top | item 30769201

Adafruit requires 2FA to prevent bots buying out Raspberry Pi

303 points| 7402 | 4 years ago |blog.adafruit.com

269 comments

order
[+] dawnerd|4 years ago|reply
I don't know why this is so hard for retailers to figure out. Valve has an excellent system. Let me give you a down payment, five dollars, ten, whatever. Put my name on a list and when its my turn to buy give me a few days to purchase, and if not refund and move on to the next person.

It's like all these retailers forgot backordering was a thing.

They could even store the address and limit to one order per x period of time.

[+] kelnos|4 years ago|reply
Yeah, this has been really frustrating for me, too. I've been trying to buy a Compute Module 4, and everyone is sold out of that as well. I'd be perfectly happy to even pay the full price to place a backorder, and just wait for them to ship it to me whenever my order hits the top of the list. I don't want to keep checking daily to see if anyone has something, and then click through to each of 5 different retailers to only find out that they've sold out again in the time it's taken me to click through. It's such a waste of time.
[+] batch12|4 years ago|reply
Or increase the price for the bots detected to a few thousand dollars
[+] yahn00|4 years ago|reply
Retailer gets paid whether it’s you or someone else buying. Why invest in system upgrades?
[+] monkeybutton|4 years ago|reply
Ticket scalpers use pools of credit cards to make purchases. What's to stop botters from using pools of CCs+phone numbers?
[+] Nsida3|4 years ago|reply
I ordered a RPi CM4 about 5 months ago. They charged me the full price and I’m still waiting for the delivery.
[+] rtpg|4 years ago|reply
Bots then buy them up?? Back ordering has the same problem as everything else that is first come first serve.

My fav thing is combining “purchase intent” with “has bought at store before” and just allowing people with purchase histories at the store to buy, and 1 per person.

Also just lotteries work alright, if only cuz you add enough weird friction to make it rough.

[+] cjcampbell|4 years ago|reply
Glad they took this step to slow down the bots. The situation has been rough since rpilocator.com came along. I haven’t been able to complete a purchase since the week it hit HN.

I use the pi for teaching, and could previously pick one up every couple weeks just by signing up for stock notifications. I was in the middle of a purchase in February when rpilocator updated to show stock and Adafruit went offline due to the traffic surge. The disruption lasted about half an hour.

[+] philjohn|4 years ago|reply
Will this slow down the bots? It's just an extra (simple) hoop to jump through, TOTP is easy to implement.
[+] geerlingguy|4 years ago|reply
It was rough before rpilocator came along. It just highlighted how difficult it is to find any Pis in stock.
[+] alexk307|4 years ago|reply
Good. Supply is so limited right now, but everyone should be able to get one at MSRP if they want one. The whole goal of the Pi project is to make computers affordable to enable learning and prototyping. I pre-ordered a Pi 4 about 3 months ago, and I should receive it this week if I'm lucky.
[+] avian|4 years ago|reply
> The whole goal of the Pi project is to make computers affordable to enable learning and prototyping

Is it still though? They have been pushing into various industrial and commercial markets. There was talk about Raspberry Pi Trading planning an IPO this year [1].

There are companies now that are basing their entire product lines around Raspberry Pi's Compute Modules. This then drives demand for other Raspberry Pi products as well. When you're deeply invested into that ecosystem you also need Pis 3s and 4s for builds, testing, development, etc.

[1] https://news.ycombinator.com/item?id=29392649

[+] NowhereMan|4 years ago|reply
Looks like you can use OATH TOTP, which can be easily automated. I don't understand how this is an effective countermeasure against bots.
[+] colechristensen|4 years ago|reply
A lot of bots are written by really unsophisticated people though, often just following online guides. Raising the bar lowers the number of adversaries.

You can never eliminate the risk, but it's just one more point of friction which is also a not-so-unreasonable speed bump to enable for real users.

[+] samwillis|4 years ago|reply
This ads friction to the process of automating the buying process. Preventing bots is an endless cat and mouse game, every protection you put in place will be circumvented eventually. You just have to keep changing tactics and adding new layers. That’s what they are doing here.

Realistically the best protection that they could put in place is a rate/qty limit on the credit card being used. It can still be automated by using stolen cards, or one of the services that instantly creates new card numbers for you. But again it adds friction.

Also limiting the number of orders to delivery addresses would be a easy mitigation.

It wouldn’t surprise me if they are doing both of those already though.

[+] evan_|4 years ago|reply
You're misreading, you have to "verify" your account first as well as set up MFA.

Verifying just consists of confirming your email via a one-time token. Setting up MFA presumably just makes sure there's no impetus to hack a bunch of old accounts.

[+] londons_explore|4 years ago|reply
Perhaps for buying a ras-pi specifically, they'll require SMS verification.

SMS is hard to create large numbers of fake accounts because getting access to large numbers of phone numbers that aren't all in the same block is pretty hard.

[+] udia|4 years ago|reply
I agree, 2FA seems unrelated to stopping bots. It really seems like some form of rate limiting and captcha should have been used instead.
[+] bradly|4 years ago|reply
Maybe now is now a good time to sell all my Pi's I bought through-out the years with good intentions of building something one day.
[+] largbae|4 years ago|reply
Indeed. Once you start, you won't stop
[+] chmod600|4 years ago|reply
What's the background here? Why is this model so popular? Are previous models a viable alternative for some? How long until production can catch up?
[+] wnevets|4 years ago|reply
It seems like online scalping in general has skyrocketed since the pandemic started in 2020, the most famous probably being GPU cards.
[+] qbasic_forever|4 years ago|reply
This is the first Pi with 4 or 8 gigabytes of memory, and the ability to boot off a USB drive natively (like a SSD). It can easily replace a big desktop computer with a tiny ~$50 board. It is not a slow and semi-unreliable little computer like the previous models (Raspberry Pi 3 and below).

The Pi 3 only has 1GB of memory and is pretty much unusable for modern desktop use (especially browsing the web today). In addition with only a micro SD card as primary storage it's super slow and prone to brick itself if you aren't careful about powering it up and down cleanly.

[+] jimrandomh|4 years ago|reply
Just raise the price already. The market price of a Pi Zero 2W is about $70 right now. For my application, I'm happy to pay it, because the alternative would be spending a month of skilled developer time designing a daughterboard and porting software to a different SBC. If Adafruit actually succeeded in preventing scalpers from buying up the supply, this would mean misallocating boards to projects where a dozen other boards would have worked just as well.
[+] throwaway81523|4 years ago|reply
What were you doing building a product(?) around a 02W anyway? They are supposed to be 1 per person, like the old 0 series. They have never been offered in quantity even when there wasn't a shortage.
[+] 2xpress|4 years ago|reply
Indeed, if the demand exceeds the supply then the prices have to go up. This way more money will be available for the manufacturer to increase the supply. This is the basic law of economics, and anybody trying to play games around it will only make things worse and end up in poverty.
[+] ephbit|4 years ago|reply
What's this about?

Are the bots operated to manipulate the market, by buying up the whole supply to then sell at a higher price?

[+] dljsjr|4 years ago|reply
I guess you could call it market manipulation but it's more just resellers/scalpers trying to take advantage of the chip shortage. RPis have always been in high demand and often were backordered even when things were fine; now they're supply constrained enough that scalpers can buy up in bulk and resell at high markup, similar to the GPU aftermarket going on right now.
[+] fmajid|4 years ago|reply
All official RPi resellers are required to sell them without forced add-ons, at the list price. The scalper bots are trying to arbitrage that.

I think a CAPTCHA in the ordering process would make more sense.

[+] teeray|4 years ago|reply
The bots are middlemen that ensure proper pricing of scarce goods. Their commission is the difference between the retail price and the actual market price.
[+] throwaway81523|4 years ago|reply
Sometimes the bots are just because people want the items for themselves. I know of some companies that bought 1000s of disk drives for their data centers that way from retailers, back when there was a drive shortage a few years ago.
[+] n4bz0r|4 years ago|reply
Given one of the goals of the project is to allow young people to have an affordable PC to learn linux and programming, it would make sense to reserve a part of the stock for verified students (or teachers) at MSRP.
[+] hashkb|4 years ago|reply
I don't understand what's so hard about this problem - if you have a platform that's impacted by bots and scalpers, and if you want to do the right thing, or give the appearance of doing the right thing with almost no cost to yourself or your business, you should release your product in a fair lottery with reasonable purchase limits.

