TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Sending spammers to password purgatory

349 pointsby itsjlohalmost 3 years ago

31 comments

vanviegenalmost 3 years ago
For our dating site, which of course has to deal with many prinses, Nigerian or otherwise, when we manually verified an account to be a scammer, we reject logins with a message stating that the IP address has been blocked. Scammers will usually go through all of their VPNs&#x2F;bots in order to try to login, allowing our system to flag them all.<p>We&#x27;ll manually review all accounts that use (more than one of) those ip addresses. Works like a charm! :-)
评论 #32341546 未加载
评论 #32341067 未加载
评论 #32364967 未加载
评论 #32340756 未加载
评论 #32341654 未加载
评论 #32341267 未加载
armchairhackeralmost 3 years ago
Ok, I have no issue with tactics like these when they&#x27;re wasting spammers&#x27; time. But sometimes it seems like real users get caught up in these honeypots for scammers and hackers.<p>A lot of the crap real sites make people go through e.g. when they lose access to their account or login to a VPN or the site just &quot;can&#x27;t verify their identity&quot; for some reason. Where you go through a bunch of hoops and captchas, only to have some step fail or reach a dead end. They really seem like they&#x27;re just set up to intentionally waste people&#x27;s time.<p>For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. It&#x27;s a lot more annoying than just saying &quot;you have been locked out of trying to log in for X hours&quot;.<p>But this, this is fine. It&#x27;s pretty clear that the person you&#x27;re targeting is a spammer, and it&#x27;s pretty clear to the user after about 60 seconds that you&#x27;re password system is a joke.
评论 #32339004 未加载
评论 #32339114 未加载
评论 #32339344 未加载
评论 #32338849 未加载
评论 #32339400 未加载
评论 #32339235 未加载
drfuchsalmost 3 years ago
Troy, watch out you don&#x27;t open yourself up for an attack from the bad guys: They&#x27;ll start sending you solicitations with ReplyTo addresses of industry honeypots, and before you know it, you&#x27;ll become a known spammer and your regular outgoing emails will be routed to recipient&#x27;s spam folders or maybe even dropped entirely.
评论 #32339669 未加载
评论 #32340964 未加载
ghgralmost 3 years ago
You can check in their GitHub repo [1] the list of reasons to reject your password (classified by level of &quot;InfuriationLevel&quot;). Some examples:<p>&#x27;Password must contain at least 1 primary Simpsons family character&#x27;<p>&#x27;Password must contain at least 1 Nordic character&#x27;<p>&#x27;Password must contain at least 1 Greek character&#x27;<p>&#x27;Password must contain at least 1 primary Griffin family character&#x27;<p>&#x27;Password must contain at least one emoticon&#x27;<p>&#x27;Password when stripped of non-numeric characters must be a number divisible by 3&#x27;<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;troyhunt&#x2F;password-purgatory-api&#x2F;blob&#x2F;master&#x2F;index.js" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;troyhunt&#x2F;password-purgatory-api&#x2F;blob&#x2F;mast...</a>
评论 #32342219 未加载
评论 #32342542 未加载
评论 #32350028 未加载
brightballalmost 3 years ago
This is awesome and it works!<p>I did the same thing 10 years ago and it was one of the best morale builders for our team after all the time we spent dealing with these folks.<p><a href="https:&#x2F;&#x2F;www.brightball.com&#x2F;articles&#x2F;waste-spammers-time-to-reduce-their-return-on-investment" rel="nofollow">https:&#x2F;&#x2F;www.brightball.com&#x2F;articles&#x2F;waste-spammers-time-to-r...</a>
inopinatusalmost 3 years ago
This reads more like Microsoft content marketing than a serious attempt to do anything of value.
评论 #32348619 未加载
thenoblesunfishalmost 3 years ago
This reads a bit much like an ad. I sure have to scroll through a lot about Microsoft, Cloudflare, etc. before the funny password requirements I came for, at the verrrry end.
