The LTB Network Forum

Abusive Likes.

Back to LTB Platform Development & Support

Comments

• CrimsonRoze

  

  Offline
  Posts: 295
  Location: Göteborg, Sweden

  @cryptonaut I went ahead and deleted all those accounts, so their likes wont even count lol. Pretty lame attempt if you ask me, the usernames and emails were super obviously fake...

  looks like I am going to have to add in email verification for all new accounts

  email verification does little to help against this. It's very easy to use throw-away-mails and just automate the verification process. Also, you probably need to be on the lookout now that the obvious names are done for. Next logical step is better name generation by means of name-dictionaries.

  Posted on August 10, 2014 at 9:30 AM
  Permalink
  0 likes
• Cryptonaut

  

  Offline
  Posts: 1944
  Location: Canada

  @rob

  @cryptonaut I went ahead and deleted all those accounts, so their likes wont even count lol.

  Should we fear the centralized power you have? I say this tongue-in-cheek, because I completely trust you and Adam (and other's here, as well). I'm also in awe of how amazing your work on this site is! But I do have trouble reconciling philosophically how glad I am that you have the ultimate power on this site, vs. the goals of decentralization of such power. I'd be curious if anyone has thoughts on this.

  I also am a bit unclear why adding an email address will do much to stop technical people from creating many accounts, since it isn't difficult to create a new email address for each account.

  heheh thanks! :)

  I tend to agree with the sentiment that "anything that can be decentralized, will be decentralized".. but its much much easier said than done. Until we are at the point (if ever, no one has yet AFAIK) where we can actually host and manage the site and database in a secure decentralized manner, then there will always be central control points. "Access Control" (as @andreas puts it) has been the only way websites can operate so far since the internet started

  For the email address bit.. its just adding an extra hurdle for bot creators. Its much easier to create a bot that just generates random username/password/email combos and get instant access compared to actually creating a real email address for each one, having it automatically detect the verification email and entering in the secret code etc.. Its not fool proof but its a decent deterrent.

  Posted on August 10, 2014 at 9:41 AM
  Permalink
  0 likes
• Cryptonaut

  

  Offline
  Posts: 1944
  Location: Canada

  @crimsonroze

  @cryptonaut I went ahead and deleted all those accounts, so their likes wont even count lol. Pretty lame attempt if you ask me, the usernames and emails were super obviously fake...

  looks like I am going to have to add in email verification for all new accounts

  email verification does little to help against this. It's very easy to use throw-away-mails and just automate the verification process. Also, you probably need to be on the lookout now that the obvious names are done for. Next logical step is better name generation by means of name-dictionaries.

  true. There is only so much we can do though against someone who is dedicated enough. Its a problem with basically every site that has a registration system lol. The only other thing we could do really is make it so every new account has to be manually approved by an admin before they can do anything, but that is far from ideal or user friendly. Things like IP bans wont work either since those are also really easy to get around.

  If an attacker makes an account that has a realistic username, realistic email, completed the registration CAPTCHA and actually went through the email verification process.. there is really no way to tell if its a bot other than catching it in the act of abusing stuff

  Posted on August 10, 2014 at 9:47 AM
  Permalink
  0 likes
• CrimsonRoze

  

  Offline
  Posts: 295
  Location: Göteborg, Sweden

  @cryptonaut

  @rob

  @cryptonaut For the email address bit.. its just adding an extra hurdle for bot creators. Its much easier to create a bot that just generates random username/password/email combos and get instant access compared to actually creating a real email address for each one, having it automatically detect the verification email and entering in the secret code etc.. Its not fool proof but its a decent deterrent.

  Then please add at least a ban on all email domains who has an MX that points to http://mailinator.com/

  Also note that you can point your own domains to Mailinator (i.e. specifically, your MX record). Thus you can have your "own private Mailinator" in that respect. The mailinator system accepts any email addressed to [email protected].

  Posted on August 10, 2014 at 9:49 AM
  Permalink
  0 likes
• page

  

  Offline
  Posts: 423

  @rob But I do have trouble reconciling philosophically how glad I am that you have the ultimate power on this site, vs. the goals of decentralization of such power. I'd be curious if anyone has thoughts on this.

  Both centralised and decentralised power structures get legitimacy through consent. As long as there's nothing coercing individuals to partake in either process I don't see anything too problematic occurring.

  Posted on August 10, 2014 at 9:50 AM
  Permalink
  2 likes
• CrimsonRoze

  

  Offline
  Posts: 295
  Location: Göteborg, Sweden

  @cryptonaut If an attacker makes an account that has a realistic username, realistic email, completed the registration CAPTCHA and actually went through the email verification process.. there is really no way to tell if its a bot other than catching it in the act of abusing stuff

  This is not true, you're thinking inside your box. Robots and Humans have different behaviours and there are alot of things that robots often do that humans simple never could.

  But yes, its an uphill battle and you can take it one step at a time if you want.

  Posted on August 10, 2014 at 9:51 AM
  Permalink
  0 likes
• Cryptonaut

  

  Offline
  Posts: 1944
  Location: Canada

  @crimsonroze

  @cryptonaut If an attacker makes an account that has a realistic username, realistic email, completed the registration CAPTCHA and actually went through the email verification process.. there is really no way to tell if its a bot other than catching it in the act of abusing stuff

  This is not true, you're thinking inside your box. Robots and Humans have different behaviours and there are alot of things that robots often do that humans simple never could.

  But yes, its an uphill battle and you can take it one step at a time if you want.

  The behaviour is defined by the human thats creating it though. I dont think the bots that are hitting us are generic ones that crawl the web trying to sign up and spam wherever they can, they appear to be made specifically for LTB. What do you suggest as a sure fire way to detect if a new registration is an automated spam bot or not? million dollar question right there haha

  As far as the mailinator thing goes.. I think its a slippery slope if we start banning any email that comes from specific services due to feat of bots (the accounts in question also were not using that service BTW). I can see plenty of legitimate uses for mailinator, so its not really fair to exclude potential legit users from signing up on the site. Once the bots start actively abusing the service it becomes pretty obvious and only takes me a minute to get rid of all traces of them anyways

  Posted on August 10, 2014 at 10:01 AM
  Permalink
  0 likes
• noobdan

  

  Offline
  Posts: 88

  with the creation of iMacros, everyone can create these sort of bots, expectable

  Posted on August 12, 2014 at 5:40 AM
  Last Edited: August 12, 2014 at 5:40 AM
  Permalink
  0 likes

Post Reply