I'd caution against expecting them to make any difference against someone with resources.

It's all about raising the bar. Nobody can reasonably expect to defeat someone with resources - if pretty much anyone poured in enough time, they could harass any small service as much as they wanted. ~~They could also look for people like theabbie posting working exploits in public without responsible disclosure~~

Story time!

I actually discovered an exploit a few years ago that allowed you to create mass amounts of Discord accounts, with no email address or password, and then use them like normal registered users. Pretty sure I was around 12 back then. (My account has since been deleted, so there's no more COPPA non-compliance.)

That's a nice example of how one person can cause disruption. If I had registered, say, 100 accounts, and then run bots on them with the then-far-too-capable discord.py library, I could have sent 1000 messages per second in any server that I chose. That was before Discord search, so any message caught in the crossfire would have been completely drowned out, and I would have stressed the crap out of that Discord server. The moderators would've had to ban 100 individual user accounts, making the whole situation a complete mess. I had far too much power and I was only 12. Needless to say, I (and my botnet) got deleted before I could use most of that power. That was definitely for the better.

It was only possible because... Discord sometimes did not show a captcha when creating a new account, allowing me to use cheap free services like Runscope to make new accounts from all sorts of IP addresses that couldn't be traced back to me! And Discord allowed you to create accounts without filling in account information! On top of that, it allowed you to join the accounts to servers and send messages without ever actually authenticating over websocket! Absolute dream for any exploiter.

Yes, I did abuse the API significantly and I did not disclose anything to Discord. They had to track me down and ban me on their own. I regret that, but it's a cool story to tell, even though 12-year-old me was literally a toxic hacker. Every single API hole I've mentioned has since been patched, and they also added a captcha to the bot authorization screen after I collected every public bot on Discord in one server.

There are so many stars that aligned to allow that, and compromising any one of them would have hindered it significantly. The goal is to knock as many stars out of alignment as possible to make it as difficult as possible for someone with resources to assemble a proper attack strategy. That is the goal of captchas, new member limits and so on. And that would have prevented my 12 year old rampage.

Hopefully, that will also help this project prevent future 12 year old rampages from any other aspiring hackers. We'll just have to wait and see which measures are going to be put in place. :P

Anti-spam tools #13

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions