11 ms·
I don't think device fingerprinting is the right approach here. Client-side detection can always be sidestepped, and you need to intermediate the actual infere
by mlenhard 2mo ago
I don't think device fingerprinting is the right approach here.
Client-side detection can always be sidestepped, and you need to intermediate the actual inference to get enough signals to make an accurate prediction. There are hundreds of listings for cursor tokens/credits right now.
We use canary values to detect the resellers, and I believe that's the only approach that will actually work at scale.
- reliabilityguy 2mo ago> We use canary values to detect the resellers, and I believe that's the only approach that will actually work at scale. Can you elaborate how it works? Specific sequence of tokens acts as a canary?
- nikcub 2mo agosign up for the resellers, insert a random id canary into your requests, trace them back on your server to tie it to an account find fingerprints / signatures of the accounts being used. ban all of them. eventually build an ml based system that detects these at signup reinforce with more data. loop forever, etc.
- grinich 2mo agoWe do a lot more than device fingerprinting including training custom fraud models. We don't broadly publish our techniques for detection since that would make them much easier to circumvent.