Re:Ask HN: Is there anyway besides a private VPN to make the...
by nunez on Wednesday March 25, 2020 @09:17PM
(#22690030)
It's hostile because malicious actors ensure that we can't have nice things.
CAPTCHAs and reCAPTCHAs may seem nefarious and hostile...until you realize that there are bots on AWS/Azure/${insert_cloud_here} that do nothing but try and brute-force logging into stuff or pay for things on peoples' behalf because they use passwords that were leaked ages ago and so many people use their FB login credentials for their bank and government stuff.
You could add backoffs, retry limits, user agent verification and all sorts of server-side tricks to slow hostile actors down, but services like Lambda make these extremely trivial to bypass now. You could invest in machine learning to detect hostile patterns and defend against them, but that's a really expensive game of whack-a-mole at best and useless at worst, and blocking out IP ranges is really, really easy in comparison.
You could do something like what India does where every service that involves PII must be authenticated with SMS two-factor against a phone number registered in India, but at US scale that would be hard to manage.
CAPTCHAs and reCAPTCHAs may seem nefarious and hostile...until you realize that there are bots on AWS/Azure/${insert_cloud_here} that do nothing but try and brute-force logging into stuff or pay for things on peoples' behalf because they use passwords that were leaked ages ago and so many people use their FB login credentials for their bank and government stuff.
You could add backoffs, retry limits, user agent verification and all sorts of server-side tricks to slow hostile actors down, but services like Lambda make these extremely trivial to bypass now. You could invest in machine learning to detect hostile patterns and defend against them, but that's a really expensive game of whack-a-mole at best and useless at worst, and blocking out IP ranges is really, really easy in comparison.
You could do something like what India does where every service that involves PII must be authenticated with SMS two-factor against a phone number registered in India, but at US scale that would be hard to manage.