AWESOME!! I really like the automated "monitor and react" method of dealing with scanning bots.

To help harden the countermeasure effectiveness, could these be implemented:

• Have seller option "require user Steam login before showing 'resolve' link" (further prevent fresh bots from ever viewing my Steam ID while maintaining SEO for my post contents)
  
• Expand 'resolve' link monitoring to "logged in by Steam" users and block specific users, not just IP addresses

These two measures should help harden the phishing bot countermeasures by:

• Not exposing 'resolves' to fresh collector bots
  
• Prevent proxy server hopping by collector bots even if they are logged in by Steam to beat IP bans
  
• Further increases the complexity of successful collector bot code (disincentive to create smarter bots)
  
• Give sellers more active options to combat phishing

Thanks again for the excellently effective efforts!! ^_^

Joe.

@Cheese Flavored Ya, captchas have been requested many many times, but the dev team here has shot down the idea each time. Even the idea of "make it an option to have just my own trades at my request (settings option) require a captcha to contact me" was shot down harshly.

Agreed. The point was to slow down phishing; nothing can stop it. I would much rather deal with one phisher a day (my current rate) than 5-8 every time I bump like it was a week ago. IMHO, the current measure has been pleasantly effective. (Thank you again, kind developers.)

Rock on! Thank you very much for your hard work!! ^_^

Originally posted by Sneeza™:

The reason that anonymous users are able to see some portions of the website (homepage, backpacks + profiles) is because our Search Engine Optimisation relies on it. If we blocked anybody that isn't logged in from accessing those pages then our SEO would tank and the site would receive less traffic and not even appear on search engines in good results. As you said somewhere else in this thread, Outpost is a business. We need good SEO, so that option is out (and no, before you suggest, we can't selectively block the pages for search engine bots because phishers could impersonate googlebot incredibly easily).

I see and understand. However, I have only asked for selective pieces of information to be hidden (mainly Steam ID) but not whole pages or sections of the site. My personal Steam ID should not affect SEO

Originally posted by Sneeza™:

If we were to not display your steamid unless you agree to a trade then that would cause a couple of issues:

- User experience would be slower - people would have to offer on a trade, wait until the other user eventually comes back on the site, accepts the trade. The buyer then has to visit the site again after this and add the trade owner. The trade owner then accepts at some arbitary time and the trade is performed. Having to wait for users on Steam is slow enough, adding another layer at Outpost would be too much.

But this slowness is something that I want to opt-in for my trades, not for the site as a whole. (see other phishing countermeasures threads) If I want to inconvenience my personal trade customers so that I can get less phishing bot leads, it should be up to me. I agree, doing it globally could be bad.

Originally posted by Sneeza™:

- We'd still have to show your avatar and username (partially SEO, partially user experience) which would mean that any bot could perform a quick lookup of the name on steam community and match the avatar url with the one on Outpost. Hey presto, they have your profile.

That is fine, but it still makes more work for phishers. I could change my username to "Fluttershy" so automated matching bots wouldn't be able to match me from the thousands of similar usernames. Either way, my own singular personal Steam ID won't affect SEO if it is not displayed anonymously.

Originally posted by Sneeza™:

Of course, we're always looking for ways to limit the effects of phishing bots but we haven't yet found a solution which doesn't cause damage to our own website at the same time.

I suggest crating some countermeasures and adding options for users to turn them off and on. If they work, users will use them; if the measure don't work, users will turn them off.

Howdy!

I've only been on these forums for a few days, but it seems that thread locks are used quickly and frequently around here. Of the 15 threads on the first page, only 4 are available for comment and of the 75 most recent topics, only 25 are open to chat. That translates to a discussion repression rate of 66% to 75%. Is repression of open discussion a common practice among Steam forums or just here?

Thanks and have a great day!

Joe.

Correct. I want to make the phishing process more difficult. Hiding my Steam ID would accomplish that.

@1337Walrus #bread Since there is not a list of ideas, it is hard to tell is an idea is actually new or not. From what I could find out, this idea has not been submitted as described. If you know otherwise, please point me to the thread with the idea. I would appreciate it. ^_^

Yes, there are many places to get my Steam ID. However, my Steam ID is harvested most often whenever I bump a trade here at the site. My goal in suggestions here is to hopefully reduce the ability of phishing success whenever a trade is submitted or bumped here.

According to the list of rejections, this idea here may be a new one.

I guess the main issue is: How are phishing bots using this site to succeed a phishing and how can the site disrupt bot success? My point of view is that bots are getting Steam IDs from the site. How can the site disrupt that?