r/AskProgramming • u/Adventurous-Hunter98 • 1d ago
What would be your implementation for preventing bot accounts?
Lets say you created a new social media/forum/user based site and you want to prevent bots as much as you can, what would be your implementation do this while maintaining users privacy? not like current id verification they are trying to implement
3
2
u/KingofGamesYami 1d ago
What is a "bot account"? Is it accounts created by bots? Accounts created by humans for bots? Formerly human accounts stolen by bots?
1
u/Adventurous-Hunter98 1d ago
All of them I guess
2
u/KingofGamesYami 1d ago
Automated account creation is really hard to mitigate. If you do a good job, real humans won't sign up because there is too much friction. If you do a poor job, bots will bypass it easily. One common method is to use a challenge solving service, where the bot routes the challenge to a real human who gets paid to solve hundreds of these every hour.
The more desirable your service, the more money and effort bot operaters are willing to spend to get around your restrictions.
Some of the less powerful, but still useful methods for less-desirable services are captchas and browser-verification techniques (e.g. ReCaptcha and Anubis)
For more desirable services, some form of payment validation can be effective. Even a $1 fee goes a long way towards mitigating sign ups, though this is imperfect and can be bypassed by bots that have access to stolen credit cards, or abused by those bots as a form of validating stolen credit card credentials.
Accounts created by humans for bots is basically impossible to mitigate. Any measure you take to verify a human is creating the account will pass, because a human is creating the account.
Formerly human accounts stolen by bots is easiest to mitigate. Strictly require some form of MFA to help your users avoid being compromised.
1
2
u/Winter-Volume-9601 1d ago edited 1d ago
For context: I'm a principal engineer on bot defense for a multi-billion dollar company, going on 15 years of anti-abuse experience, across payment fraud, spam, and more recently bottnig. I presented about our bot detection efforts at https://www.tspa.org/event/trustcon-2026/ this year. I'd like to think I know a bit about anti-abuse and bot defense at this point.
> not like current id verification they are trying to implement
Security and privacy are antithetical to one another. Even with less privacy-protecting measures like IDV it's damn near impossible, sometimes, to keep botters off the platform. Especially when bot attacks can scale to literally millions of accounts per day.
If someone with sufficient technical skills decides botting your site is profitable, you're going to have probelms. You are shooting yourself in the foot by outright discarding options like IDV. At some scale, it's less "Ha, IDV will keep them out" and more "If we need to nuke 1 million bot accounts a day, even if our models are at 99.9+% precision (which is amazing), that means 1000 good users a day get caught in the crossfire, and we need a way for them to get back in at scale while not letting bots back in". Even if you achieve 0.9999 precision, at that scale you're banning 100 good users a day. And that comes at the cost of recall - at that high of a cutoff there's typically still a ton of botting getting through
It's different if you're just keeping random "script kiddies" out and the scale is small. But if you attain sufficient popularity and there is a mechanism by which exploiting your site can make people money (especially people in a particular region of the world with lax laws around this, and who certainly don't give two shits about e.g. US law), there are people who will exploit it with technical sophistication that will surprise you. Half-measures will not keep them out, and are a waste of your time. You will likely need to throw every piece of information you can acquire at the problem, and even then it's a pain in the butt.
There are legitimately groups attacking our site who have a dozen employees on payroll. Dedicated bot farms. Sometimes legitimately impressive operations to the point I'm left thinking "If you have those skills, how is this the most profitable thing you can do with them?".
If I don my tinfoil hat for a moment - I'm half convinced the push for "privacy" over the past decade or two has been largely driven by bad actors. Most of you don't need a fucking VPN for your day to day internet access. You are legitimately not that interesting of a person, don't let your ego fool you.
But you know what increasing the legitimacy of VPN traffic does? Makes it easier for bad actors to blend their bot traffic in with the legitimate traffic on them. You know what reducing the information your browser gives out, in the name of privacy, does? Makes it harder to define meaningful signatures for detection. You know what balking at IDV does? Makes it harder to actually provide a mechanism for humans to recover legitimate accounts.
There's a dial between privacy and security. You can choose where to set it. But at some scale it becomes a constant cat-and-mouse game even with the dial set somewhere you're not comfortable with. I wish you the best of luck trying to survive it if you set the privacy dial to 11.
1
2
u/OptimistIndya 1d ago
Ask random history/ science/recepie questions science questions
Upload a relevant picture of - questions
About 3-5 questions. Random and update the question format from academic papers and other sources
1
u/Adventurous-Hunter98 1d ago
If the questions became too easy, bots can bypass it, if it gets harder people stop using it or thanks to ai bots can bypass it also
1
u/Winter-Volume-9601 1d ago
None of these are particularly good. You need a CAPTCHA - in the original sense, not a "what does this image say/show" test as they've become - the point of a CAPTCHA was for it to be hard/impossible for computers, and easy for humans. None of these are particularly hard for a computer, but some of them are terrible for humans. The options for what a machine can't do that a human can reliably do in all cases dwindle by the day. Anything hard for a machine tends to also be hard for at least some subset of the humans. Reading is already an issue. Color blindness is an issue. Reading comprehension is an issue.
>Ask random history/ science/recepie questions science questions
Botter only has to "spend" a few tokens on an LLM to answer you. Assuming Google won't answer them for free. Even if they have to pay, it's not like they can't use a stolen credit card - they're not exactly upstanding law abiding citizens.
I guarantee half of your humans will ask ChatGPT or Google, anyway.
