What are the best ways to prevent fake registrations?

Question

I would like to know more about the solutions to restrict registering for a website for humans only.

Captcha may seem a proper solution but as it turns out it's not as good as it sounds. And it's not a problem if a solution is not an option for blind, deaf people etc..

Wilding

CAPTCHA is evil! Usually takes me several tries to find something I stand a chance of reading. – Paries

The best way to prevent fake registration is to not have registration. – Pomiferous

Answer 1

My newest web app uses a process that makes this really easy for the user and secure for me.

1. User goes to login page, enters their email address and clicks an "I am signing up" checkbox.
2. The user clicks "register", their email address gets inserted to a temporary SQL table (called signups) and an email with a verification link is sent to the email address.
3. The user clicks the verification link which takes them to a "create password" page.
4. After the user creates his password, the email address and password are inserted into the users table–and the entry in the signups table is deleted.

This makes it easy and reliable.

The signups table also includes a random SHA1 hash (for the verification link), a timestamp set for 12 hours after the sign up, and IP Address.

All entries in the signups table that have an expired timestamp get removed at certain parts of the day.

---

Update

Since writing this answer, I have found that keeping a signup form secure from robots is a never-ending battle.

As time goes on, new technologies and methods are being developed to circumvent security measures. The best thing any dev team can do is periodically be checking the quality of signups, and thinking of ways to make their signup form both more secure and intuitive to use.

Yeah, it is a good bit of work and resources that go into it, but having confidence in your signup form and quality of signups is well worth the expense.

Alfredoalfresco

+1 sounds like a great idea. Although what about when users dont receive the email because their ISP marked it as spam or it ended up in their spam folder? Do you do any checking if the email was bounced on send? – Stringpiece

@Stringpiece Actually, I do. I use Mandrill for emails so I get detailed reports of bounced emails. Furthermore, Mandrill uses the MailChimp sending infrastructure, so bounces and emails in spam folders rarely ever happen. – Alfredoalfresco

A good old registration confirmation is always the best. Leave the dirty CAPTCHA work to the free email websites. – Universalist

why does this restrict access to humans only? It can be bypassed easily with a custom email server, and some scripting – Wilding

@Glaslos Yes they are. In fact, free. One extra layer of security I am using is filtering IP addresses (using Project Honey Pot's data), and suspicious IPs and/or email account names (e.g. [email protected]) get sent a six-digit validation code, in conjunction with the verification link. A human user will have to enter the six digit code into an input dynamically inserted into the page by JavaScript. – Alfredoalfresco

Answer 2

Depending on how targeted your site is, using a honeypot can be quite effective.

In short, you have a field on your form with a common name -- let's say email. Your actual email field has some other random name like larp.

Hide the email field using CSS, and include a text label instructing users to leave that field blank, should they happen to see it.

If any registrations come in with the email field filled in, send a success message back then drop it.

Paries

Answer 3

Verifying the e-mail address and allowing only users who have verified their e-mails is the easiest and quickest solution.

Patriarchy

What if some one register usingMailinator,Emailgenerator etc... services? Registration on site means that Making a genuine profile.So genuine profile must based on some genuine email addresses.So Email addresses provided through Mailinator and related application should be banned. – Footton

Answer 4

You could have users listen to an audio file, and enter the word into a text box. That's what I wanted to do for phpBB3, but alas, they do not allow HTML markup for their verification questions. Alternatively, you can do defense in depth, and have a CAPTCHA be only part of the process.

Brockwell

Answer 5

Instead of captcha (typing in words displayed in an image) I've seen websites that require you to answer a question, usually basic math. I haven't implemented these, but I've seen them several places so it must be something that's a plugin for various CMSes and soforth.

Bottom line is, any system will eventually be circumvented. You can minimize bot-registrations, but I can tell you from experience that there are people out there who will pay other humans (who can pass just about any test) money to sign up for web sites - the pay is generally really poor, but there are always people who will find that acceptable.

So along with whatever solution you use, you'll want to periodically re-evaluate that solution, AND you'll want to have a human being review new registrations (maybe once a day?) to weed out the few 'bots that do get through.

Cutworm