Proper way to target spammers on pages such as user registration, password recovery, etc

Question

What is the best way to handle spam on pages like user registration or password recovery? I am not asking about whether to lockout a user for a few minutes or how to put up a captcha. I'm interested to learn on how do I target the spammers.

Iv'e read that it is bad to target a user via:

1. IP since a lot of users share a common IP (e.g. users connected to the same wifi, users on a proxy, etc.)

2. Session and Cookies since users can just close open browsers and not allow cookies

So how do I target them so that I can implement proper spam prevention systems? I think it would be very easy for a spammer to just use the password recovery or registration form to spam away my site's confirmation emails, which would result to users flagging the emails as spam and stacking the server with unnecessary requests. Any ideas?

Answer 1

You are right about your assumptions on "what is bad", but when dealing with these kind of problems you have to ask yourself several questions:

1. How many same-ip users are going to ask for remembering their password?
2. Does my solution works reasonably well? (time-effort/solution)
3. Is this really a risk in your system?

I believe that the best way to approach this problem is an heuristic solution. The best thing to do is to study how many users do use this system a day and how many petitions you usually have. Once you have done this you can automate an alarm so that it sends you an e-mail when your algorithm find suspicious traffic.

Also, locking the page (as you suggest) will prevent malicious users to exploit this page and you are in fact mitigating the other problems.

Consider also some other actions:

1. setting some thresholds like: "maximum 2 mails a day for retrieving password for user".
2. using different from-emails for different actions (just in case they mark one of them as spam).
3. adding text in the e-mail so users are able to identify if somebody is trying to hack them.
4. others?

As a rule of thumb and when addressing security issues, never try to overkill a problem, consider always the risk ( probability of the materialization of a threat vs the impact over your business). Small and easy solutions are usually the best if they address well enough a vulnerability. Consider always the security/usability trade-off.

Hope this helps you.

(Feel free to add any grammar/syntax correction since English is not my mother tongue).