Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage registration spam?

news.ycombinator.com

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Ask HN: How do you manage registration spam?

#21

Post by Meganet »

anovikov wrote: post #17

Yeah i have a contact form and i have many dozens of absolutely spammy requests each day, many of them looking legit, but obvious auto-generated to catch my attention because they appear to be coming from genuine clients at first glance. Kept wonder why is someone (apparently many people or entities!) are doing this. What is the upside? What are they trying to achieve, let's say i bite and waste my time replying to i…

Its about mass and leads to 99% to some scam. I don't think thats a lot of people but someone writes software for this type of thing and others buy it and they then do all the same thing.

Sometimes just an impression (visit of your page) can get you money.

Re: Ask HN: How do you manage registration spam?

#22

Post by abernard1 »

Some of this can be fixed with architecture, some with tech practices.

In no specific order:

- Create a concept of an "enrollment" that is different than an "account." It allows record-keeping for the steps leading up to a malicious account created.

- Require mobile phone validation if possible if you're a consumer-facing company. This makes it much more difficult to create fake accounts without a phone farm.

- Get a good WAF and put your `/enrollments` endpoint behind it. Serve the `/enrollments` endpoint exclusively from the CDN associated with your WAF. Having that page served behind the WAF/CDN allows you to block traffic with rules if you can identify patterns to the malicious behavior

- Separate the writes into the enrollments data store/database from any reads and your main production database. Make conversion of an enrollment to account process async, with a rate-limited architectural queue that can be paused if necessary

Re: Ask HN: How do you manage registration spam?

#24

Post by chuckadams »

rchaud wrote: post #18
sfmz wrote: post #16

Earlier quoted context omitted.

Here's a uBlock filter to defeat 'sign-in-with-google' auto-popups ||accounts.google.com/gsi/*$xhr,script,3p

Does this visually block the text+images from showing up, or does it block the network request altogether?

That filter blocks the request outright. A cosmetic filter would have a CSS selector in it after a couple of # signs, and would apply to the site containing the popup.

Re: Ask HN: How do you manage registration spam?

#25

Post by chuckadams »

ale42 wrote: post #12
gnz11 wrote: post #9

Earlier quoted context omitted.

If you are OK with running a Google service, how about Recaptcha V3? No captcha to fill in, just validate the score it generates on the backend.

Is that the same one that sometimes asks you to click on motor cycles and zebra stripes in a loop and you never come out? (this happens often especially if you're on a somewhat uncommon IP address, like an IPv6 /48 with just a few customers on it)

That’s V2. V3 is always invisible and only returns a score. It’s not unusual to redirect low scorers to a v2 challenge, but afaict you have to set that up by hand.

Re: Ask HN: How do you manage registration spam?

#26

Post by nolist_policy »

decremental wrote: post #15

Use Cloudflare's Turnstile captcha. It's leagues ahead of Google's or hCaptcha. Users never have to click on stupid images, and it works great. You're not going to be able to stop people manually signing up but depending on how they're doing it, you might curb some of it. These guys have loads of email addresses and can just use a VPN to switch to a new IP in seconds. Often accompanied with a completely fresh browser…

> Use Cloudflare's Turnstile captcha.

Is that the one that sends you into an endless loop while on a 3g connection?

Re: Ask HN: How do you manage registration spam?

#27

Post by freitasm »

I run a forum, so there is a higher chance of spam attempts.

We confirm emails before creating an account. Visitors fill out a form with their email address and receive an email containing a URL with a hash of their salted email, which is the actual registration form.

Emails will not be sent to temporary email addresses, which we check using the DeBounce API. We also don't send emails if the IP address is a proxy, which is checked against another API. We also check the StopForumSpam API.

The request and registration forms are protected with Cloudflare Turnstile.

We also block registrations from a list of countries that are not a focus of our content.

I used to have Google reCaptcha v3, which returns a score. Scores above a specific value were rejected. I stopped using Google's service when they unveiled plans to charge with a low threshold for the free tier.

If you want to use the forum, you will register. If not, good.

Re: Ask HN: How do you manage registration spam?

#28

Post by cbluth »

beAbU wrote: post #14
didgetmaster wrote: post #7

The problem might be with your service. Do you force users to sign up before you share any details with them? I routinely provide fake info when a website that I think MIGHT be something I am interested in, but refuses to give me enough info to know for sure, until I give them a bunch of personal info. NO THANKS! Sometimes I tell them my name is Bob. I live at 123 Main St. My email is bob@nowhere.com. If that works t…

You are way too nice. Sometimes I sign up with fuck@off.com, address is 666 nunya business street, anonymousville, united states of handsoffmydata. If I can get their CEOs details or whatever, I sign up with that. Same for newsletter popups. If they force an email verification, 9/10 times I just leave. For the 1/10 times I'll give a pseudonymous email, and if the service then proves to be useful I /might/ give more i…

I'm glad I'm not the only one doing this
Post reply on HN