0

I wonder whether or not there are mechanisms other than captcha that prevent a mallicious script from creating an indefinite number of accounts for a given service. If so, is this not a huge red flag, especially with image analysis algorithms constantly improving?

Improve this question
3
  • Some sites, such as StackExchange, only give new users very limited abilities, meaning that it doesn't really matter if they create loads of accounts - they still can't do much. In order to be able to do anything useful, an attacker would need to earn reputation. They can post spam messages, but they don't last long - usually less than a minute...
    – Matthew
    Jul 3, 2017 at 7:54
  • Wouldn't loads of accounts at some point fill the database (asuming that the attacker can create a huge number of email accounts, something prevented by captcha?)
    – user2887596
    Jul 3, 2017 at 8:02
  • Only if you preserve them - if you delete accounts which aren't used within a certain period, you're fine. Also, you can have as many email addresses as you like with some providers without needing captcha - Gmail, for example, lets you have addresses such as [email protected], where the string after the + sign can be arbitrary, and is used for filtering.
    – Matthew
    Jul 3, 2017 at 8:08

2 Answers 2

Reset to default
3

  1. Prominent web services use second level confirmation to screen and obfuscated automated spam registration, to increase the cost of automated spam. E.g.:

    • email with a unique confirmation link
    • email with a confirmation code that required user to click on a sperate link given.

  2. Another bot check can be initiated by loading a welcome page with javascript that tracks mouse movement(normally bot script will not emulate mouse movement). However, this is a gray area because such script can be abused to use to fingerprint the user.

Improve this answer
1

The mechanisms vary between site. Captcha isn't just image of letters, Google's ReCaptcha doesn't show anything other than a tick box (you can google how that works).

The different mechanisms therefore are site dependent. A developer may require admins to approve accounts, restrict accounts to be created only after email validation, or number of accounts from an IP etc... there is no one answer for a question like this.

But in direct response to your question yes more can be done than just a captcha.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .