Closed
Bug 1036893
Opened 10 years ago
Closed 10 years ago
Loop server needs to disable an account which matches a set of rules
Categories
(Hello (Loop) :: Server, defect, P2)
Tracking
(Not tracked)
VERIFIED
WONTFIX
mozilla35
People
(Reporter: RT, Unassigned)
References
Details
(Whiteboard: [qa?])
User Story
As a Loop user, I want the Loop service to prevent me from being abused to the extend of what is technically possible so that I feel safe using Loop.
No description provided.
Comment 1•10 years ago
|
||
Do we really want this to be automatic? Who can report that? How do we track this is not used to make accounts un-usable for the users?
Reporter | ||
Comment 2•10 years ago
|
||
(In reply to Alexis Metaireau (:alexis) from comment #1) > Do we really want this to be automatic? Automation will be required to lower support staff involvement. Even if manual deletion would be based on a set of rules which we could apply to an automatic deletion algorithm. Who can report that? Client bugs allowing to report abusers: Desktop client abuse report: https://bugzilla.mozilla.org/show_bug.cgi?id=1036879 Standalone UI abuse report: https://bugzilla.mozilla.org/show_bug.cgi?id=1036882 How do we track > this is not used to make accounts un-usable for the users? This is where we need some clever rules, probably a mix of: * An account can be disabled if X abuse reports have been made by Y different accounts * An account can be disabled if X abuse reports have been made by Z different IP addresses * An account can be disabled if X% of its calls result in abuses * An account can be disabled if it was created less than X days ago
Reporter | ||
Updated•10 years ago
|
Summary: Loop server needs to disable an account which has 2 or more abuse reports against it → Loop server needs to disable an account which matches a set of rules
Reporter | ||
Updated•10 years ago
|
User Story: (updated)
Updated•10 years ago
|
Whiteboard: [qa?]
Comment 3•10 years ago
|
||
If we're doing this automatically, we need to be really careful about bogus abuse reports, especially if abuse reports against Loop could cause users to lose their other account features (find my phone, sync, etc). It needs to be clear to the user against whom an abuse report has been logged that such an action has been taken, so that they can avoid interacting with users who have marked them as abusive. We probably also want to make sure that abuse reports eventually age out (I'm thinking months or years).
Reporter | ||
Comment 4•10 years ago
|
||
(In reply to Adam Roach [:abr] from comment #3) > If we're doing this automatically, we need to be really careful about bogus > abuse reports, especially if abuse reports against Loop could cause users to > lose their other account features (find my phone, sync, etc). > I assume that we can't prevent a specific service from being used by an account rather than deleting an account? If Loop can be enabled on an existing FxA can't we disable Loop and prevent further re-enablement rather than delete the account? > It needs to be clear to the user against whom an abuse report has been > logged that such an action has been taken, so that they can avoid > interacting with users who have marked them as abusive. Rather than informing the abuser, I propose the following implementing what we can to prevent re-abuse: * Account user reporting abuse from another account user: We offer a "Report and block" feature rather than just "Report" so that in scenarios where 2 account users are involved, the reporter automatically blocks the abuser (I needInfo Darrin here to modify the UX for reporting users). * Account-less user reports abuse: We offer a "Report and revoke link" option rather than just "Report" * Link clicker reports abuse: Nothing can be done here apart from just reporting the abuse. I don't think we should notify the abuser but rather implement a solution preventing auto deletion of accounts where abuse has been reported by the same IP address multiple times. > > We probably also want to make sure that abuse reports eventually age out > (I'm thinking months or years). https://bugzilla.mozilla.org/show_bug.cgi?id=1036889 refers to 2 years as discussed with Geoff
Flags: needinfo?(dhenein)
Flags: needinfo?(adam)
Comment 5•10 years ago
|
||
Agree that when we get to reporting abuse, "Report and Block" should be the default action.
Flags: needinfo?(dhenein)
Reporter | ||
Comment 6•10 years ago
|
||
Moving to FF35 based on Mika's comments that legal does not require this feature for initial launch.
Target Milestone: mozilla34 → mozilla35
Comment 7•10 years ago
|
||
I'm a bit confused here. Let me try to resume what I understood so far: - We need the client to be able to block contacts locally (e.g. the server is notified of the calls but the client rejects it automatically). - We want a way to report an abuse on the server side for a particular user; - Once a defined number of abuses is reached for a specific user, block it on the server side. Would this proposal work okay for you?
Reporter | ||
Comment 8•10 years ago
|
||
(In reply to Alexis Metaireau (:alexis) from comment #7) > I'm a bit confused here. Let me try to resume what I understood so far: > > - We need the client to be able to block contacts locally (e.g. the server > is notified of the calls but the client rejects it automatically). > - We want a way to report an abuse on the server side for a particular user; > - Once a defined number of abuses is reached for a specific user, block it > on the server side. > > Would this proposal work okay for you? There are 4 scenarios: 1 Account user reporting abuse from another account user: We offer a "Report and block" feature rather than just "Report" so that in scenarios where 2 account users are involved, the reporter automatically blocks the abuser - "Block" is local and leverages bug 1017052 (block a user from calling you) - Abuse report is made on the server - When a reported user matches a set of rules, this user is blocked from being able to log-in (this bug) 2 Account-less user reports abuse: We offer a "Report and revoke link" option rather than just "Report" - Revoke link leverages bug 1000134 - Abuse report is made on the server - Blocking a user from logging-in is impossible given that the reported user is a link clicker 3 Link clicker reports abuse from account-less user - Abuse report is made on the server - Blocking a user from logging-in is impossible given that the reported user is an account-less user 4 Link clicker reports abuse from account user - Abuse report is made on the server - When a reported user matches a set of rules, this user is blocked from being able to log-in (this bug)
Comment 9•10 years ago
|
||
I don't understand the use case for "4. Link clicker reports abuse from account user". How can a link clicker be abused here? Otherwise, that clarifies a lot the purpose of this bug, thanks for the precisions!
Reporter | ||
Comment 10•10 years ago
|
||
After discussions on IRC I believe you understand the need for abuse report in this scenario, for instance an account user shares way too many URLs with you and you want to report it.
Reporter | ||
Comment 11•10 years ago
|
||
Marking as RESOLVED after discussions with Mika: we don't need this feature anymore.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(adam)
Resolution: --- → WONTFIX
You need to log in
before you can comment on or make changes to this bug.
Description
•