评论 #32340757 未加载
rainsurfalmost 3 years ago
This is a cool project, but I would more concerned that replying to spammers confirms you are real and that could result in much more spam. So is the net increase in pain your own?
hot_grilalmost 3 years ago
There are simpler and more effective ways to waste spammers&#x27; time. First of all, I can&#x27;t remember the last time I&#x27;ve gotten email spam that expected a response. On the other hand, phone spam, which is much more disruptive, is usually trying to screen me briefly then funnel me to a scammer.<p>So I pick up spam calls, press 1 immediately, then put the phone back in my pocket. This usually connects it to a real person who hears ambient noise, thinking I&#x27;m nearby. Usually I waste like 60sec of their time for 2sec of my time. It&#x27;s hard for them to protect against this because no matter what, they need some victims to talk to the real person, unless they develop a very smart AI. But a relatively simple bot with a list of likely scam numbers could automate the fake victim&#x27;s side.<p>A colleague was dealing with more advanced scammers who had already made some progress with his unaware mother. Their scam was unique in that it required calling them back. He managed to collect all the phone numbers they were using, then he put up fake Craigslist ads for free couches... and you can guess the rest.
评论 #32351106 未加载
Pxtlalmost 3 years ago
I assume your starting password rules deliberately set the bar low to encourage PRs to improve it, since I can think of much more believable, infuriating, tedious ways to drag this out longer, keeping the user thinking they&#x27;re always one step away from a valid password without being obviously silly.<p>Believable, stupid requirements I&#x27;ve seen in the wild in the bad early days of complexity requirements.<p>- your password contains a common word<p>- your password contains one or more repeating characters<p>- your password contains a forbidden character<p>- your password needs at least one additional uppercase letter<p>- your password needs at least one more distinct special character<p>- your password cannot end with a special character<p>- your password contains an escalating series of numbers<p>- your password is too short<p>- your password is too long
评论 #32339165 未加载
评论 #32341378 未加载
评论 #32339935 未加载
评论 #32341201 未加载
评论 #32341982 未加载
itsjlohalmost 3 years ago
I had to change Microsoft -&gt; MS and Cloudflare to CF otherwise the title wouldn&#x27;t submit.<p>Original title in full is: Sending Spammers to Password Purgatory with Microsoft Power Automate and Cloudflare Workers KV
kazinatoralmost 3 years ago
&gt; <i>Because it would be rude not to respond, I&#x27;d like to send the spammer back an email and invite them to my very special registration form.</i><p>Don&#x27;t do that. No, really, don&#x27;t.<p>Okay, you didn&#x27;t listen and did it anyway; please, at least don&#x27;t <i>automate</i> it or semi-automate it where you&#x27;re just doing it with one click.<p>&gt; Spammer burned a total of 80 seconds in Password Purgatory<p>So you <i>think</i>, based on the belief that when you reply to the spam, it goes back to the spammer.<p>That may not be the case; when you engage spam, you are possibly generating &quot;backscatter&quot;; a person having nothing to do with the spammer may receive the e-mail.<p>Spam messages are not always relying on someone replying to them to hook in the victim. Sometimes there is no hook at all, or sometimes the hook is in the HTML links, and not in replying. (They additionally hope that if you reply, the person you are replying to will also get the spam e-mail, since it is quoted, and <i>that</i> person will click on the links.)
sedatkalmost 3 years ago
Back in early 2000&#x27;s, I&#x27;d written a simple ASP page that produced infinite amount of random email addresses page by page. Had any crawler bot got caught up in it, it&#x27;d keep filling its database with these nonsense email addresses. I&#x27;d distributed its source code too. Troy Hunt&#x27;s project made me remember it.
LinuxBenderalmost 3 years ago
Nice! I like things that keep spammers and scammers busy.<p>My own low-effort method is to accept mail for any domain on my name servers. Spammers think they are relaying their scams but it just goes to a flat text file. It isn&#x27;t like I try to hide it. The banner even says its a honeypot and not to use it.<p><pre><code> 139K &#x2F;var&#x2F;spool&#x2F;mail&#x2F;vhosts&#x2F;crap 24K &#x2F;var&#x2F;spool&#x2F;mail&#x2F;vhosts&#x2F;crap 177K &#x2F;var&#x2F;spool&#x2F;mail&#x2F;vhosts&#x2F;crap 196K &#x2F;var&#x2F;spool&#x2F;mail&#x2F;vhosts&#x2F;crap </code></pre> That&#x27;s 4 days of spam&#x2F;scams.
creeblealmost 3 years ago
Cute idea, but my guess is that 80% of the reply-to in spam emails are either forged or fake.<p>They’re not typically trying to get you to reply - they’re trying to get you to click a link.
efitzalmost 3 years ago
The complexity requirements pretty quickly become unreasonable, to the point that I would have realized they weren’t serious after like the 2nd try.<p>To be really evil, Troy should play with the password field- make it not a text or password field, but rather some sort of custom input field that doesn’t work with password managers and doesn’t allow paste.<p>Also maybe return errors sometimes that are themselves erroneous.
