1

I'm trying to create multiple Google accounts

Here's my setup:

I use Firefox with the FoxyProxy plugin and a bunch of IP's.

I use the Firefox Random Agent Spoofer plugin, with the following settings:

{

Random browser profile:

enter image description here

Headers:

enter image description here

Options:

(I can only post 2 images, so the last one is here: i.stack.imgur.com/miGH2.png)

}

After each account creation attempt I do the following:

  • Close down FireFox
  • Run CCleaner and clear:

{

  • DNS cache
  • Temporary files
  • All Firefox data
  • Adobe Flash player data

}

Open up Firefox again, change proxy through FoxyProxy

The Random Agent Spoofer plugin automatically assigns me a new browser profile.

However; every time I attempt to create a new Google account I get asked to verify my phone number after which the number is denied.

It is very obvious that Google somehow are tracking me between each session as I am entirely certain that neither the proxies nor the phone numbers are the problem.

So I guess my question is: How are Google tracking me and what am I doing wrong

closed as off-topic by TheJulyPlot, Jedi, Xander, Steve, Anders Jul 6 '17 at 9:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – TheJulyPlot, Jedi, Steve, Anders
If this question can be reworded to fit the rules in the help center, please edit the question.

  • As far as I'm aware, Google always want phone number verification when an account is created from a known proxy IP address. – Matthew Jul 4 '17 at 15:04
  • @Matthew Not always, it depends on the IP. However, it is irrelevant as my phone numbers are being denied. I know for sure that they are identifying me. – Hasse Andersen Jul 4 '17 at 15:05
  • 1
    IMHO, you just encounter Google anti-fraud/anti-spam mechanism. e.g. say if Google noticed your phone last login location is in New York, while you try to register through VPN proxy exit point in Washington, Google can bar the registration and treat it as spam fraud registration. Google might email you on such condition, so check your mailbox. – mootmoot Jul 4 '17 at 15:26
  • have you checked your browser solution amiunique.org/fp or panopticlick.eff.org ? There are many more options to identify you beside HTTP Headers – Serverfrog Jul 4 '17 at 15:34
6

Misuse of free accounts for spamming and similar is a big problem many providers face. Thus they try to detect early if an account creation is somehow unusual, like being automated by a computer or multiple accounts created by cheap labor.

By using a fresh browser profile and trying to be as undedectable as possible you are essentially behaving similar to how massive account creation by cheap labor is done. And you are behaving contrary to the common user for which google usually has lot of data, like interaction with the search engine, google analytics, ads etc. These collected data can be used to decide if the behavior seen in account creation looks like a typical innocent user or more like somebody who wants to create yet another new account, maybe for spamming or selling. And while Google cannot be fully sure of the intentions of the user they can at least add another verification step if they notice unusual behavior - and that is what you get.

In short: the problem is not that Google is tracking you and thus knows that you are the same user who just created an account. The problem is instead that Google has not enough tracking data to be sure that you are an innocent user.

Disclaimer: I don't know if this is really done this way. But, given the amount of information Google has about different user behavior, the advances they make in distinguishing between usual and unusual behavior which they use for example to improve use of captchas or decide that they don't need one and the massive use of big data I just expect them to use all this to minimize account misuse.

  • While this makes great sense in theory, it just isn't like this in practice. I have specifically done my entire setup on a new VPS and it did not get detected, even though Google would not have any previous data. – Hasse Andersen Jul 4 '17 at 15:56
  • 1
    @HasseAndersen: the problem with heuristics (and big data analysis is heuristics) is that it is not fully reliable: you get false positives (innocent user gets blocked) and you get false negatives (malicious user gets not blocked). And usually these heuristics are tuned to have a low number of false positives in order to not scare customers away. But as long there are still enough true negatives a low false positive rate is usually fine. – Steffen Ullrich Jul 4 '17 at 16:03
  • Yes, Ullrich, presumed guilty until proven not guilty. 'Demoncratic Freedom'. – Overmind Jul 5 '17 at 11:45
  • @Overmind: it is a companies choice to offer resources for (kind of) free as much as it is a companies choice to limit access to these resources if they fear misuse. This has nothing to do with democracy or freedom - there is no such thing as a human or constitutional right to have as much google accounts as you want. And they also don't restrict access based on race, gender or similar. Apart from that, they did not even deny the creation of the account, they only asked for additional verification to make sure that the account does not get misused. – Steffen Ullrich Jul 5 '17 at 15:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.