You have plenty of time before the product is released to register and verify everyone. You completely avoid traffic issues. Accounting is easy - you'll sell out when you run the lottery. You'll build a reputation for releasing inventory fairly and without causing undue stress on your customers, and avoid the suspicion that you're in cahoots with the scalpers (looking at you, Ticketmaster).

I'm accustomed to stressing out over concert tickets and struggling to get gaming consoles, and have a deep hatred of scalpers and the platforms that enable them, but I had no idea that scalpers were ruining the educational/hobby markets too. That seems really low.

[+] cinntaile|4 years ago|reply
Fixed pricing with scarce goods tends to lead to this result, just let supply and demand sort it out and this problem wouldn't exist. Trying to fix this by using 2FA won't change much, it's just an arms race where each side keeps investing more and more money into fixing a problem that doesn't have to exist in the first place.
[+] samwillis|4 years ago|reply
> just let supply and demand sort it out and this problem wouldn't exist

That would go against the mission of the Raspberry Pi Foundation which is to promote computer science education. Accessibility though low prices is an important aspect of that.

Not all problems are solved with free markets.

https://en.m.wikipedia.org/wiki/Raspberry_Pi_Foundation

[+] colechristensen|4 years ago|reply
There are a lot of people who want to play arbitrage with rare goods, if you have enough money you can do it with just about anything. It is perfectly fair to want your market segment to be to deliver cheap rare goods to people without many resources.

Sometimes arbitrage helps make efficient markets, other times it is just a drag on the economy. It is perfectly fair for a provider to not want to only provide goods to people with many resources or scalpers.

RPi is also just not a good deal if it is significantly more expensive, there are lots of more expensive options out there for small computers which have better specs and are more readily available.

[+] zozbot234|4 years ago|reply
As others have pointed out, AdaFruit likely cannot raise their selling price for these Pi's due to prior contractual arrangements. They're essentially forced to ration their supply, and all they can do is make the best of a pretty bad situation by at least trying to act fair (i.e. limited buys only) and rewarding their existing customers with preferential access.
[+] TrevorFSmith|4 years ago|reply
If you have an RPi that you're not using then be a hero and offer it to your maker friends.
[+] snapetom|4 years ago|reply
For anyone confused in setting this up, the App is Twilio Authy in the Apple App Store. The logo in the app store has little contrast and the Adafruit blog post just calls it "Authy" which returns dozens of 2FA apps.
[+] charcircuit|4 years ago|reply
If you want to prevent scalpers just sell the new units that come into stock in a reverse auction. Start the price at $500 and lower the price by a dollar every minute. Once all of the stock is sold out you charge everyone the price the last unit was sold for.

In this system bots don't have an advantage over humans. Humans can preinput what they are willing to pay and there will be no race against bots like what you see here.

[+] harryvederci|4 years ago|reply
If I'm not mistaken, the Raspberry Pi was meant to be an affordable device for educational purposes. Now bots are buying them, making them scarce, making them less affordable.

Could licensing help here? What if the Raspberry Pi Foundation would sell devices with a license that says you can't sell it for more than a certain price, and you can only sell it / give it away under the same license?

[+] FrenchDevRemote|4 years ago|reply
This is incredibly stupid, it's really easy to handle 2FA with a bot.(as easy as making the bot in the first place, or even easier...)
[+] lagrange77|4 years ago|reply
Maybe these are just some pitiful injured robots, trying to get hold of some spare parts for self repair. :'(
[+] Seattle3503|4 years ago|reply
I'm surprised they didn't require Phone # verification given the issue they are having.
[+] digitallyfree|4 years ago|reply
As an aside, used thin clients and industrial PCs are a good x86 alternative to the Pi if you require similar performance and don't need GPIO. They are quite plentiful on ebay, include a housing, and consume little power.