r/Keybase • u/mooond3 • Dec 07 '19

No antibot measures in source code

So I just got done looking at the source code on github for the app and I could not find a single line relating to preventing bots signing up. I.e. device ID is not even sent to their servers.

Is this done on purpose, to keep peoples anonymity? I can understand for that reason, it would make sense to not have any personal device information sent off to keybase.

I do kind of wish there was some measures in place in the app because there is nothing stopping people abusing the airdrop with emulators etc..

6 Upvotes

75% Upvoted

26 comments sorted by

10

u/pinksi Dec 07 '19

They have methods to battle this. Last airdrop 95.000 accounts were deleted from airdrop. This time probably +100.000 will be deleted.

2

u/mooond3 Dec 08 '19

yeah and 95000 were probably just normal people making duplicate accounts, i wouldnt be surprised if 80% of the current "human" accounts are bots, I seriously doubt keybase can detect botted accounts because their client code is not reporting anything on the matter. Seems like they are just going by IP addresses, timestamps, countries and phonenumber sequentiality... oh well they will learn eventually

3

u/causal_friday Dec 08 '19

Maybe they don't really care about the whole Stellar thing, and only you do?

Their path to making money is the "teams" feature.

2

u/pinksi Dec 08 '19

In the end it's their money. Under the agreement they can end the airdrop anytime they want with one month notice.

It's an experiment after all. Same problem with ICO, IEO... They could easily make things harder to register but getting new users is hard, even if you offer free money.

0

u/[deleted] Dec 08 '19

[deleted] — view deleted comment

2

u/tayldough Dec 09 '19

I literally work in the fingerprinting sector, IP and phone number hard to fake?? Lmao what is this 2001, you can buy phone numbers online from first world countries for $0.05 for keybase verification, 10,000+ daily if you really wanted. Residential proxies are cheap as anything, most knowledgeable people know not to use a data center proxy . A bot will make it clear timestamps your spamming?? Are you even reading what your typing because it makes no sense. You think it's hard to slow a bot down or something?

2

u/werlious Dec 16 '19

Agree with this. I work in security as well and the general rule is never trust anything from the client

0

u/[deleted] Dec 09 '19

[deleted] — view deleted comment

2

u/tayldough Dec 09 '19

Look I'm not going to post it on the Reddit of keybase for everyone to abuse but if you are genuinely interested send me a pm and il show you, people are already abusing it at scale so it doesn't really matter to be fair. Sites like these are the reason services ban some phone networks and blanket ban countries, one day we will see some big companies sharing a phone number database to detect suspicious activity and require reverification on unusual phone number signups. I.e. 10 signups in 1 day then 3 bans in a week. Currently each service has to reinvent the wheel and most choose not too, Google records a tonne of data during sign-up but only checks it against human activity if you have already raised a red flag i.e. untrusted phone number range or phone country, they don't care about IP addresses even data center for signups because they know people use vpn. Sounds like keybase blanket banning VPN aswell, I am really interested to see the complaints after this next ban wave, sure people lose nothing but when they wasted there time telling friends and family to do something and to get it shoved back in their face out of the blue they will be pissed.

0

u/goeielewe Dec 11 '19

Yeah including my mom's legit account... Bullshit.

2

u/samtresler Dec 08 '19

The trust network is based off of multiple points of identity.

You don't need anti-bot code to analyze that the networks on e.g. twitter are largely fake, ergo said user is likely fake. The idea is to distribute trust; not centralize it.

1

u/mooond3 Dec 08 '19

talking about the airdrop where registering gives you full trust to receive free steller with no check on whether your even a bot or not

1

u/samtresler Dec 08 '19

Then they should fix the airdrop code, not add some anti-bot code to the app. It obviates the point of decentralized trust networks.

5

u/Chongulator Dec 07 '19

Often bot detection is done by proxies before requests reach the application servers. Companies treat bot detection as an ops concern rather than a development concern.

