Prevent users from starting multiple accounts?

Question

I know that in the end it, can't be done.

But, what are the options to:

  a) limit the options for persons to create multiple accounts,
  b) increase the chance of detecting multiple accounts / person

for a blog-like web service?
(people can sign up for their own blog)

Update:
I think the 'limit the options' has been answered nicely. (there is no reliable method, but we can raise the bar)
However, I would still like to know what other options there are to detect multiple accounts?

Tensible

Answer 1

I'm assuming you're talking about a free service? I can't think of any ways that don't either have serious drawbacks or would be trivial to defeat. Things like setting a cookie, requiring a unique e-mail address are easy to defeat.

Requiring a unique IP address is not foolproof but might work to some degree, up to the point that you have lots of users and get complaints from people behind proxies.

The best ways are to charge money or require people provide some kind of personal information, like real name/phone/address that you verify, or a CC number, but that's invasive (then again maybe you only want serious users who are willing to provide this sort of info).

I guess I would turn the question around and ask "Why don't you want to let people have multiple accounts?"

There may be some other ways of mitigating whatever your underlying reason is, i.e. if you're worried about lots of orphaned blogs you could scan for a period of inactivity and disable them or at least schedule them to be looked at by a human. If you're worried about spam blogs you could periodically scan all blog content for spammy stuff. If you're worried about bots and are using some generic software like WordPress, change the names of the form variables and otherwise protect your forms from bots.

Definitely think of other ways of dealing with the problem, because you are not going to be able to block people from registering multiple accounts if it's a typical free service like Blogger.

As for detecting multiple accounts by one person, the first thing you need to do is have a log file store complete data on every user login (username, timestamp, IP, user-agent etc.), that you can then analyze later. I'll list a few things to look out for, but just by poring over the log file you will likely discover other patterns. Some ideas of things to look for are:

• Set a tracking cookie (i.e. random hash) and log its value on login, look for multiple logins from the same cookie value
• Logins from same IP address/user-agent combination
• Logins from same IP address only (less reliable than the previous two bullets)
• Accounts with email addresses from free webmail services (Gmail etc.)
• Accounts with same password

If you're worried about spam blogs, you could try doing some analysis of blog content, i.e. extract all the <a href>s and look for correlations between blogs. You could run the blog content itself though something like SpamAssassin or otherwise filter for spammy words like "viagra" and "rolex."

Boyceboycey

that list was really helpful, cookies are a nice trick I'm going to implement right now, thanks :) – Jeuz

Cool, I think that's the way to go. It's a lot easier to pinpoint someone with several accounts and remove them saying "sorry, you broke our TOS and have multiple accounts" (without telling how you know of course) than to detect it at registration time. – Boyceboycey

... If they do get blocked trying to register a second account, then they'll just hunt until they find a way around the block. And, it stings them more to have an active account that they maybe invested a lot of time in deleted. They'll think twice about trying it again. – Boyceboycey

Ehmm... I run at least 5 different browsers on my machines. Thats going to give me 5 different user-agents + 5 different cookies - same IP yes, but I am behind a router/NAT as many people are. – Stereochromy

Mobile verification wasn't something I had thought about but solves my issue perfectly! – Adverse

You should not be able to detect accounts with same passwords unless you store them without adding unique user salt to the hash, which is not safe. – Gabriel

Answer 2

I think the best method would be to remove the incentives for creating multiple accounts.

Do you limit the users in any way? Can those limits be overcome (easily) by creating multiple accounts? If so, then maybe you should think about removing those limits.

Counterfactual

Great idea. I'll just let all my users vote up their own comments an infinite number of times. (sarcasm) hehe Sorry, I'm just tired of answers that basically say: "I'm not going to give an actual answer to your question because you're asking the wrong question and I'm more clever than you." Still, this is not a bad answer hehe – Seismo

Well, nothing has a single solution. This was my way of proposing an alternative. If you think that it implies or that I think it implies I'm more clever than you, we might have a bigger problem here ><. I do understand your frustration, though. It's just that someone else might not already have thought of the alternatives. – Counterfactual

The problem with "infinite multiple upvoting" is only valid when voting is incremental. Think instead of a suggestion engine where my votes only matter in calculating the content that will be suggested to me, or of a social site where they'll only be of interest to my friends: the problem loses context. – Counterfactual

Answer 3

You could send users a SMS message to verify before creating the account. Since people can't get cell phone numbers as easily as they can get email addresses, this might work. Some people might be able to get two or three accounts, but not an unlimited number. There are a number of services that let you send SMS messages programmaticly, including Gizmo SMS, Text4Free and TxtDrop.

Of course, this requires users to have cell phones, and be willing to provide you with the number.

Eradicate

Answer 4

You can set a cross browser cookie e.g. http://samy.pl/evercookie/ (flash cookies) The can not be deleted by the browser cookie deletetion they stay 4 ever and you can read the cookie cross browsers. Its the ultimate solution if the user uses the same computer. With more than 1 computer the IP address is your only way to find out, but (in my case) sometimes 2 real people in the same house with 2 computers login 2 my website

Devine

ff warns you that flash is trying to run and this looks malitious – Blithesome

Answer 5

Ask users to register with a credit card. You don't have to charge anything to the card, you can just check that the card is valid.

Emileeemili

Motivated users may be willing to use more than one credit card. This approach still seems inadequate. – Skewbald

Answer 6

You can't and you shouldn't. You are not dealing with the real world guys, but with accounts, so treat them as abstract entities which have the equal rights to live.

Some options I can imagine on the fly:

-- Only one account for email address. But I can create more then one email... or use Mailinator.

-- Long and tedious verification procedure. But that will discourage the users from registration

-- bind the IP to the account and block(temporarily?) that IP from creation of another account. But two different users with the same gateway will be blocked...

-- Use the cookies. But the user can delete them.

Zhukov

I love being able to generate random permutations of my email address at will. [email protected] -> [email protected] notation, or [email protected] -> [email protected] family of tricks, where "variable" can be anything. – Root

Answer 7

The most difficult to break methods I've seen implemented in real life are to use a separate hardware medium for confirmation (sending a confirmation code via SMS for a public service, or mailing an RSA token for something more sensitive, like intranet access), or to ask for a financially-bound piece of identification, for example a bank account number (Paypal deposits a few cents to your account and the sum of the amounts is your passcode) or a valid credit card number.

Kurtis

Answer 8

I think an alternative direction to take with this is to let the "big boys" do it.

http://oauth.net/

Offload the authentication of your site to a well-known 3rd party like Google or Facebook. It won't prevent duplicate accounts, but it's nice to think that the latest in spam prevention and whatnot is automatically implemented for you.

Goethite

Answer 9

One common option is to verify the persons identity through their e-mail. Actually make them respond to an e-mail sent to their account. Some sites take this a step further and don't allow addresses from domains such as yahoo, g-mail, hotmail, etc ...

Win

This still doesn't completely prevent someone from creating multiple accounts, but since most people only create one active mail account it's probably the closest that you can come. – Mccullers

For such sites I use spam.la or fakemailgenerator.com wich frequently changes the domain for the email address. I think ther is no way to prevent this without annoy the /good/ users. – Oao

And you've just excluded anybody who uses certain email clients. – Arlina

The way spam is these days, webmail isn't the invalid choice, it's the best choice, for avoiding spam. – Pointsman

Answer 10

I think, as many people have mentioned above, one of the best ways is to verify mobile numbers and that's what I wanted to use in teh first place, if it wasnt so damn expensive ...

I have found this site here and I think it can be used for this purpose but I havent tested it myself, but it seems pretty modern and cheap

Abstract