Comment by slv77 | Hacker News Reader

Comment by slv77 | Hacker News Reader

Parent Full thread

Whatever you set your limit as it's pretty trivial to bypass if they are willing to create a thousand accounts. Close those thousand accounts and they will create a thousand more at the same rate you close them.

Add velocity controls for the IP address and you'll get a thousand sign ups from a thousand IPs. Limit it by device and you'll see a thousand devices. Flag the images using a perceptual hash and the images will come back superimposed on random pictures of food.

At some point you find that your accounts are now traded as a commodity on underground markets at various prices by teams that specialize in creating accounts, aging them and selling them for x cents. Add enough restrictions to new accounts and you'll find existing shops being taken over and flooded with listings.

And do all of this while still having an "effortless" signup experience for new legitimate vendors.

Are you really sure they are that sophisticated? Genuine question. THis sounds like an extreme worst case scenario

The example of cell phone case pictures superimposed over random pictures of food was from an Etsy presentation at a conference I recently attended.

Routinely (i.e. daily) I see activity that may involve 500+ unique IPs and 2000-4000 attempts. The type of activity that I see isn't close to what would be considered an extreme-worst case scenario in the industry.

Assuming the right economic incentives these groups are over time able to duplicate about any behavior that would be seen by a typical customer. For example, they can effectively remote desktop into a device and create a sleeper account and then come back to the exact same device a week later once the probation period has expired and execute a larger attack.

Also it is hard to fully understand that markets where labor isn't scarce fundamentally organize themselves differently. For example one recent attack that I'd see involved multiple attempts from multiple IP addresses and multiple devices all within seconds of each other and using the same credit card for registration. For a while I marveled at the technical skills that would be required to orchestrate such an attack until I realized that it likely was likely a dozen people in a room sharing the same credit card number and launching the attack in a coordinated fashion. Low tech, but extremely effective when labor is cheap.

Reply on news.ycombinator.com