Show Posts
101
MicrostockSubmitter / Re: Repeated Login Request from Adobe Stock. Over and over and over again
« on: April 06, 2020, 08:00 »This is a new problem. I have changed nothing on my system form the last time I uploaded. I never had a problem uploading to Shutterstock before, so I doubt that my antivirus is the problem here because the error does not occur while uploading to any other site.
I am going to be honest here. Please try to listen and not get offended.
It just seems from where I am setting that the Stocksubmitter program is lagging behind when it comes to internet security. When I first started using it, I never had to reenter user names and passwords each time I launched the program. Then Alamy started requiring me to re-login each time and pass a CAPTCHA images test (which is really irritating). Then Shutterstock started doing the same thing. Now Adobestock is doing it but even when properly completed, Adobestock is rejecting the authentication. It is a massive pain in the butt!
Now, I can log into all of these websites from a browser with no problem, never having to reenter my login info or pass a CAPTCHA test, because these sites TRUST the browser security and recognize me as the same user.
So, the question is, why are these sites not trusting a connect from Stocksubmitter and treating each contact as a new login, instead of recognizing that it is the same user from last time?
Now, don't get me wrong. I appreciate your program and it is extremely helpful, but I find it concerning that at every turn, you are being flagged by every security system on the internet. Your website gets flagged, and your program cannot be installed without having to bypass Windows Security. I have dealt with utterly thousands of apps and programs and yours is the ONLY one that I have ever had to do that. I would be remiss if I did not question why you are having such a hard time with the standard security protocols everyone else seems to have no issues with. And it does not seem to bother you, which bothers me and begs me to question more.
Again, I appreciate you and your program, but I would like to see you spend a little effort on compliance with security. Your site is flagged, Windows flags your program, and Stocks sites increasingly do not trust connection from your program, requiring users to go through extensive security checks every time your program tries to connect to them. It is time to start fixing these security issues, ASAP!
Thank you for the detailed explanation of your concerns.
I will answer with the same level of detail to make it more clear why does it happen this way.
First of all, Norton has already replied to my e-mail and they've re-classified StockSubmitter website as "Technology/Internet" and not as a malicious website. So it was just merely a false positive detection result by their system.
And here we approach another issue you're describing - that some antivirus software sometimes detect the app itself as malicious and decide to block it.
Most of antivirus software rely on heuristics to analyze this or that app. This heuristics is not giving exact results (it's not possible by definition) but rather 'a probability' based on the patterns in the app compiled code that may match those of known viruses or on the list of libraries and system functions that the app is using. While the first one (patterns in the code) is pretty random and we get incorrectly detected as a virus (always some "Generic.Win32...Something", not a specific virus) by some antivirus software every once in a while just because we keep updating the program (sometimes multiple times a day) to keep it up to date with the changes on the agencies websites. So some random update may be detected by some random antivirus as malicious and the next update will be detected as 'clean' again.
The second detection reason - what does the program do - is even worse for us. The program DOES indeed connect to several dozens of hosts in the internet (agencies FTP servers, agencies web servers, our own server, etc.), including many automated requests (periodic submission attempts, earnings balance fetchings, etc.). It does use your hard drive extensively (especially if you keep your files in dozens of folders like many users do; add to that the program configuration folder; release folder; etc.). What other kind of programs perform the same level of activity? Viruses, botnets, trojans, etc. So no wonder we get detected as a malicious software.
You may ask why don't other software that has the similar level of activity get detected as such? Well, there are not many programs that can be compared in terms of network and disk activity with StockSubmitter. May be a torrent client, a browser and similar software. But there are only so few of them and they all have 100-10000 times more users than StockSubmitter has just because there are only so few microstock contributors in the world. So antivirus developers keep adding them and their updates to their white lists to avoid them being detected as malicious software. They wouldn't bother to do so for StockSubmitter just because it has a few thousands of users, not millions. And even if they would it would be useless because, as I said before, we keep updating the program for it to still work after all the changes on the agencies websites.
Second, regarding the 'security standards'. It actually has nothing to do with security standards. It's more about (quite stupid if you ask me) ideas of the microstock agencies websites developers on how to improve their security.
A security standard is to use HTTPS protocol. Or two-factor authentication _if neccessary_. If you look at the shutterstock website it has only a simple captcha as a security measure and doesn't ask the user to re-authenticate every few hours like Canstock does. They don't use some sophisticated bot protection systems. And still, they're the biggest microstock agency out there and I believe their security engineers aren't stupid. They just try to not over-engineer and over-protect what doesn't need to be overly protected. Their security measures are just enough.
You've asked why doesn't an agency website understand it's the same users when you try to connect with StockSubmitter - it's because we do not have access to your browser's cookies. So their websites have no way to know it's the same user. We come to them as a plain new client without any previous browsing history. Just like you would if you would try to log into your account on an agency website in an incognito Chrome tab - your would face the same captchas, two-factor authentications, etc. There is no way around it except passing it and hoping the agency won't ask you to pass it again soon (which it shouldn't except Canstock due to their ridiculously short session life time).
Some agencies go further and use some complicated bot-protection systems or implement their own (Pond5, Creative Market and so on) which we have to overcome, because StockSubmitter is essentially a bot. That's the main purpose of the program - to automate your manual actions. And while many agencies appreciate that we help them to get more quality content from our users, other agencies do not share this attitude and refuse to cooperate to make things work more stable (which is plain wrong unless they don't really need more content). Of course we find a way around all those issues even thought sometimes it doesn't work as reliable as we'd like it to.
By the way, we've implemented a solution to resolve those captcha issues automatically - you can just enable the "solve captcha on our servers" option on the "Features" tab - that way you wouldn't have to solve it manually.
Why does it have to happen on our servers - because we're using a paid captcha solving services and can't just embed our access keys into the app as that would essentially mean sharing them with everyone and paying for whoever would want to use them for their own benefit.
Another possible alternative is to use Microstock.Plus - our web-based platform - that has the automatic captcha solving feature built in and that's whitelisted by some agencies specifically to prevent any issues from arising.
We're yet to resolve the issues with Bigstock but for other agencies it works pretty stable and easy.
Hopefully I've provided a detailed enough explanation on why things are how they are at the moment.
If you have any more questions feel free to ask me
Found how to attach one from Stock Submitter (I don't have anything there, no account, no releases, no photos, nada) or how to create (I have the release already, no need to create). Present situation: photo on M+, release on computer. How to unite them?