评论 #32342923 未加载
hot_grilalmost 3 years ago
I&#x27;ve seen worse password purgatories in the wild. One was the Princeton undergrad acceptance (or should I say rejection) portal, which for some reason required registration even though I was entering a key from an email. It was something like:<p>1. marcopollo – Password must contain at least two numbers. 2. marcopollo11 – Password must not begin or end with a number. 3. m1arcopoll1o – Password must not contain two of the same number. 4. m1arcopoll2o – Password must contain at least one special character (! ? &amp; % $ # @). 5. m1arcopoll2o! – Password must not end with a special character. 5. m1arcopoll2!o - Password must not contain 3 or more of the same letter. 6. m1arcopoll2p! - Password must not contain 2 of the same consecutive character. 7. I forget, but it kept going.<p>At some point, I gave up and started generating random passwords. The first 3 attempts were still not accepted. In a way, those restrictions were actually reducing the entropy.
orliesaurusalmost 3 years ago
I love that the endpoint was called `&#x2F;create-hell` - that got me chuckling reminding me of Stone Cold Steve Austin from WWE&#x27;s motto:<p>- Arrive, Raise Hell, Leave
thih9almost 3 years ago
The article shows only a single and relatively short “purgatory” session. Are there more? Is there a place that lists or provides a ranking of them?
Double_a_92almost 3 years ago
This seems kinda silly... Basically he sends his own spam back to the spammer. I expected something cleverer.
评论 #32341081 未加载
kaiusbrantleealmost 3 years ago
This will work on some spammers but not forever. This is an infinite cat and mouse game.<p>For better or for worse, &quot;publicizing spammers pain for our pleasure&quot; has a guaranteed effect of shortening the useful lifespan of this tool. Unless of course no spammers ever read that article, OR HN.
评论 #32344816 未加载
archi42almost 3 years ago
I like the idea, but upon pondering, I think it could be made better by imitating other dark patterns:<p>1. Ask for a username, only offer &quot;OK&quot;<p>2. Upon OK: Wait 2-3s while showing an ajax spinner, then add another box to the DOM, asking for an &quot;e-mail&quot;<p>3. Rinse and repeat with first name + last name; then company name; country (pick from a list of ~50 widely known country names, sorted by median age of the population - remove the IPs country of origin, so they have to pick &quot;other&quot; and enter it manually)<p>4. Tell the user the username doesn&#x27;t match the expected format and offer to add a random &quot;#1234&quot; for them - upon doing so, back to square one (except their username is now &quot;#1234&quot; and not &quot;scamoverlord#1234&quot;). make sure to flush the other info as well.<p>5.1. Tell them you&#x27;re sending a verification mail (you don&#x27;t). Offer them to resent it after 30s.<p>5.2. Upon &quot;try again&quot;, tell them first to check their mail address, and lock the &quot;try again&quot; for another 10s.<p>5.3. Now, after another 30s, tell them there must be an error with the mail gateway (there is no mail gateway) and offer them to continue; the verification mail is queued and will be sent later (-&gt; you&#x27;re sooo super userfriendly!).<p>6. Now the user&#x2F;victim easily spent 90s to enter &quot;valid&quot; details and must be quite invested. Show a re-captcha style captcha before asking for password (after sending an email and possibly spamming someone? yeah, maybe put that before the fake mail verification, I came up with that in the wrong order).<p>7. the &quot;checking if you&#x27;re human&quot; should fail after 3-4s (spammers are used to that).<p>8. Then the first of the 9 captcha images should pop up afer 1-2s initial &quot;loading time&quot;, the other ones after another .5 - 2s, each.<p>9. Let the first one or two captchas fail no matter what (two if they&#x27;re fast, one if they&#x27;re already spending a lot of time there - plausible if you&#x27;re handpick terms + images for which foreign speaker often don&#x27;t know the exact meaning; like &quot;barnacles&quot;, &quot;melange&quot;, &quot;cabin&quot;, &quot;truck&quot;, or showing differnt styles buses and asking for &quot;tram&quot;).