← Extractions

wroclove.rb 2024 — Prevent Account Sharing (Andrei Kaleshka)

Andrei Kaleshka's first English talk at wroclove.rb 2024 on preventing paid-account credential sharing in a Ruby on Rails music-education app. He walks through data collection with paper_trail and a login_sessions table, charting indicators in Metabase, rolling out devise-two-factor email MFA selectively to users with 4+ active sessions, and reports a ~27% lift in signups.

Model

claude-opus-4-7

Ingestion

1e927be1

Input tokens

550,282

fresh: 485,614
cached: 57,979
cache write: 6,689

Output tokens

10,588

Duration

165.7s

Roundtrips

Tool calls

Cost

$0.00

Nodes/edges extracted

24 / 42

Read set (nodes/edges)

486 / 2

Nodes (24)

update Andrei Kaleshka person

description Ruby developer at an outsourced company, working as main developer and sometimes tech lead depending on the project. ... → Ruby developer at an outsourced company, working as main developer and sometimes tech lead depending on the project. ...

update Prevent account sharing talk

attrs {"type" => "talk"} → {"type" => "talk", "first_english_talk" => "true"}

description Talk at wroclove.rb 2024. → Andrei Kaleshka's wroclove.rb 2024 talk (his first English-language talk) on fighting credential sharing in a Ruby on...

short_description Talk at wroclove.rb 2024. → wroclove.rb 2024 talk on detecting and curbing shared credentials in a Rails app.

create paper_trail tool

kind (empty) → tool

name (empty) → paper_trail

slug (empty) → paper_trail

attrs (empty) → {"category" => "library"}

description (empty) → Ruby gem that records changes to Active Record models as versions — trivial to install on an existing Ruby on Rails a...

short_description (empty) → Ruby gem for tracking changes to Active Record models as a version log.

create Metabase tool

kind (empty) → tool

name (empty) → Metabase

slug (empty) → metabase

attrs (empty) → {"category" => "service"}

description (empty) → Open-source BI tool for exploring data via charts, numbers and dashboards. Easy to set up (~5 minutes via the Docker ...

short_description (empty) → Open-source business-intelligence tool for charts and dashboards over a database.

create devise-two-factor tool

kind (empty) → tool

name (empty) → devise-two-factor

slug (empty) → devise-two-factor

attrs (empty) → {"category" => "library"}

description (empty) → Ruby gem extending Devise with two-factor authentication. Used in the Prevent Account Sharing talk with email-based v...

short_description (empty) → Devise extension adding two-factor authentication to Rails apps.

create Amazon CloudFront tool

kind (empty) → tool

name (empty) → Amazon CloudFront

slug (empty) → amazon-cloudfront

attrs (empty) → {"category" => "service"}

description (empty) → AWS CDN service that sits in front of the Rails application as a proxy. Has an optional feature that enriches every p...

short_description (empty) → AWS content delivery network, also used as a request-proxy exposing geo/IP headers.

create Fingerprint tool

kind (empty) → tool

name (empty) → Fingerprint

slug (empty) → fingerprint

attrs (empty) → {"category" => "service"}

description (empty) → Commercial third-party service that identifies returning browsers/devices via fingerprinting, used to detect shared a...

short_description (empty) → Third-party browser/device fingerprinting service for identifying returning users.

create Stripe tool

kind (empty) → tool

name (empty) → Stripe

slug (empty) → stripe

attrs (empty) → {"category" => "service"}

description (empty) → Online payments platform. Used in the Prevent Account Sharing talk as the source of truth for revenue — the team watc...

short_description (empty) → Online payments platform widely used by SaaS applications.

create devise_token_authenticatable tool

kind (empty) → tool

name (empty) → devise_token_authenticatable

slug (empty) → devise_token_authenticatable

attrs (empty) → {"category" => "library"}

description (empty) → Extension for Devise that adds authentication-token support for API clients. Used in the Prevent Account Sharing talk...

