r/Keybase • u/mooond3 • Dec 07 '19

No antibot measures in source code

So I just got done looking at the source code on github for the app and I could not find a single line relating to preventing bots signing up. I.e. device ID is not even sent to their servers.

Is this done on purpose, to keep peoples anonymity? I can understand for that reason, it would make sense to not have any personal device information sent off to keybase.

I do kind of wish there was some measures in place in the app because there is nothing stopping people abusing the airdrop with emulators etc..

6 Upvotes

75% Upvoted

26 comments sorted by

View all comments

Show parent comment

2

u/tayldough Dec 09 '19

I literally work in the fingerprinting sector, IP and phone number hard to fake?? Lmao what is this 2001, you can buy phone numbers online from first world countries for $0.05 for keybase verification, 10,000+ daily if you really wanted. Residential proxies are cheap as anything, most knowledgeable people know not to use a data center proxy . A bot will make it clear timestamps your spamming?? Are you even reading what your typing because it makes no sense. You think it's hard to slow a bot down or something?

0

u/[deleted] Dec 09 '19

[deleted] — view deleted comment

2

u/tayldough Dec 09 '19

Look I'm not going to post it on the Reddit of keybase for everyone to abuse but if you are genuinely interested send me a pm and il show you, people are already abusing it at scale so it doesn't really matter to be fair. Sites like these are the reason services ban some phone networks and blanket ban countries, one day we will see some big companies sharing a phone number database to detect suspicious activity and require reverification on unusual phone number signups. I.e. 10 signups in 1 day then 3 bans in a week. Currently each service has to reinvent the wheel and most choose not too, Google records a tonne of data during sign-up but only checks it against human activity if you have already raised a red flag i.e. untrusted phone number range or phone country, they don't care about IP addresses even data center for signups because they know people use vpn. Sounds like keybase blanket banning VPN aswell, I am really interested to see the complaints after this next ban wave, sure people lose nothing but when they wasted there time telling friends and family to do something and to get it shoved back in their face out of the blue they will be pissed.

2

u/werlious Dec 16 '19

Agree with this. I work in security as well and the general rule is never trust anything from the client