Hundreds of parameters are used to identify unauthorized access to your accounts.
Seriously, no sarcasm here, I'm actually curious about those hundreds of parameters.
Hundreds of parameters are used to identify unauthorized access to your accounts.
Seriously, no sarcasm here, I'm actually curious about those hundreds of parameters.
That isn't obvious at all. Quite contrary, I'd say a refusal to go into detail puts the whole thing under a pretty dark cloud, making the entire thing sound entirely scammy.
Even if we assume that you have all of the data you need (as an external service, with the limited information the various services provide) to create such a usage profile, there is no credible reason why you can't detail the mechanisms.
We aren't an ignorant crowd. There is limited information that you can monitor.
Password reset emails. Sure. Access suddenly being revoked. Right. Weird posts at odd times of night. I guess.
Outside of that, there is little belief that you're circumventing any sort of mechanisms at any of these providers.
No-one is running to this website because they have a secret sauce of heuristics. Nor is it stop a motivated competitor from reversing it.
Lose-lose situation.
>unless your signals are something trivial a hacker could mimic
Name any security product out there, whether they make software tools or hardware appliances, and chances are there is a set of trivial signals a malicious actor can mimic to appear to be trusted by that product, or a set of trivial signals to avoid to prevent being considered malicious.
And yet those products can still provide tremendous value. There is serious value in a large team of intelligent, experienced, resourceful people spending 8-10 hours a day tracking fraud and crime patterns so they can detect suspicious activity and meticulously add to and update their signatures. Yes, if their list of signatures was published on a fraud forum, the fraudsters would see it and take advantage of it and the company would have more workload trying to detect the new pattern changes. But it's still a useful service for many people.
My only concern in OP's case is that neither he nor his company has any track record in the security industry. He's perfectly reasonable to not reveal the precise technical details of how they're detecting suspicious activity, though.
Does Gmail tell people the signals it uses for spam classification?
Actually even today, does Google tell the signals it uses for its new Recaptcha?: http://googleonlinesecurity.blogspot.com/2014/12/are-you-rob...