short_description (empty) → Devise extension adding token-based authentication for API clients.

create Account Sharing concept

kind (empty) → concept

name (empty) → Account Sharing

slug (empty) → account-sharing

attrs (empty) → {"category" => "practice"}

description (empty) → Situation in a paid-subscription application where one user shares their credentials with friends, family or stranger...

short_description (empty) → Users reusing paid credentials with others, hurting subscription revenue.

create Login Session Tracking concept

kind (empty) → concept

name (empty) → Login Session Tracking

slug (empty) → login-session-tracking

attrs (empty) → {"category" => "pattern"}

description (empty) → Pattern of creating a database record for every user login and injecting its id into the browser's cookie session, so...

short_description (empty) → Persisting each user login as a database record identified via cookies.

create Selective MFA Rollout concept

kind (empty) → concept

name (empty) → Selective MFA Rollout

slug (empty) → selective-mfa-rollout

attrs (empty) → {"category" => "pattern"}

description (empty) → Risk-management pattern from the Prevent Account Sharing talk: instead of turning MFA on for every user — which risks...

short_description (empty) → Enabling MFA only for users flagged as violating account-sharing rules.

create Scaffolding Before Features concept

kind (empty) → concept

name (empty) → Scaffolding Before Features

slug (empty) → scaffolding-before-features

attrs (empty) → {"category" => "methodology"}

description (empty) → Analogy drawn in the Prevent Account Sharing talk to the construction industry: before starting a building, scaffoldi...

short_description (empty) → Collect data and define indicators before rolling out a risky feature.

create Music Education SaaS project

kind (empty) → project

name (empty) → Music Education SaaS

slug (empty) → music-education-saas

attrs (empty) → {"domain" => "music education", "status" => "active"}

description (empty) → The application at the center of the Prevent Account Sharing talk. A Ruby on Rails product that sells online courses ...

short_description (empty) → Rails application selling online classes and courses for musicians.

create Collect data before enabling risky features takeaway

kind (empty) → takeaway

name (empty) → Collect data before enabling risky features

slug (empty) → collect-data-before-enabling-risky-features

attrs (empty) → {"type" => "recommendation"}

description (empty) → When you face implementing a feature whose impact on the product is hard to predict (like MFA), stop and think first:...

short_description (empty) → Define indicators and capture data before rolling out hard-to-predict features.

create Learn SQL to analyze your product takeaway

kind (empty) → takeaway

name (empty) → Learn SQL to analyze your product

slug (empty) → learn-sql-to-analyze-your-product

attrs (empty) → {"type" => "recommendation"}

description (empty) → Even with a BI tool like Metabase, preparing the data into meaningful charts required writing custom SQL. The speaker...

short_description (empty) → Analyzing application indicators effectively requires writing custom SQL.

create MFA improves account-sharing health takeaway

kind (empty) → takeaway

name (empty) → MFA improves account-sharing health

slug (empty) → mfa-improves-account-sharing-health

attrs (empty) → {"type" => "insight"}

description (empty) → Outcome reported in the Prevent Account Sharing talk: after enabling email-based MFA weekly for users with 4+ concurr...

short_description (empty) → Selective MFA significantly reduces account sharing and boosts signups.

create Record CloudFront request headers on sessions takeaway

kind (empty) → takeaway

name (empty) → Record CloudFront request headers on sessions

slug (empty) → record-cloudfront-request-headers-on-sessions

attrs (empty) → {"type" => "lesson-learned"}

description (empty) → AWS CloudFront has an optional feature that attaches IP, location, latitude/longitude and other details to every requ...

short_description (empty) → CloudFront can enrich requests with IP/geo headers but accuracy is limited.

create Why a limit of four login sessions? question

kind (empty) → question

name (empty) → Why a limit of four login sessions?

slug (empty) → why-a-limit-of-four-login-sessions

attrs (empty) → {"answer_summary" => "The app has multiple device surfaces (desktop, mobile web, iOS, upcoming React Native), the bus...