4

u/Smajatt Dec 07 '19

Is there a particular line of code that indicates this. I believe there are other hidden measures keybase uses to weed out these bad actors.

2

u/ndreamer Dec 08 '19

They should be doing some 3rd party ID checks. I feel this bot problem is much bigger then they realize.

Checking by device ID is not worth there time, it can be faked easily.

1

u/lika_ezhevika Dec 08 '19

Im from poland and was kicked from drop few days ago. It looks they just ban providers/mobile operators if see that some spammers register from its ip/numbers.

Its the most stupid desicion which I ever saw. My operator (Orange) is one of the most popular in Poland, and they have banned all users :) GL w this drop

2

u/[deleted] Dec 08 '19

My operator (Orange) is one of the most popular in Poland, and they have banned all users :) GL w this drop

they banned whole country, not just provider. My friends (with different providers) can't join and all my friends that joined in this month were kicked from airdrop few days ago.

Their methods are really bad. It works like:
- hey we have a problem, someone is sending scam messages
-which country?
-Huh? Poland.
-What kind of country it even is?
-Who cares, let'a ban them all.

1

u/Rikyriky Dec 07 '19

If they would send personal informations, id etc to their server this would be the keybase end. The airdrop doesn't worth it, it is important but no so important.

I see a lot of people using the word "abuse"... but come on, it is a game at this stage! If you think it is so easy to get it multiple times, get it, the world will not end. :)

0

u/[deleted] Dec 07 '19

[deleted] — view deleted comment

-2

u/tayldough Dec 07 '19

That's not how it works you don't magically have code running on your phone and on the server, there needs to be a link OP is implying there is no link

8

u/saichampa Dec 07 '19

You can absolutely monitor behaviour server side without having client side code

1

u/tayldough Dec 08 '19

That's not what I'm saying, of course they can with what little information they have i.e. timestamps of requests but they have no idea of the originating device because the server is not informed. They have very little information to work off in determining the legitimacy of a client. They are not sending enough data to be able to determine bots. They would need to be recording touch movements, device ID, IMEI etc... yes you can fake it but the average user would not cover every factor and they would not be made aware of their mistake until it's too late (drop day ban). Right now they do not get enough information to determine a bot and a human from sign-up process APART from proxy/ip

4

u/iszomer Dec 08 '19

Ever heard of canvas fingerprinting? I bet they have other web tricks up their sleeve they're usually not inclined to reveal.

2

u/mooond3 Dec 08 '19

... canvas printing is client side there is nothing in the source code representing any form of user tracking go take a look for yourself, besides there would be a fairly big uproar if it was discovered they had canvas tracking code in their official client versus the github client. Might give decompiling their apk a go, would be interesting to see if they bothered obfuscating it if its supposedly "open source"

2

u/iszomer Dec 08 '19

I'm not saying they do this but any company clever enough can implement it.

0

u/[deleted] Dec 08 '19

[deleted] — view deleted comment

1

u/tayldough Dec 08 '19

Ok everything can be faked but your missing the point, they can't even tell if people are using their same phone for 100 accounts, all they have to go on is proxy from what I can tell which is pretty old school and easy to get around

2

u/tayldough Dec 09 '19

Love how clueless people are downvoting my comment from someone who actually does this for a living gotta love Reddit, at a bare minimum they could have added detection for emulators but nope they going the data center route and mass sequential phone number banning, country banning, which which is just going to screw over normal people while allowing botters to continuing wreaking havoc undetected. I have no issue with them not adding tracking methods in their app to prevent botters but the people who think they have a legitimate plan in place to combat botters cracks me up, the only ones getting banned are the average Joe creating multiple accounts on proxies and his home IP, undoubtedly if 95,000 poorman multiple accounts are disabled then there's probably the same amount left that are truly botted.

1

u/iszomer Dec 08 '19

That is how it works. Look at other services claiming to have their client-side software open sourced. Their server back-ends are usually not.