Is it even possible? I have an application that is susceptible of a same person creating many different accounts on different IP addresses. How to fight against this the best? Using 2-step verification like SMS? Any other ways?
How to protect against a user using many different IP addresses and creating many accounts? [closed]
4
-
The best way would be to require them to submit their passport and SSN for verification, that would be pretty secure. You'd still have stolen identities and such, but you'd stop people who have multiple email accounts from making multiple accounts at least. You also wouldn't need to worry about server resources because no one would use your application.– userCommented Nov 17, 2020 at 19:47
-
"... susceptible of a same person ..." - how are you sure it is the same person? If you would know than you could use this knowledge to stop it or delete the extra accounts. And what harm is actually caused if a person has multiple accounts? There is not enough known about the application, what accounts can be used for, why it is important to have only one per person, what you get on information within registration, how complex is the registration allowed to be etc. But a useful answer depends on these information.– Steffen UllrichCommented Nov 17, 2020 at 19:53
-
@SteffenUllrich Can a user have many different IP addresses? How would he achieve that without a botnet?– eveningCommented Nov 17, 2020 at 20:00
-
@evening: The IP address is not bound to the user. A user has different IP addresses on mobile networks, at public hotspots, when using home network - and it even changes from time to time in the home network. User might also use a VPN, Tor, ... which all result in different IP addresses.– Steffen UllrichCommented Nov 17, 2020 at 20:12
Add a comment
|
1 Answer
There are different approaches, based on how badly you want to prevent users from creating new accounts. While this isn't a comprehensive list, it should give you an overview of what is being done:
Just let them
The simplest approach is to not care at all. If your users want to create multiple accounts, you just let them. While this may sound like "The safest way to ski is not to ski", it is indeed how some services operate. Not every user with multiple accounts has those for malicious reasons. For example, you could create a second Stack Exchange account for a question that you may find embarassing or for which you may have personal reasons as to why you don't want to have it connected to your other account.
Tie registration to a difficult-to-obtain factor
Phone numbers aren't as easy to obtain as they used to be. Back in the day you could buy 20 pre-paid sims with individual phone numbers at the grocery store and nobody would bat an eye. Okay, maybe the cashier would look weird at me, but she doesn't get paid enough to care.
These days, even prepaid SIM cards are more difficult to come by, so an attacker who wants to have lots of different accounts has to go through significant trouble to get them. If their costs to get a new account are higher than their expected gain, it'll not be worth it anymore for them.
Make them pay for a new account
You could tie accounts to licenses. As such, if a user wants to register 10 accounts, they need to buy 10 licenses. While obviously this strategy doesn't work for every kind of service, it does indeed work for some kinds.
Cheating in an online game, for example, becomes less desirable if you need to pay 40€ for a new copy of the game every time you are banned for cheating.
Analyze their behavior
This approach requires considerable investment, but you can build a system that looks out for anomalous behavior and flags it for manual review. For example, if two accounts constantly and almost exclusively upvote each other, then you can be pretty sure that those are sockpuppet accounts.
Of course, the actual implementation of such a system is difficult and will include lots of false positives and false negatives, but depending on how badly you want to stop people from using multiple accounts, it may be worth it.