There's a bill with three hits !

Skylimit · Post by **Skylimit** » Sat Oct 05, 2002 10:00 am

The technique right now is in consecutive numbers. So let people use the advanced form, but think about what to do with consecutive.

It is OK for me to enter consecutive, as long as you don't hit someone with it, because that is not possible. In case of a hit, the whole series should be deleted (or deactivated) These attacks are made to deliberitely hit our most interesting bills and/or users.

Another possibility could be to add more x's to the serial numbers.
So it would take a lot more effort to hit someone.

(btw for consecutive, they will find an algorithm to get passed the defence, but now we don't have any defence ... so you don't need any skills to produce a fake hit)

Another thing that can be done, and which I am in favour of, is to have a quotum, as to how many bills you can enter per day. No panic for bhoeyb and HNL, you could make a dynamic quotum, or a quotum that can be modified for users that can be trusted.

Afer one week : max 100 notes ; no access to advanced form
+ no consecutive numbers
after 15 days : max 250 notes ; no access to advanced form
+ no consecutive numbers
After one month : max 500 notes ; access to advanced form if x-notes
were entered with simple form (*) + no consecutive numbers
After two months : max 1500 notes ; advanced + consecutive (if valid e-mail communication was established with webmaster, or forum user created.)
etc ...

This would have blocked Leonardo, Che Gevara, and others, before this hit somebody, and we would have known them as fakers before they did damage.

(*) This is not enough in itself, because new users will be created to do nothing for one month until they get access to the advanced form. So they should be obliged to enter x-notes manually before they can start using the advanced form, which would be pretty discouraging. But I don't believe in new users that start entering hundreds of notes right away. And most of you (we can have a poll) started with simple form, before using advanced form ... (*) let's have a poll

It is of course less friendly for newcomers, but it can be explained why it is necessary.

Donald · Post by **Donald** » Sat Oct 05, 2002 10:08 am

HNL wrote:...if there is no advanced option, it is unfeasible for me to enter all the notes. I hope notes like that could be removed from EBT.

I agree that you, bhoeyb, KHDP, temporarily pinguino 79 and some others would suffer if the advanced option got dropped.

Proposal: CSV files with minimum 500 notes are sent to the webmaster who checks them, before he enters them into the system. I chose for 500, because it should not be more than 10 CSV files per week (it will get worse while EBT grows). My personal limit for manual input is roughly 100 per session, more hurts. So there is a gap for users. who insert 100 - 500 bills per day.

As I mentioned before, this needs discussion. At the moment, I only can offer imperfect solutions.

Skylimit · Post by **Skylimit** » Sat Oct 05, 2002 10:18 am

Please have a go at the poll "use and misuse of advanced form"
so we can learn how fast new users start using the advanced form ...

(I hope not everybody in here was already a regular when the advanced form was first created)

EuroBillTracker · Post by **EuroBillTracker** » Sat Oct 05, 2002 10:21 am

I haven't been really following the thread here because I don't have time.

I have seend that thomas andd others have been discussing the shortcode wrt the serial and value. This is what can really help us kill frauding. We could even imagine not notifying a user who is entering 20 fake bills and just dropping his bills !

however I am starting to think it's not a good idea to discuss this issue and public and I am in favor of creating a member's only discussion forum about this. I'll start a poll

Donald · Post by **Donald** » Sat Oct 05, 2002 10:32 am

I sympathize with skylimit's proposal. It seems to be stringent and easy to automate.
I only propose to allow for small numbers of consecutives. From cash machines I get up to 5 consecutives. I also once had 100 consecutive 5 € bills, freshly from the bank. From my experience the limit for consecutives should be 10 or 20. This prevents users from inserting new bunches.
Getting bunches of small denominations seems to me a behavior which is induced by the will to enter many bills. At least this is my only motivation to do so. Normally I would use what I get from the cash machine. Now, since I am tracking, I take extra care that I get optimum change. Yesterday, I felt really sorry because I gave a 20 € note to the cashier in the supermarket when I had to pay 19 €. It would have been more efficient to have given her the 4 notes of 5 €, I also had in my wallet. This shows me that I am taking eurobilltracking too serious. It should be more of a funny game, not that serious.
Maybe, EBT should rather concentrate on people who have average paying habits, than on sophisticated cash optimizers.

MDeen · Post by **MDeen** » Sat Oct 05, 2002 7:43 pm

Donald wrote:I sympathize with skylimit's proposal. It seems to be stringent and easy to automate.

I agree totally. The details can be discussed about, but I think it is a must to block the advanced entryform to certain users.

Maarten

EuroBillTracker · Post by **EuroBillTracker** » Sat Oct 05, 2002 11:17 pm

bhoeyb wrote:Is it possible for the webmaster to check if the IP-addresses of those guys are the same? Would it be possible to just BLOCK their IP-address so they can't login on ETB anymore?

Just saw this and I have checked. They are the same yes. I can probably block them out but they might spoof them...

Tiger · Post by **Tiger** » Sat Oct 05, 2002 11:49 pm

IP adresses are not always the same....
And if you surf with a proxy, most of the times the IP adress of the proxyserver is given.

My ISP obligates the use of their proxy, so if 1 Telenet-user gets banned somewhere, noone surfing with a Telenet connection can acces the pages anymore.

If you just use a modem, you can change your IP adress by simply redialing.

Skylimit · Post by **Skylimit** » Sun Oct 06, 2002 9:16 am

I think Tiger is right ... I've been on forums that displayed the IP address per default (maybe this could be done per bill entered, or at least, stored in the database for tracking purposes -> tracking trackers, hows that ...? don't get to strict, it's anonymous)

Anyway, I was surfing with a free connection, and all you could tell from the address is : that it was a skynet free subscription + that it changed every time I logged on.

Only thing useful was, that I could not be two forum users at the same time without being suspect (same IP) If you block these IP's you may block a range of users.

I have no clue if this is the same, now I have ADSL ... I suppose the IP is still dynamic, why would it be fixed ?

Olivier · Post by **Olivier** » Sun Oct 06, 2002 3:52 pm

EuroBillTracker wrote:however I am starting to think it's not a good idea to discuss this issue and public and I am in favor of creating a member's only discussion forum about this. I'll start a poll

I agree... The fakers can just read on the forum what kind of solutions we get to prevent them from ruining EBT!

Olivier

thomas · Post by **thomas** » Sun Oct 06, 2002 6:29 pm

EuroBillTracker wrote:I have seend that thomas andd others have been discussing the shortcode wrt the serial and value. This is what can really help us kill frauding. We could even imagine not notifying a user who is entering 20 fake bills and just dropping his bills !

however I am starting to think it's not a good idea to discuss this issue and public and I am in favor of creating a member's only discussion forum about this. I'll start a poll

OK, here I am: I just registered in this forum as "thomas".

Is there a chance to get entry into the moved thread "short codes"?

Thomas

Wouter1 · Post by **Wouter1** » Sun Oct 06, 2002 10:42 pm

When you sign up to EBT, you agree to the EBT terms. Right?

So when some stupid serialist spoils our fun by illegaly entering consecutive notes, it´s time to spoil his life:

make his e-mail address public and SPAM the asshole!

just a thought.

Tiger · Post by **Tiger** » Sun Oct 06, 2002 11:14 pm

ok, but then you need a valid email adress...
I think most of these fakers enter a fake email adress when they register.

That's why I think activation by email is a solution.
They have to get the email, and that way you know the email adress works.