4 ms·

Porn sites are pray of bruteforcers, who use thousands of proxies to scan for working accounts. I know people who do this and I can say that no negative or usua

by Jhsto 13y ago

Porn sites are pray of bruteforcers, who use thousands of proxies to scan for working accounts. I know people who do this and I can say that no negative or usual CAPTCHA stops them. What you would need is a lazy loaded CSRF field, which breaks their bruteforcing applications.

latchkey 13y ago
We just showed a captcha after enough failures. If we saw a massive spike of failures, we'd just add their ip to our firewall and disappear of the net for a period of time. This stops 99.99% of the attacks. For the rest of them, the feeling was that if they wanted free porn badly enough, then it was free marketing for the company.
- Jhsto 13y ago
  I've understood that after the page shows CAPTCHA, the bot either tries to solve it with OCR or then it just rotates to the next proxy. By rotating trough lets say 7000 proxies, by the time it has gone trough all of them the first ones do not display CAPTCHA challenge anymore. One funny thing I remember of being told is that if the main site seems to hard to config, they just change to the mobile version of the site, which usually has less security. For them it really is free porn besides of hobby, as I've seen logfiles of hundreds of subscribed accounts on them. Some people steal the credit card information attached to them while some just preserve a giant libary of porn accounts on demand. When I noted this problem I coded a service which would have prevented all these attacks made by the tools they used. I contacted various of porn and filehosting sites, but none never replied to me. It's a pity that the site owners either do not care or can't address the problem.
  - latchkey 13y ago
    In the case of kink, we changed things up quite a bit. An account is meaningless until you add a subscription or kinks (the micro-currency we developed) to it and also your account never goes away. This is different than 99.99% of the sites out there which generally tie an account to a subscription, when the subscription is up, so is the account. Those sites generally just add/remove lines from a simple .htpasswd file and it is those files which usually get stolen from badly configured servers and sent around the forums. If someone shares an account on kink (different ip's/browser agents over a period of time), they are all automatically cockblocked... by changing the users password, thus making them do the password recovery dance. It is no surprise nobody contacted you back... most sites are either run by people who have no clue about tech (and thus wouldn't be able to do anything with you) or they are smart and don't trust some random person emailing them saying they can fix their security issues.

by Jhsto 13y ago

latchkey 13y ago

We just showed a captcha after enough failures. If we saw a massive spike of failures, we'd just add their ip to our firewall and disappear of the net for a period of time. This stops 99.99% of the attacks. For the rest of them, the feeling was that if they wanted free porn badly enough, then it was free marketing for the company.

Jhsto 13y ago
I've understood that after the page shows CAPTCHA, the bot either tries to solve it with OCR or then it just rotates to the next proxy. By rotating trough lets say 7000 proxies, by the time it has gone trough all of them the first ones do not display CAPTCHA challenge anymore. One funny thing I remember of being told is that if the main site seems to hard to config, they just change to the mobile version of the site, which usually has less security. For them it really is free porn besides of hobby, as I've seen logfiles of hundreds of subscribed accounts on them. Some people steal the credit card information attached to them while some just preserve a giant libary of porn accounts on demand. When I noted this problem I coded a service which would have prevented all these attacks made by the tools they used. I contacted various of porn and filehosting sites, but none never replied to me. It's a pity that the site owners either do not care or can't address the problem.
- latchkey 13y ago
  In the case of kink, we changed things up quite a bit. An account is meaningless until you add a subscription or kinks (the micro-currency we developed) to it and also your account never goes away. This is different than 99.99% of the sites out there which generally tie an account to a subscription, when the subscription is up, so is the account. Those sites generally just add/remove lines from a simple .htpasswd file and it is those files which usually get stolen from badly configured servers and sent around the forums. If someone shares an account on kink (different ip's/browser agents over a period of time), they are all automatically cockblocked... by changing the users password, thus making them do the password recovery dance. It is no surprise nobody contacted you back... most sites are either run by people who have no clue about tech (and thus wouldn't be able to do anything with you) or they are smart and don't trust some random person emailing them saying they can fix their security issues.