<p>10. Three times the charm: Accept any answer, as long as the &quot;user&quot; spent more than 4s on it (use a simple term with obvious images to make it plausible, like &quot;birds&quot; or &quot;cars&quot;).<p>11. finally get started with the password. Let them do four or six levels.<p>12. What&#x27;s that, the the captcha timed out and&#x2F;or too many bad password tries? Are you sure you&#x27;re not a bot? Well, do it again! (maybe let them only fail once to keep them hooked)<p>13. Oh no, the password field has been reset after the captcha was solved. At least you now know how to do a rule-abiding password. So let them do all the levels.<p>14. If they&#x27;re really persistent, fake a &quot;oh no, your tab crashed, reload?&quot; screen for their browser.<p>Uuuuh, I think I put that on my infinite todo list.<p>PS: Have them write &quot;a few words&quot; about their business. Make sure to garble copy&#x2F;paste (e.g. reverse word order or just reset length counter to 0, increase decrease from there and do a proper recount on submit). On submit, verify the input for a few seconds and claim that it&#x27;s either to short or too long (if they wrote &gt;500 chars, say it should be 200-400, if they wrote &lt;500 chars, ask for 600-800). And remember to keep the char counter broken (update only after not typing for 2s, making the input field not readable for another second while &quot;counting&quot;). Bonus points if a WYSIWYG editor widget is used, which of course takes 5 to 10s to load; or have a &quot;worker&quot; at Amazon Mechanical Turk review it (only takes 30 to 90s).<p>PPS, for balls of steel: Add a second act by only enforcing the first few levels. Then, upon login, tell them they need to change their password. Maybe also tell them if they install your &quot;super special&quot; security extension, they can use weaker password rules. If they stupid enough to really install it, let it send a &quot;X-Block-Me: I am a scammer&quot; header along with every http&#x2F;s request.
评论 #32344376 未加载
joshxyzalmost 3 years ago
Thats evil and hilarious lol. Password must start with a cat, end with a dog haha.
评论 #32340042 未加载
mattmaroonalmost 3 years ago
This is hilarious but I wonder if many actually fall for it.
评论 #32338418 未加载
chad_strategicalmost 3 years ago
I do something kinda similar to this, but using the google mail api. Then I send them to my site were there are some ads impressions for them.
jmoualmost 3 years ago
blinry used this idea as a game concept! <a href="https:&#x2F;&#x2F;blinry.org&#x2F;you-shall-not-pass&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blinry.org&#x2F;you-shall-not-pass&#x2F;</a>
annoyingnoobalmost 3 years ago
I would pay for this as a service.
miedpoalmost 3 years ago
This reminds me of SpAmnesty.
legalcorrectionalmost 3 years ago
This is wrong. You are logging their password attempts and then sharing them with the world. It doesn’t matter that you think you know they are scammers. What gives you the right to dispense vigilante justice by disclosing people’s passwords? Shame on you.
评论 #32339695 未加载
评论 #32340021 未加载
评论 #32343304 未加载
评论 #32346303 未加载
bo1024almost 3 years ago
I wouldn&#x27;t be comfortable doing this, for one thing, we know people tend to re-use passwords. So any email&#x2F;password info you collect should be treated with security like they just gave you their bank login, because some of them did. So then Troy has to report himself to his own service (haveibeenpwned).
评论 #32339683 未加载
评论 #32346657 未加载
thomassmith65almost 3 years ago
<p><pre><code> Spammer burned a total of 80 seconds in Password Purgatory </code></pre> The ability to deal with a bad actor by wasting a minute and 20 seconds of his&#x2F;her time isn&#x27;t cause for fist-pumping or high-fiving. The internet needs a better way to verify user identity. The lack of online accountability isn&#x27;t worth the cost anymore.
评论 #32340272 未加载