How to suspend a user from my website and prevent them from creating a second account?

Question

I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The problem is to detect users who create a second account. Here are ways I've thought of:

• IP address tracking
• User information (email address or any information that is repeated on the second time of registration, after suspension)
• session id cookies are also a way to identify the users after login

Any more creative suggested ideas? Is it possible to make it 100% impossible to prevent those bad users (frauds, spammers) from coming back?

Answer 1

There is no way to prevent multiple registrations.

I have two suggestions to offer

1. Make multiple registrations undesirable, for example by charging a fee.

2. Outsource the identity problem to someone else, for example my using Facebook or Google login instead of rolling your own.

Answer 2

No - given that most users come in from large ISPs, their IPs are not fixed for all time - the names they give to you certainly aren't fixed

Security is not a black and white issue - though it seems too many don't seem to understand that - it's an issue of making the cost of defeating it not worth the reward

In the general scenario you're describing, captcha might help - for the dumb ones it defeats them - for the more sophisticated, they may not care to waste the machine cycles, at least for spammers

email won't do you any good - i'm a nice guy and i still have an excessive number of email accounts, and it's really easy to get more these days

summarizing, stop looking for a black and white solution - instead, look for a solution where the costs to legitimate users are acceptable, but the costs aren't acceptable for the given reward for someone overriding your safeguards

and take a page from the stack overflow world - reputation is something you can bind to accounts - then you at least have a way of 'scoring' users

Answer 3

You could prevent multi-registration by increasing your identity proofing (See OMB M-04-04). Of course by doing so, registration is now much more difficult for your legitimate customers. So while you could prevent multi-registration, you probably don't want to. (Please note, I'm not seriously suggesting that you upgrade your identity proofing. Increased identity proofing answers the specific question you asked, but I don't think it is a practical solution to your problem).

I believe your real challenge is to design a registration system that discourages fraudulent users but is relatively transparent to legitimate users. If I were in your shoes I would probably @Mark Mullin's suggestion that you bind some reputation to the account with federated identity. Federated identity means that you don't register users; you allow them to use credentials generated by a third party. For example, I use my google credentials to log into stack exchange. The "how to" on federated identity is a bit more complicated than I think is appropriate in a Stack Exchange answer, but you may wish to consult Google's Relying Party site. Two of the primary implementations are OpenID, and Shibboleth, and I know that Kingsley Idehen has posted extensively on "how to", including code samples (that last link is to his G+ profile; I don't have a better way to contact him).

I think that there is much merit in Mr. Mullin's suggestion that you create reputation and link it to the user's account. Assign a reputation score based on the number of transactions the user has participated in, or the total value of the transactions, or like ebay, on the feedback from other participants in the transaction.

And to echo someone else's comment, no, it is not possible to make a website 100% secure. That is a fundamental principle of security; the best you can hope for is to mitigate the risk to an acceptable level. If you're really doing security design for a website that involves monetary transactions, I would urge you to obtain a security architect. Security is complicated. Your security architect needs to have a lot of fundamental knowledge that can't be picked up through google searches. If you are conducting monetary transactions without a security architect you are exposing your company to considerable risk. The risk of losing money, the risk of being sued by customers who have lost money or personal data, and potentially criminal liability, depending on where you're located. This isn't something that can be learned through a month of internet research.

Answer 4

There is a way you can make it extremely difficult for a user to re-register more than a certain number of times without disrupting legitimate user registration. Just follow the money...

As a shopping website, your users must be using some kind of payment system. If they are putting their financial information into your system (not using a 3rd party like paypal) you can ban their credit/debit/bank account info. You'll have to make the financial information mandatory as part of the user registration process, but Apple does the same thing with the app store so it's not likely to be perceived as unreasonably burdensome to legitimate users.

Now, a nefarious user can only register once for every payment account they have. If they start constantly changing their account numbers by opening and closing cards or accounts they risk attracting unwanted attention from financial institutions or regulators.