Anti hack/probing/bot ideas (after today's probing attempt)

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Oct 14 23:43

(1)

(0)

#2326

I have reason to believe we just had our first probing attempt that I'm aware of. Someone spun up an account and posted a "listing" that wasn't a listing at all, just every field stuffed w/ junk to test whether the site would run code they typed in instead of just showing it as text. I hope nothing ran, IDK lol?

Also dropped a test thread here on the forum and then left a reply calling it an "authorized XSS assessment". Nobody authorized anything AFAIK. I'd consider this type of testing done w/o permits on the site potentially malicious/dangerous.
https://xmrbazaar.com/forum/topic/400/

There are some ways we can potentially slow these kind of probing type of attempts.

1. Proof of work on signup and on posting a listing. Something like Anubis or mCaptcha.
Wastes some CPU cycles, adds some friction.

2. New accounts can't publish right away. Either a short waiting period or the first listing sits in review before it goes live. Well obviously this's a big friction.

3. A small refundable XMR bond to post. Same idea as the bond/escrow thing for new swappers, and it's the most Monero native option I can think of RN.

None of this stops one determined person. It can delay/slow someone just asking some LLM to "go try to break this site" potentially.

Thoughts?

Edited: Oct 14 23:51

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

nobswebdev

5 (269)

Posts: 73

Earned: 0 XMR

Tipped: 0 XMR

Oct 15 00:01

(1)

(0)

#2328

Reply to post #2326

I would just make sure there is no XSS or any other vulnerability on the website. You can't reliably stop hackers from searching for vulnerabilities.

Tip Monero to nobswebdev

8C3UDYTrTQ34bqLVA3QhRacELDBDEGCixSKd1rqJeWoKjS4m1qHbcNphJNEzs67phXSwD5RbVj5bpTm7HtZjYjVHUiMZ4rk

Publish Tip to nobswebdev

Please login to publish your tip

CANADA

N/A (0)

Posts: 9

Earned: 0 XMR

Tipped: 0 XMR

Oct 17 00:06

(0)

#2361

I enjoy observing the huge discrepancies betweens devs and actual users, business onwers and so on when it comes to delivering products. The devs are smart no doubt, they know programming and some know math but when it comes to business, user experience, or reasons for doing something, they are absolutely retarded. I'm not reffering to here so don't cry yet, it;s just a general observation from a decade or two of reading the forums around tech and btc.

Now prepare to cry

Ideas 1-3 are bad, they do nothing but impede the users. Having someone come to your site and test your form has been happening for 20 years. They often don't do much else. There is no sense holding back posts either, the community is pretty good at flagging, nobody buys new scammers stuff and they go away after being deleted. Bots do very little harm. I often look at logs with thousands of tests a day, nothing happens. that's like the resources of a grain of rice. And don't even mention anubis, when I see that rodent it's a quick X and I'm off to another search.

If you want people to buy things and sell things, make it is smooth and hassle free as possible. people often leave just because of an uncomfortable feel and too many bells and whistles. I still buy and sell more on craigslist than anything because it only servers one purpose, to buy and sell without accounts, captchas, trackers etc..

I would not bother with fixes until there is a noticable financial loss or gross abuse from scammers/bots.. I don't see that, just a handful of bad users doing scams.

Tip Monero to CANADA

CANADA has not setup a {COIN} tip address yet.

Publish Tip to CANADA

CANADA has not setup a {COIN} tip address yet.

XmrBazaar

Anti hack/probing/bot ideas (after today's probing attempt)