4 ms·

Mechanical Turk is Insecure

45 points by ukd1 13y ago

sashaeslami 13y ago
This is absurd. What is the work-around/alternative? Well written post.
- ukd1 13y ago
  The only one I've thought of since writing this is to have a separate AWS account and link it as a sub account for billing. Solves someone shutting down your main servers, but still means they can spin stuff up / use lots of cash. This would be a massive pain for us as we'd loose our worker pool. I could do it the other way, move our infrastructure to a new account...but that sounds equally painful.
  - mattzito 13y ago
    Or have it charged to an entirely separate card, one that gets reloaded with money every month to cover planned MT expenses. Annoying, but the safest option, I suspect
  - tillk 13y ago
    I would like to see IAM as well, but I would say that the solution right now is using a seperate account and using AWS MFA: http://aws.amazon.com/mfa/ http://aws.amazon.com/mfa/ A new account doesn't have all AWS services enabled by default, so the impact seems minimal to start with. Not sure if you can lock this down further as I haven't looked into it. All in all this is not perfect, but "securer".
dnsco 13y ago
Hopefully this draws enough attention for amazon to want to fix the problem.
anandkulkarni 13y ago
Worse yet, the tasks are public on the web, and anyone can see what's being posted: there's not even a minimal level of privacy.
- ukd1 13y ago
  Well this is the same for most services, I've seen - including MobileWorks? If you register as a worker and you can accept tasks, if you meet the requirements. It's avoided to some extent by us due to the way we issue training / challenge work before any actual work is given to new workers.
  - anandkulkarni 13y ago
    Not quite: in MobileWorks, work is assigned to private workers, so nothing is public. The same goes for CloudFactory, TaskUs, and the other non-marketplace crowd platforms. You're right that challenge work does a reasonable job of screening tasks from search engines, though!
mkr-hn 13y ago
Mechanical Turk is Amazon's Google Reader. I had to write a whole guide[1] on not getting screwed over by scam requesters because all the tools for it don't exist as part of Mechanical Turk. I don't think Amazon has touched the service since they launched it. [1] http://mkronline.com/2013/09/17/how-to-make-money-with-mechanical-turk-without-being-scammed/ http://mkronline.com/2013/09/17/how-to-make-money-with-mecha...

45 points by ukd1 13y ago

sashaeslami 13y ago

This is absurd. What is the work-around/alternative? Well written post.

ukd1 13y ago
The only one I've thought of since writing this is to have a separate AWS account and link it as a sub account for billing. Solves someone shutting down your main servers, but still means they can spin stuff up / use lots of cash. This would be a massive pain for us as we'd loose our worker pool. I could do it the other way, move our infrastructure to a new account...but that sounds equally painful.
- mattzito 13y ago
  Or have it charged to an entirely separate card, one that gets reloaded with money every month to cover planned MT expenses. Annoying, but the safest option, I suspect
- tillk 13y ago
  I would like to see IAM as well, but I would say that the solution right now is using a seperate account and using AWS MFA: http://aws.amazon.com/mfa/ http://aws.amazon.com/mfa/ A new account doesn't have all AWS services enabled by default, so the impact seems minimal to start with. Not sure if you can lock this down further as I haven't looked into it. All in all this is not perfect, but "securer".

dnsco 13y ago

Hopefully this draws enough attention for amazon to want to fix the problem.

anandkulkarni 13y ago

Worse yet, the tasks are public on the web, and anyone can see what's being posted: there's not even a minimal level of privacy.

ukd1 13y ago
Well this is the same for most services, I've seen - including MobileWorks? If you register as a worker and you can accept tasks, if you meet the requirements. It's avoided to some extent by us due to the way we issue training / challenge work before any actual work is given to new workers.
- anandkulkarni 13y ago
  Not quite: in MobileWorks, work is assigned to private workers, so nothing is public. The same goes for CloudFactory, TaskUs, and the other non-marketplace crowd platforms. You're right that challenge work does a reasonable job of screening tasks from search engines, though!

mkr-hn 13y ago

Mechanical Turk is Amazon's Google Reader. I had to write a whole guide[1] on not getting screwed over by scam requesters because all the tools for it don't exist as part of Mechanical Turk. I don't think Amazon has touched the service since they launched it. [1] http://mkronline.com/2013/09/17/how-to-make-money-with-mechanical-turk-without-being-scammed/ http://mkronline.com/2013/09/17/how-to-make-money-with-mecha...