[jonathan-kosgei]

This is actually proof that it works as intended. Our scores are made to be consumed by web applications.

In that context it makes sense that a cloud IP that's used to send mail would be treated with suspicion if it's seen trying to make a purchase on an e-commerce site.

[mindslight]

Please stop making the world a worse place. Every online purchase I make comes from a datacenter IP with resistFingerprinting = true. I've got a good ISP that probably isn't selling surveillance about me, but websites themselves certainly abuse IP addresses (as you're doing here), and I see no reason to browse like some naive jamoke - datacenter IPs are easy to rotate, and fine-grained wireguard is already integrated into my setup.

When web sites increase the amount of hassling (and make no mistake about it, garbage like this, CAPTCHAs, nonconsensual "SMS 2FA" etc are all just hassles to customers), I file support tickets about their broken website. If a website continues down the path of snake oil to the point of becoming unusable, I generally end up no longer being a customer.

[jonathan-kosgei]

Fraudulent activity by bots is a problem that everyone who's managed a large enough website is familiar with.

Most bots originate from cloud IPs or hide behind proxies and VPN services. Our scores ensure that the majority of legitimate users i.e. those coming from residential IPs are left alone, with captchas and other verification mechanisms shown to "high risk" users, that is, users visiting from a cloud provider's networks or a known proxy/vpn provider. This can be verified by the number of comments on this thread by users whose home internet IPs showed a high "Trust Score".

So if anything our scores help reduce the hassle or friction that legitimate users are subjected to by the fraud-fighting tactics employed by different websites.

[mindslight]

"Fraudulent activity by bots" is a contradiction in terms that sounds like you've just mashed distinct issues together to create an emotionally manipulative phrase. Bots are bots, fraud is fraud. "Bots" are an overstated problem - websites should want to publish their information for every type of consumption. If serving some types of consumers causes too high of a load, then the inefficient code is what needs to be fixed. And fraud is not going to be prevented by a CAPTCHA.

> our scores help reduce the hassle or friction that legitimate users are subjected to

I'm telling you right here, I am a legitimate user and when businesses fall for the garbage story you're pushing, it makes me less likely to remain their customer. Hassling customers with repeated rounds of "click on all the cars" "no you're wrong" is terrible UX. It could be understandable if it popped up after a few failed logins in a row, but putting the nagwall front and center is appalling design.

I look forward to Apple's VPN increasingly demonstrating just how wrong your marginalizing surveillance mindset is.

[jonathan-kosgei]

Bots here refers to automated traffic, and I don't think anyone on HN would be surprised by the assertion that most online fraud is automated.

[mindslight]

I would reject that assertion, because it seems to tie a bunch of disparate issues in order to summarily "other" them. It probably makes for reassuring business metrics that are ultimately detached from reality. I'm sure my own browsing patterns are often miscatergorized into a bin of "look at how many bad guys we stopped", ultimately misleading businesses.

Please describe one specific trend/activity you're referencing, where an automated user agent specifically facilitates fraud, beyond merely facilitating users that just so happen to have fraudulent intent. Situations where augmented user agents are claimed to be prohibited via bullshit terms of service do not count.

[xist]

What is the difference between the setup you describe being used for what I assume is privacy, and the same setup being used for nefarious reasons exiting from your presumably consumer level VPS?

[mindslight]

The difference is as you just said - one is being used for privacy, and the other for "nefarious reasons".

It seems like you're trying to imply an association, while avoiding having to make the "if you have nothing to hide" argument explicitly.

[xist]

Not at all.

I'm wondering why you expect the websites you're attempting to utilize to understand your intentions are "pure" when I would argue that setup is vastly more commonly used for nefarious purposes.

They do blocking for a reason. I'm sure if you contacted them they would explain they lose $$$$$$ a year due to fraud/abuse/hack/nefarious attempts coming from setups similar to yours, which dwarfs however much you might buy from them. I understand their position.

There are commercial VPN and security solutions etc that would achieve some of the goals - undoubtedly at a higher cost than what you're running. You would essentially paying for a boost in reputation that websites would recognize as being more on the "good" side than "bad".

It's quite unfortunate for you I agree but I don't blame them at all.

A suggestion - get a more premiere data center host and get a /29 network allocated to you (can be using a LLC for privacy). Essentially become a commercial entity and pass the sniff test for a lot of websites.

Or subscribe to a service that does that for you, and your frustrations will melt away.

[mindslight]

I expect websites to use IP addresses for their purpose of routing packets back to me, and perhaps some slightly-above-L2 concerns like rate limiting.

And yes, I understand these businesses have fallen for snake oil salesmen telling them things like VPSs are indicators of "nefarious purposes". But the actual reality is why would someone with "nefarious purposes" need or want to use a VPS? Rather someone looking to do credit card fraud is going to be using a proxy service that runs through residential connections via cracked machines.

Commercial VPNs, which I also use for some types of traffic, get hassled just as much by websites. So no, that is not a solution.

Getting my own /29 would defeat the entire purpose of browsing from a rotating data center IP, which is to defeat IP-based tracking.

The only way to solve this dynamic is for enough people to start browsing from VPNs, CGNAT, etc, that the snake oil salesmen have to move on to something else.

[byyll]

>these businesses have fallen for snake oil salesmen telling them things like VPSs are indicators of "nefarious purposes"

They are indicators. 95% of the abuse on my VPS came from China, services like Contabo, DigitalOcean, Linode, Azure, Oracle, GCP, M247, and Tor. Some of these are no longer allowed to even reach L7 for my website. One other statistic I noticed is that some of those providers have 0% legitimate traffic.

[data_maan]

The audacity you people are having of shoving unconsented scores down our throats!

I hope you choke on your own scores when a future-AWS-using-your-scores will deny your servers acces, because you accidentally sent an email from that server that was actually supposed to be doing something else.