Fake account creation prevention on a Laravel website - php

I'm working on a Laravel project I'm building on my own that will require a fake account creation prevention system. I've already read some articles online and for now all the solutions which came to my mind are the following ones. I would like to make a mix of following technics, but not sure about how it's handle on other existing websites.
My website will require a bank account / paypal account, but also social networks to enjoy the experience. My service won't need people to pay to access to it.
I wanted to have a return of experience of people creating solutions like this online and what is the best combo or solution to avoid to maximum fake profiles creation ?
Email validation
(+) Easy to implement
(+) Easy to do for users
(-) Easy for people to bypass with fake emails or trash mails
Captcha
(+) Good to block spam bots
(+) Easy to implement
(-) Not working for every time of bots, and not working when people creating manually fake profiles
Social network link
(+) Could be a good basis to check user presence on Internet
(-) Not everyone has a social network account
(-) The social network account could be a scam also
SMS validation
(+) Pretty secure
(-) Not everyone has a mobile or are whiling to give their mobile
(-) Some platform already exists to send / receive online SMS to easy to avoid this system
Bank account / Paypal account
(+) Hard to fake
(+) Only people who are whiling to fill that information will do it
(-) How to check the user is real based on that informations ?
(-) What if the Paypal account is also a fake ?
Moderators
(+) Perfect to control all informations
(-) Consume time
(-) Consume money
I also know there is an existing online solution for that, but at the beginning of a project it represents a huge cost : Detect fake accounts
What are the solutions you are using right now and what would be adapted to minimize the number of fake profiles on a website ?

I implemented for prevent spam email registration in /register url.
When I try Google Captcha V2, V3, Mews Captcha, neither of one works for me.
Finally honeypot did the job.

option 1) we are using the invitation CODE scenario that will be generated from the admin side and only that users who have the CODE will be able to sign up the website.
option 2) when generally bots or something are using they were filled all form field so we can just take the Empty Form Field and it will be validating while register new user if value will be filled then its bot or something wrong that way we can prevent it.

Related

Security of logging in with phone number only, plus SMS code

I am building a cross-platform app and using PHP and MySQLi. Users sign up with either their Facebook account or phone number. If they choose phone number, they enter their number and an SMS is sent containing the verification code. The user enters the code and an API token is sent back to be used across the API requests. Tinder (for example) is this way.
I am considering Twilio for the verification.
My issue comes down to the security of this login process. Can a malicious user just rapid-fire the login request that creates a verification code over and over again... sending plenty of SMS and costing me a fortune on my Twilio account? Should I only allow so many attempts? Can a bot just eventually guess the code?
What is the security behind Tinder's API?
things to consider:
1- limit request per phone number
2- limit request per user (by ip)
3- use captcha (only after second attempts to keep your app user friendly)
4- use honeypots
"can a bot guess the code?"
verification codes should have a time constraint. after like 2 mins they should be invalid. time constraint and request limiting should make it very very unlikely for a bot to guess the code.
if you are using laravel it already have rate limiting middleware (limit by ip).
Twilio developer evangelist here.
I agree with all the things that Shalior says in their answer, so I'm not going to reiterate that.
What I wanted to share was this article on falsehoods programmers believe about phone numbers. It is a good reminder that phone numbers don't necessarily uniquely define a user, and worth keeping in mind if this is your intention for a passwordless login.

Wordpress Opt-In Form with Social Login to receive Leads from Users

Dear Stackoverflow Community,
I am an Online Marketer and I am facing a problem: People are not converting when visiting my page through a smartphone. My interpretation is: they are lazy, as I am too.
I am not too terrible deep into programming Wordpress, but I thought about something and seeking advise:
I want to to build a Opt-In Form, which uses Facebooks "Social Login"
to process the Lead.
I need to find a way to get the "E-Mail-Adress" through the Facebook open graph API.
I generated a lead with one simple click.
I guess Online Marketers are graving for a feature like this!
So my question is:
Do you think it is possible to build a Wordpress Opt-In Form which uses Social Login (Facebook, Google) to receive E-Mail-Adresses from my users?
Maybe someone has some experience with this.
Best wishes
Dennis
I don't think there is a way to capture user's email address from facebook without permission of that user. However, there are a number of plugins that show popups and widgets to get users to subscribe to your newsletter etc.
https://wordpress.org/plugins/optin-forms/screenshots/
Also, if your content is good and if you create a catchy Call to Action, then it's possible to get more people to subscribe to your blog.
Isn't the process of opting into a subscription more involved than simply entering a name and email? Personally, I will ignore an optin form that requires me to do a social login.
Using a regular WordPress opt-in form plugin would suffice.
By the way, do you have any data that shows conversion is low because social login isn't present?

Preventing Duplicate Form Submissions using 2FA

My problem is this:
I have a survey that is taken by people that they're paid for. I want to avoid the same person submitting the form multiple times. It is a web application.
What I have tried:
I have tried recognizing the IP address from which they try to submit the survey but it hasn't worked.(They could just change devices and so, IP changes) I could try 2FA (where I authenticate using SMS/Voice to phone numbers) but free phone services like Google Voice/Twilio will render that useless. Using a SHA/MD5 hash on a combined key such as phone number and email address still faces the same multiple emails/phone numbers problem. Uber has recently covered up its tracks and devised a way (or a partnership) to recognize Google Voice Numbers. I have gone through the Google Voice API and haven't found a way to find the actual phone number linked to the Voice number.
Is there any full-proof way of doing this?
PS: I am NOT talking about multiple form submissions on a form (say a ecommerce website) which causes multiple charges to a credit card. Please do NOT suggest CAPTCHA.

