Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to hear recommendations on a best practice for handling abusive users (for whatever reason) on an authenticated Website.

Is there any point in keeping the user in the database with a "banned" flag, or may you just as well delete the user?

Of course, in the latter case, people may re-register with the same email address, but in the prior case they may just as well re-register with a new, disposable email address, or a new mail alias on a domain they own.

So is there any real point of keeping banned accounts around in the database?

EDIT: It's a social media where people upload images and communicate. There are no IP restrictions on the site, and it's not an open forum.

share|improve this question

closed as primarily opinion-based by Adnan, Xander, TildalWave, NULLZ, Terry Chia Aug 7 '13 at 11:39

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
This hugely case-dependant, and thus the answers are gonna be primarily opinion-based. Do uses upload files or make comments/posts? Do you wanna keep their comments? Delete the comments and their other comments? Is it a forum where the user asked a question and the question got good answers? Do you allow only one account per IP address? There are tens of questions and tens of sides to this problem. I voted to put this question on hold until it's reworded. –  Adnan Aug 6 '13 at 13:15

6 Answers 6

As a rule, traceability is good. In some jurisdictions, you are supposed to keep logs for some minimum amount of time. So I would say: keep an entry for the banned user. Abusive behaviour may have legal consequences (depending on the kind of abuse, another user may wish to trigger legal retaliation, or law enforcement agencies might declare themselves interested on their own account). If you are not able to show logs and other traces, then you could be suspected of being an accomplice, which is rarely a good thing.

In any case, you most probably have other, technical reasons for keeping the banned user entry around. If your Web site is some kind of forum (a typical reason for banning being abusive behaviour when writing) then your forum database contains some messages which refer to the user as author. By deleting the user entry, you would make these references dangling links, which can only confuse your forum management software. Deleting the banned user would then entail deleting all traces of his activities on your site, i.e. pretending that the user never existed at all in the first place. This is probably hard to do, if at all possible.

Also, a user who gets banned is also a user who got bad reputation. You can delete forum posts and records, but you cannot delete reputation. If the user entry is destroyed, another user may register and happen to use the same name, thus unwillingly inheriting the dubious fame.

share|improve this answer
    
+1 on the last point. Even if you manage to solve all the technical problems, and are sure you don't want to reverse a ban, letting a new user create an account with the same name is a bad idea. It will be a bad experience for the user if the previous owner was infamous, the "new" user might be the previous user, and people will get confused. (X did horrid things. Why are you letting him back on?) –  Patrick M Aug 6 '13 at 15:43

I have seen situations where users have been unbanned from forums after contacting the Administrators a while later. Depending on the offence the user committed, you might consider unbanning him eventually.

If you decide to allow the user on your website again, it would be simpler for both of you to let him use the very same account. In a forum, you could restore his posts and keep track of his behavior without having to keep in mind his new username in the case where you deleted it (assuming he wouldn't create a new one and that you actually know he's back on the website).

The way I would implement this in a database would be 2 fields: a boolean that makes the user banned and a varchar where you could leave a comment why you actually banned the user for future reference. It will be simpler to reconsider the user's case if he contacts you later to gain access to your website again.

share|improve this answer

Identity management is just that. You have an identity and you want to limit assess related to that identity so do so. Why would you weaken your identity management solution but destroying records? Use it, don't corrupt it.

share|improve this answer

You want a record of who has been removed from the community so they can't sign up again. Even if you permanently intend to remove someone from the community, it is worth knowing you removed them. A permanent ban is a record of the fact they are not welcome.

If you are worried about taking up space, purging all their other data (such as posts and comments and such) can be done while still preserving their user record and details (which should be very small), just so that you know who has been removed.

share|improve this answer

One solution to the problem is to create a table with 'flags' that prevents the user from being created again, you can set up your own flags/preventions.

  • If a user that is banned(added to the table based on username or ip) attempts to log in it will be refused.

  • If someone tries to create an user with a banned mail address or blacklisted mail domain the ip address will be flagged in the table and the user will be refused.

If you do like this you will store less data about the current user(based on how big your user table is).

share|improve this answer

Banning users as you said permits you to check for re-registration, you can also add more data which might prove interesting like IP address, time, day, country and much more.

Even if you don't plan them now they might be interesting in a future and for that you would need to ban them and not delete them, so generally I'd say it is a good practice to ban and not deleting users.

As for re-registering with a new disposable address in my experience you should check for disposable addresses (there are lists like this https://gist.github.com/adamloving/4401361).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.