1% of the time. We were purposefully tolerant of the issue as it is better to let a few people through and gain that marketing and audience than it was to have false positives and the bad marketing on the sport team forums. I can't share the various bits of code I'm afraid, it's a while ago and belongs to my employer at the time, though the technique I've outlined above.
- teej 18y agoThanks for posting this. For a long time, I've had the opposite issue: detecting and disabling single users running multiple accounts. This is a much more comprehensive way I could narrow down where requests originate and then map that to clusters of user accounts.
- whyleyc 18y agoJust out of interest why did you decide not to push the account details change ?
- buro9 18y agoThe site is UK hosted, we felt that publishing data that isn't required for the function of the site would fall foul of the data protection laws within the UK and EU. It also smelt a bit. And we tried* to not do things that were possible if we felt that the idea was in any way unethical or just stank. * Past-tense not because they now do otherwise, but because I haven't worked there in a while.
- fallentimes 18y agoESPN Insider? If so, you caught me.