Drupal Rules to block Spam Bots

I'm using Drupal 7 with Drupal Commerce for my e-commerce website.
I'm not a new programmer and I can pick up on skills relatively quickly, but I do not do it for a living, so bear with me if this seems like a stupid question.
I'm having difficulty with spam bots filling out my form "Commerce Checkout". Commerce creates a new customer profile (one each for shipping and billing information).
Shipping and Billing information each have the following fields:
First Name
Last Name
Address 1
Address 2
City
State
Zip Code
Country
It's pretty easy to determine which profiles are created by spam bots and which are real. The bot-created profiles have the same string of data in EACH of the above fields.
I'm trying to create a rule using Rules and Rules Form Support modules to BLOCK the creation of the profile or progression through the checkout process if any two of these fields contain the same data, but I'm running into a wall. How can I set up rules in Drupal 7 to accomplish this (i.e. if Address1/Address2 are the same or FirstName/LastName are the same or FirstName/Address1 are the same....)
If there's another way to accomplish this I am open to suggestions. From what I understand, CAPTCHA and Honeypot are really not options for the checkout-process forms because they will not block the progression to the next step. Unless someone is willing to show me how to incorporate one of those as well, that would be great or possibly even easier...
There are lots of modules which can protect your website like
Spam Detect: https://www.drupal.org/project/spam_detect
Spambot: https://www.drupal.org/project/spambot
Simple Anti-spam: https://www.drupal.org/project/simpleantispam
User Ip Log: https://www.drupal.org/project/uiplog
Restrict Ip: https://www.drupal.org/project/restrict_ip
IP Ranges: https://www.drupal.org/project/ip_ranges
Ban an Ip address: https://www.drupal.org/documentation/modules/ban
and many more.
Use any or any set of such modules to prevent your site from spammers. You can choose which suits you better.
Thanks
Just require login with Commerce Checkout Redirect:
https://www.drupal.org/project/commerce_checkout_redirect
It will require anonymous users to set up an account first before proceeding.
If you still need more security, you should also be able to follow this suggestion to enable CAPTCHA on your user registration form:
https://drupal.stackexchange.com/questions/95979/add-captcha-to-registration-form
That should make it possible to reduce the number of spam submissions through your checkout system.

Preventing abuse to an invite system

recently I helped some friends ship an invite system in their website that works like this: A user creates an account, we send a verification email and when he verifies the e-mail he gets one free credit to spend on the website. In addition to that, he has personalized links he can share on social networks or via e-mail and when people register using this link (e-mail verified accounts again) he gets one credit per invite. Much like the invite system on thefancy.com or any other reward driven invite system on the web.
Lately we see elevated rates of fake user account which probably are automated. The registration page features a CAPTCHA but we're aware this can be bypassed. We also see elevated rates of users creating disposable email addresses to create accounts following specific invite links thus crediting one legit users that onwards uses the free credits he earns.
I am looking for an automated way to prevent such kind of abuse. I currently investigating putting rate limits on invites/registrations that come from the same ip address but this system itself has it own flaws.
Any other production tested ideas?
Thank you
Edit:
I've also proposed 2 factor registration via SMS but was turned down due to budget shortage.
It seems you need to require more than just a verified email address before a user can send invites, ideally something that shows the user has participated in your site in some way. Without knowing what your site is it's hard to give specifics, but the StackOverflow equivalent would be requiring users to have at least X reputation before they can invite others. If you're running a forum you could require that they've made at least X posts.
I'd also suggest a small time limit before new accounts can invite - e.g. they have to have been a member for at least X days. This complicates automated invites somewhat.
An extremely simple method that I have used before is to have an additional input in the registration form that is hidden using CSS (i.e. has display:none). Most form bots will fill this field in whereas humans will not (because it is not visible). In your server-side code you can then just reject any POST with the input populated.
Simple, but I've found it to be very effective!
A few ideas:
Ban use of emails like 'mailinator'.
Place a delay on the referral reward, allowing you to extend fraud detection time period, giving you more time to detect bogus accounts and respond accordingly.
Require the referred user to create a revenue generating transaction before you give out any referral rewards (I know that might not be a shift you can make) - possibly in turn increasing the reward to account for the inconvenience to the referrer (you should be saving money through decreased fraud so not a hard sell).
Machine learning. Ongoing observations and tuning with your fraud detection. The more data you have the better you will be able to identify these cases. (IP addresses as you mention.) Shipping / billing info even more telling if it applies - beware adjacent PO boxes.
Add a CAPTCHA test to the confirmation page. I would be wondering if your CAPTCHA is sturdy enough if it is getting bypassed somehow. You might consider using the (hateful) reCaptcha which seems popular. A CAPTCHA on the confirmation page would reduce the risk that a 'bot is submitting the confirmation page. In other words, it would implement the idea of client interaction with the site after registration. A similar method would be to ask for the registrant's password.

Categories