Comment by thegeomaster | Hacker News Reader

Comment by thegeomaster | Hacker News Reader

Great! Let's add it to the list of obstacles to accessing content for us savages in small, poor, out-of-sight-out-of-mind countries:

- Harrassment with an extra verification step every god damn time you log in into a website you've been a paying customer at for years because some rando risk model thinks you're a bad guy

- Harrassment by reCAPTCHA to respond to US-centric image challenges when it decides it's up for some sadistic fun (Mark all images with a store front or street light? Sure, let me just Google how they are "supposed" to look, because I sure as hell ain't seeing any I'm familiar with here.)

- Blanket IP range bans which serve you a default 503 error page and call it a day, with ripple effects throghout tons of unrelated websites. I always know when my ISP's IP range is added to some new blacklist.

- Harrassment by Cloudflare "verifying my browser", presumably burning my CPU cycles so they can be sure that my browser, which has been hitting their IP ranges for years with not as much as a cookie wipe, has not suddenly turned into a bot

- "Your name is invalid": no, your regex is

- "Our fetishism for credit prevents us from accepting your debit card payment unless you submit a scan of your passport signed in blood"

- (NEW) CloudFlare's anti-bot measures which will surely not misfire because no one thought to test their shiny new model on the traffic patterns of some culture with < 50 million Internet users

Apologize for the off-topic rant, but you wouldn't believe how using the Internet for basic things has gotten difficult in the past few years over here (and from what I hear, in many other "forgotten" geographies). No one cares. Long live colonialism!

I'm sorry you have to put up with all of that, and I don't want to be part of the problem for folks like you. But here's the other side of the coin: I ran a small VPS hosting company for many years, and the "small, poor, out-of-sight-out-of-mind countries" are a huge source of fraud. Someone signing up from an IP in Latvia, for example, was virtually guaranteed to be paying with a stolen card that would later get disputed. Debit card payments can get disputed, too, and disputes can happen as much as 120 days after the initial charge.

For comparison purposes, the dispute rate for US-origin payments (US card, US origin IP, no evidence of proxy use) was under 1%.

If I couldn't do things like "submit a scan of your passport", I would probably just decline any cards from high-risk countries.

What would you suggest I do instead?

Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud.

In the EU one thing we are doing is basically enabling 2FA for card purchases aka "Strong Customer Authentication".

Now I'm not 100% happy with the use of SMS as a 2FA but what will happen is if the bank or site ask for extra verification of a purchase the issuing bank will prompt the user to auth the transaction via another means (Either a SMS Code they enter into the page (think verify by visa but using a one time code that gets delivered to the customer with the amount they are approving), a Rich Communication Services with a Approve / Deny prompt or a push notification to the users banking app on their smart device.

Will it defect card fraud completely? Nope, crooks are smart and will find ways around it like they did with chip and pin. But it will help (as long as we don't keep pushing back the rollout date - https://www.businessinsider.com/uk-delays-strong-customer-au...).

> Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud.

Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas.

Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system.

Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that:

A) payments will take a long time to resolve,

B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and

C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place.

So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.

I don't think you as an individual can do a lot, and I don't blame you as an individual. In your position I would've probably done the same.

The situation with poorer countries is completely clear. As people have less and less honest options of providing a dignified living for themselves and their family, their moral principles give way and they turn to crime. Maslow hierarchy of needs and all that. In my opinion, the blame for a lot of these situations is the aggressive exploitative treatment and bullying of "small guys" by "big guys" on the global scene. But that's a separate political discussion, and a long one at that.

One thing that could help, but I doubt it's under your direct control, is taking advantage of systems such as 3-D Secure, which is SMS-based OTP for card payments. My card has this and I'm always happy to verify my payment this way, but payment processors are free to ignore these capabilities and just charge the card. (Conspiracy theory: this is because it hurts the conversion rates, as it adds another step to the funnel.) I think that a payment verified via 3-D Secure would have a much lower risk associated with it.

But overall, I don't think I can offer any suggestions on how to make the system better. I ranted due to a perceived injustice, but that didn't mean I have ways ready to make the situation better. I think that change must come from the powers that be - and they're unlikely to suddenly start giving a shit, so there goes that.

In any case, I thank you for considering my perspective and offering to help move the status quo. Rest assured, my friend, you are not part of the problem.

> But overall, I don't think I can offer any suggestions on how to make the system better. I ranted due to a perceived injustice, but that didn't mean I have ways ready to make the situation better. I think that change must come from the powers that be - and they're unlikely to suddenly start giving a shit, so there goes that.

> In any case, I thank you for considering my perspective and offering to help move the status quo. Rest assured, my friend, you are not part of the problem.

I disagree with basically all of this. A lot of people here are part of the problem. They are part of "the powers that be". Not that they want to keep anyone down or anything, it's just that they have businesses to run and will do reasonable accommodations but no more.

Since I'm sure everyone here wants the problem to be solved, if it can be done easily enough, there is a good hope of solving it with some smart technologies.

3d secure and looking at cookie reputation are both good ideas. If they are not used as much as you think they should be, we gotta ask why that is? Is it because it's too hard to implement? People haven't heard of it? Can library for doing it easily be made? Can it be pushed on people through add it as default, or including it in code samples?

This is much better alternative. The little bit of CPU time you burn probably won't even step up your fan or impact your battery life noticeably. What it will do is change the economics for bots so they go out of business. If there are less bots, then the other, more annoying countermeasures can be scaled back. Everyone wins, except the bots.

  respond to US-centric image challenges

Please don't give Google's traffic AI free help. Choose the audio challenge instead, assuming you understand spoken English.

Colonialism?

I understand your frustration, but the problem isn't that it's far away geographically, it's that your country is allowing criminals to use your IPs to do bad stuff.

The bit about colonialism was tongue-in-cheek, but it's not a completely nonsensical comment.

My country has such a poor median standard of living that things like computer fraud (or crime, generally) become attractive even to reasonably honest people as they become desperate in finding ways to provide a dignified living for themselves and their families.

Due to largely the same root causes, its government has insufficient infrastructure, bandwidth, and expertise to deal with cases of computer fraud, especially with big tech corporations usually refusing to cooperate/communicate with our officials.

One of the contributors to this situation is a military operation perpetrated by a well-known and powerful transatlantic military alliance as recently as 20 years ago; it resulted in $5 billion of direct economic damage (a big deal when that's your entire GDP) and countless billions of indirect economic loss which rippled throughout the years in the aftermath (not to mention the hundreds of civillian lives lost).

I'm trying not to drag politics and emotions into this too much, and my country surely has many issues unrelated to anyone outside, but I'm expressing my grievances as a common person who, like anyone else, did not choose their birthplace, and does in no way identify with the policies and actions of their government, but suffers greatly in many ways due to them + the constant bullying and pressure by the "colonial forces", which is what I was primarily referring to.

I wasn't implying it's your fault, just saying that it's weird to, say, get mad at Walmart when they put up extra security measures in places where they constantly get robbed.

Could you explain why people from small, poor countries would be identified as malicious bots by Cloudflare?

Reply on news.ycombinator.com