What would be your implementation for preventing bot accounts?

[u/Adventurous-Hunter98]

Lets say you created a new social media/forum/user based site and you want to prevent bots as much as you can, what would be your implementation do this while maintaining users privacy? not like current id verification they are trying to implement

[u/portar1985]

I've always dreamed of creating a social media platform which actually uses national ID systems, so an account always can be attributed to a human being. The issue obviously being that there must exist a digital id (like bankID in sweden which can function in a "ok, you're a human, come in" kind of way) and the code would need to be open source to be able to show that we really do not use your credentials, just the auth part.

[u/forestking101]

Honeypot fields inside hidden forms work surprisingly well

[u/Adventurous-Hunter98 → u/forestking101]

I didnt heard that before, Im going to check it out, thank you

[u/KingofGamesYami]

What is a "bot account"? Is it accounts created by bots? Accounts created by humans for bots? Formerly human accounts stolen by bots?

[u/Adventurous-Hunter98 → u/KingofGamesYami]

All of them I guess

[u/OptimistIndya]

Ask random history/ science/recepie questions science questions

Upload a relevant picture of - questions

About 3-5 questions. Random and update the question format from academic papers and other sources

[u/Adventurous-Hunter98 → u/OptimistIndya]

If the questions became too easy, bots can bypass it, if it gets harder people stop using it or thanks to ai bots can bypass it also

[u/heyyarun]

Since you want to avoid ID, I'd stack a few cheap layers instead of looking for one fix.

At signup, Cloudflare Turnstile instead of a classic captcha. It accepts Private Access Tokens (built on Privacy Pass), so on recent Apple devices the device vouches for the user and you never learn who they are.

Then make accounts cost something without asking for identity. Lobsters does it with an invite tree: every account hangs off whoever invited it, so when a spammer turns up you can prune their branch, and people care who they invite. If you'd rather stay open, rate-limit new accounts: no links, a few posts a day, no DMs until they have some age or karma.

And like gnufan said, keep the thresholds private so bots can't test their way past them.

[u/Adventurous-Hunter98 → u/heyyarun]

Thank you

[u/xRmg]

Its always a tradeoff between useability, privacy and price to bypass

Captcha's are easy to implement but easy to bypass, a dollar gets you 1000 solves with a bypass service.

Then there is browser fingerprinting, whitelist for email domains, geolocation of user, vpn blocking, which all make it a little harder to bypass.

Phone number verification, bypass services start at 10 cents per message depending on country and platform, if you ban cheap voip numbers, and have a select list of countries/providers that are withlisted, bypass price goes up to 3 dollars and more.

ID verification is about 10 to 30 dollars based on package.

So how bad do you want to prevent bots, Personally id consider phone number verification, and a whitelist for email adresses, vpn block/ip bans, and a captcha.

[u/JacobStyle]

Well, since it would be a new site, created by me with my shit marketing skills, it would remain obscure enough never to be botted.

But for a more technical answer, any anti-bot, anti-cheat, anti-hack measure in any big platform, there is no single solution. There are fundamentals (requiring email verification to make an account, banning for rapid posting, basic account security) that any platform will implement from the start. Anything you implement will get circumvented eventually though.

This requires continual effort, detecting when botters have found ways around your countermeasures and then implementing new security. Any solution aggressive enough to have an impact will also negatively impact user experience when first implemented and will require fine tuning. Sometimes compromises will have to be made, allowing some bot posts in order to avoid too many false positives.

Bot traffic also comes and goes for a lot of platforms, depending on factors like controversies related to the community making the news. During a time that is particularly bad, you may need to implement temporary measures that are more strict that normal, such as freezing of account creation or having stricter posting limits.

[u/gnufan]

I'd say from work on websites for other things a useful approach is not to reveal how you decide someone is dodgy to in a testable way.

We spent ages creating protections on the sign-up forms, what worked best for one abuser was deleting everyone who registered accounts where the country code was not on the drop-down on the picker, but we disabled those accounts the same time each day rather rejecting them at the sign-up form processing.

We put days of work into a fancy control in the login page, and I actually found the session when that abuser first figured out what the changed, and shortly afterwards the bots started up again with a workaround. Whereas because we deleted the dodgy country accounts in asynchronous manner, they couldn't easily figure out what we were using as the identifier.

Also consider linking accounts to mobile phone numbers not emails, think account sign up and recovery flow. As it is still slightly more effort to get another number in general, than another email address.

[u/Adventurous-Hunter98 → u/gnufan]

for phone numbers, I think they use single time use phone number that are sold on the web, you still need to find those services and restrict their numbers but cut one head two arise.

[u/ericbythebay]

Easiest way is to charge for the accounts.

[u/Adventurous-Hunter98 → u/ericbythebay]

You need to have a good reputable background to do that or offer something better than "free" versions

[u/mredding]

Credit card number. If you don't mind getting regionally specific - some sort of government identifier coupled with some sort of authentication.

Of course, no one will want to do this, and you can't be trusted with such sensitive information.

[u/BoBoBearDev]

Two form authentication. Send the activation code via phone number. If they don't type the activation key, that means they are using someone else's phone number.

[u/Adventurous-Hunter98 → u/BoBoBearDev]

I replied on another comment about the same answer, for phone numbers, I think they use single time use phone number that are sold on the web, you still need to find those services and restrict their numbers but cut one head two arise.

[u/Last8Exile]

Today even real people behave like bots. They use AI to write their posts and respond to comments.

[u/SwingAggravating5724 → u/Last8Exile]

this post is about how to easily get rid of the 'people' you are talking about. no one wants them. they are worse than advertisements.

[u/nwbrown]

Require something like a school or corporate email and only allow on organizations which agree to only allow human users on.

[u/Critica0]

in the age of social media why would some-one anyone give you a billion dollar idea.

[u/Adventurous-Hunter98 → u/Critica0]

sorry for asking a programming question in the ask programming subreddit

[u/Critica0 → u/Adventurous-Hunter98]

not the point i was making.

[u/OkOcelot6725]

Don't try to win at signup, win at the action level. Bots are economical because one account can act thousands of times, so throttle the expensive actions (posts, DMs, votes) by account age and reputation. A bot farm that needs a week of normal behavior per account before it can spam stops being profitable, and no ID check needed.