description (empty) → Audience member argues four devices per user is still generous — most people use one or two at a time. Andrei answers...

short_description (empty) → Q&A: why was four chosen as the maximum concurrent sessions per user?

create How is MFA enabled per user — manual or automated? question

kind (empty) → question

name (empty) → How is MFA enabled per user — manual or automated?

slug (empty) → how-is-mfa-enabled-per-user-manual-or-automated

attrs (empty) → {"answer_summary" => "Automated: a SQL query on the login_sessions table identifies users with 4+ active sessions and...

description (empty) → Audience asks whether enabling MFA per user is done manually or by automation. Andrei answers that a SQL query identi...

short_description (empty) → Q&A: is flagging which users get MFA manual or script-driven?

create Do you protect against shared cookies? question

kind (empty) → question

name (empty) → Do you protect against shared cookies?

slug (empty) → do-you-protect-against-shared-cookies

attrs (empty) → {"answer_summary" => "No — the solution does not protect against sharing of raw session cookies."}

description (empty) → Audience asks what happens if a sophisticated user shares their session cookies (not username/password) with someone ...

short_description (empty) → Q&A: is cookie sharing between users mitigated?

create Why MFA via email and not authenticator app or SMS? question

kind (empty) → question

name (empty) → Why MFA via email and not authenticator app or SMS?

slug (empty) → why-mfa-via-email-and-not-authenticator-app-or-sms

attrs (empty) → {"answer_summary" => "Minimize user friction to avoid churn: no phone numbers on file (no SMS), authenticator apps ad...

description (empty) → Audience asks why MFA via a second device or an authenticator app was considered unsuitable, and what made email MFA ...

short_description (empty) → Q&A: rationale for picking email-based MFA.

create Do users just create new shared accounts to dodge MFA? question

kind (empty) → question

name (empty) → Do users just create new shared accounts to dodge MFA?

slug (empty) → do-users-just-create-new-shared-accounts-to-dodge-mfa

attrs (empty) → {"answer_summary" => "Not analyzed yet — acknowledged as a fair next step. Main win so far: revenue stopped dropping."}

description (empty) → Audience asks whether users drop their accounts and simply create new ones with a new shared email to continue sharin...

short_description (empty) → Q&A: have you checked whether flagged users re-register with a shared email?

create What does the application do? question

kind (empty) → question

name (empty) → What does the application do?

slug (empty) → what-does-the-application-do

attrs (empty) → {"answer_summary" => "A music-education SaaS that sells online courses/classes for musicians."}

description (empty) → Closing audience question. Andrei answers that the application is an education platform for musicians that sells onli...

short_description (empty) → Q&A: what is the product behind the case study?

Edges (42)

create Music Education SaaS → uses → paper_trail

context (empty) → Installed to collect historical data.

relation (empty) → uses

source_node_id (empty) → bf2260ce-2012-408b-8636-402d443f48c4

target_node_id (empty) → c94cfb12-f5f2-4321-be12-b73efd47e871

create Music Education SaaS → uses → Devise

context (empty) → Base authentication stack.

relation (empty) → uses

source_node_id (empty) → bf2260ce-2012-408b-8636-402d443f48c4

target_node_id (empty) → 9113bde3-534a-47d0-8333-e171c4b55e79

create Music Education SaaS → uses → devise-two-factor

context (empty) → Email-based MFA for flagged users.

relation (empty) → uses

source_node_id (empty) → bf2260ce-2012-408b-8636-402d443f48c4

target_node_id (empty) → d05fd6e1-4c37-46a3-8f53-feaa90dc2fcf

update Andrei Kaleshka → authored → Prevent account sharing

context (empty) → Andrei delivered this as his first English-language talk.

update Prevent account sharing → presented_at → wroclove.rb 2024

context (empty) → Talk given at wroclove.rb 2024.

create Prevent account sharing → about → Account Sharing

context (empty) → Entire talk is about detecting and reducing credential sharing.

relation (empty) → about