[deleted]
Ask HN: How do you manage registration spam?
11–20 of 28 posts
Re: Ask HN: How do you manage registration spam?
#12Earlier quoted context omitted.
That's why I don't want to add a captcha.
If you are OK with running a Google service, how about Recaptcha V3? No captcha to fill in, just validate the score it generates on the backend.
Is that the same one that sometimes asks you to click on motor cycles and zebra stripes in a loop and you never come out? (this happens often especially if you're on a somewhat uncommon IP address, like an IPv6 /48 with just a few customers on it)
Re: Ask HN: How do you manage registration spam?
#13Automatically delete new accounts that have not verified their email within 24h. Automatically delete verified accounts that have not made a purchase in the first month. Automatically delete accounts that have not generated a "lead" in the first year. Replace "lead" with whatever makes sense for your system. Also maybe put Cloudflare WAF on your signup flow and set it to a high security level.
If you make it too difficult to signup ... no-one will. If you make it too easy, you get a lot of useless signups. Don't make people sign-up to get basic info.
Recently noticed a customer-site had the 'sign-in-with-google' popup. Accidentally mis-clicked the close button, 1 minute later: "Thanks for signing up". And off-course, no way to delete my account.
Re: Ask HN: How do you manage registration spam?
#14The problem might be with your service. Do you force users to sign up before you share any details with them? I routinely provide fake info when a website that I think MIGHT be something I am interested in, but refuses to give me enough info to know for sure, until I give them a bunch of personal info. NO THANKS! Sometimes I tell them my name is Bob. I live at 123 Main St. My email is bob@nowhere.com. If that works t…
You are way too nice. Sometimes I sign up with fuck@off.com, address is 666 nunya business street, anonymousville, united states of handsoffmydata. If I can get their CEOs details or whatever, I sign up with that. Same for newsletter popups.
If they force an email verification, 9/10 times I just leave. For the 1/10 times I'll give a pseudonymous email, and if the service then proves to be useful I /might/ give more info. Usually if I'm actually buying something.
Re: Ask HN: How do you manage registration spam?
#15Use Cloudflare's Turnstile captcha. It's leagues ahead of Google's or hCaptcha. Users never have to click on stupid images, and it works great. You're not going to be able to stop people manually signing up but depending on how they're doing it, you might curb some of it.
These guys have loads of email addresses and can just use a VPN to switch to a new IP in seconds. Often accompanied with a completely fresh browser session that you're going to have a hard or impossible time correlating with past attempts.
Parse the domain portion of the email address and check that against a blacklist of throwaway and fishy email domains. Manually blacklist domains as needed. You can find blacklists hosted on GitHub. Use the Public Suffix List to parse the domain to make sure you don't accidentally ban an entire obscure TLD. Parse down the email domain to remove any subdomain when checking against the blacklist.
If you're really serious, you can use an API provided by SendGrid to check for suspicious email addresses. You can also look into MaxMind minFraud.
Ban IP addresses. Not every spammer is highly sophisticated and sometimes a single, fixed IP will be responsible for many spam attempts spanning months at a time.
Devise a way to fingerprint browers. This can be as simple as a random hash set to some innocuous cookie name. Ban offenders by those too. It's not always going to work but a lot of spammers aren't terribly sophisticated and you'll be able to catch them even if they're IP hopping.
Re: Ask HN: How do you manage registration spam?
#16Automatically delete new accounts that have not verified their email within 24h. Automatically delete verified accounts that have not made a purchase in the first month. Automatically delete accounts that have not generated a "lead" in the first year. Replace "lead" with whatever makes sense for your system. Also maybe put Cloudflare WAF on your signup flow and set it to a high security level.
If you make it too difficult to signup ... no-one will. If you make it too easy, you get a lot of useless signups. Don't make people sign-up to get basic info. Recently noticed a customer-site had the 'sign-in-with-google' popup. Accidentally mis-clicked the close button, 1 minute later: "Thanks for signing up". And off-course, no way to delete my account.
Here's a uBlock filter to defeat 'sign-in-with-google' auto-popups
||accounts.google.com/gsi/*$xhr,script,3p
Re: Ask HN: How do you manage registration spam?
#17Yeah i have a contact form and i have many dozens of absolutely spammy requests each day, many of them looking legit, but obvious auto-generated to catch my attention because they appear to be coming from genuine clients at first glance. Kept wonder why is someone (apparently many people or entities!) are doing this. What is the upside? What are they trying to achieve, let's say i bite and waste my time replying to it, then what?
Re: Ask HN: How do you manage registration spam?
#18Earlier quoted context omitted.
If you make it too difficult to signup ... no-one will. If you make it too easy, you get a lot of useless signups. Don't make people sign-up to get basic info. Recently noticed a customer-site had the 'sign-in-with-google' popup. Accidentally mis-clicked the close button, 1 minute later: "Thanks for signing up". And off-course, no way to delete my account.
Here's a uBlock filter to defeat 'sign-in-with-google' auto-popups ||accounts.google.com/gsi/*$xhr,script,3p
Does this visually block the text+images from showing up, or does it block the network request altogether?
Re: Ask HN: How do you manage registration spam?
#19Yep, we get tons of what looks like coded messages. "I want to know your price" in various languages, SEO spam and such. I send it to myself as email and I had to replace anything that resembles a URL otherwise my emails would get marked as spam
Re: Ask HN: How do you manage registration spam?
#20Earlier quoted context omitted.
I don't suppose it's a problem that can be fully solved; just an ongoing arms race. The hardest part is not deterring genuine users at such a decisive consideration stage.
That's why I don't want to add a captcha.
Just accept it if they don't verify it anyway.
Make sure to have good KPIs not using the pure number of accounts. I think its absolutly valid to have it like that.
IF you really don't want to use a captcha, why not write something very basic specific to your page?
Those are probably spam bots filling out a basic form.