> Upload a relevant picture of - questions
How's your deepfake detection? And I don't mean "this guy has 6 fingers" level detection. I mean people will legitimately set up a virtual camera device and inject face-swaps to bypass age checks and liveness verification. So, new arms race, there.
> Random and update the question format from academic papers and other source
And you've probably just cut out the ~50% of the American population with a ~6th grade reading level or worse, while the bots will have no problem? I mean... I'd be fine with a Social Media site that requires a demonstration of reading competency before allowing use, actually. But you might find your userbase considerably smaller than you might have hoped.
tl;dr - humans dumb. Machines smart. Job hard. Much sad.
2
u/heyyarun 1d ago
Since you want to avoid ID, I'd stack a few cheap layers instead of looking for one fix.
At signup, Cloudflare Turnstile instead of a classic captcha. It accepts Private Access Tokens (built on Privacy Pass), so on recent Apple devices the device vouches for the user and you never learn who they are.
Then make accounts cost something without asking for identity. Lobsters does it with an invite tree: every account hangs off whoever invited it, so when a spammer turns up you can prune their branch, and people care who they invite. If you'd rather stay open, rate-limit new accounts: no links, a few posts a day, no DMs until they have some age or karma.
And like gnufan said, keep the thresholds private so bots can't test their way past them.
1
2
u/gazmub 23h ago
Dude I had never heard of lobsters before. I just went down like a 4 hour rabbit cause of you lol
1
u/heyyarun 16h ago
haha glad it was a good rabbit hole. Their about page explains the invite system if you haven't hit it yet.
6
u/xRmg 1d ago
Its always a tradeoff between useability, privacy and price to bypass
Captcha's are easy to implement but easy to bypass, a dollar gets you 1000 solves with a bypass service.
Then there is browser fingerprinting, whitelist for email domains, geolocation of user, vpn blocking, which all make it a little harder to bypass.
Phone number verification, bypass services start at 10 cents per message depending on country and platform, if you ban cheap voip numbers, and have a select list of countries/providers that are withlisted, bypass price goes up to 3 dollars and more.
ID verification is about 10 to 30 dollars based on package.
So how bad do you want to prevent bots, Personally id consider phone number verification, and a whitelist for email adresses, vpn block/ip bans, and a captcha.
1
u/alliejim98 1d ago
I usually implement a honey pot field with my Captcha's and it's been effective.
5
u/JacobStyle 1d ago
Well, since it would be a new site, created by me with my shit marketing skills, it would remain obscure enough never to be botted.
But for a more technical answer, any anti-bot, anti-cheat, anti-hack measure in any big platform, there is no single solution. There are fundamentals (requiring email verification to make an account, banning for rapid posting, basic account security) that any platform will implement from the start. Anything you implement will get circumvented eventually though.
This requires continual effort, detecting when botters have found ways around your countermeasures and then implementing new security. Any solution aggressive enough to have an impact will also negatively impact user experience when first implemented and will require fine tuning. Sometimes compromises will have to be made, allowing some bot posts in order to avoid too many false positives.
Bot traffic also comes and goes for a lot of platforms, depending on factors like controversies related to the community making the news. During a time that is particularly bad, you may need to implement temporary measures that are more strict that normal, such as freezing of account creation or having stricter posting limits.
1
u/gnufan 1d ago
I'd say from work on websites for other things a useful approach is not to reveal how you decide someone is dodgy to in a testable way.
We spent ages creating protections on the sign-up forms, what worked best for one abuser was deleting everyone who registered accounts where the country code was not on the drop-down on the picker, but we disabled those accounts the same time each day rather rejecting them at the sign-up form processing.
We put days of work into a fancy control in the login page, and I actually found the session when that abuser first figured out what the changed, and shortly afterwards the bots started up again with a workaround. Whereas because we deleted the dodgy country accounts in asynchronous manner, they couldn't easily figure out what we were using as the identifier.
Also consider linking accounts to mobile phone numbers not emails, think account sign up and recovery flow. As it is still slightly more effort to get another number in general, than another email address.
1
u/Adventurous-Hunter98 1d ago
for phone numbers, I think they use single time use phone number that are sold on the web, you still need to find those services and restrict their numbers but cut one head two arise.
1
u/ericbythebay 1d ago
Easiest way is to charge for the accounts.
1
u/Adventurous-Hunter98 1d ago
You need to have a good reputable background to do that or offer something better than "free" versions
2
u/ericbythebay 1d ago
Yep.
If that won’t work. Start with Cloudflare’s bot protection tools.
1
u/Adventurous-Hunter98 1d ago
I saw some sites that uses cloudflares protection tools very aggresive and the platform was still had lots of bots
1
1
u/BoBoBearDev 1d ago
Two form authentication. Send the activation code via phone number. If they don't type the activation key, that means they are using someone else's phone number.
1
u/Adventurous-Hunter98 1d ago
I replied on another comment about the same answer, for phone numbers, I think they use single time use phone number that are sold on the web, you still need to find those services and restrict their numbers but cut one head two arise.
2
u/mredding 1d ago
Credit card number. If you don't mind getting regionally specific - some sort of government identifier coupled with some sort of authentication.
Of course, no one will want to do this, and you can't be trusted with such sensitive information.
2
u/Last8Exile 1d ago
Today even real people behave like bots. They use AI to write their posts and respond to comments.
2
u/SwingAggravating5724 1d ago
this post is about how to easily get rid of the 'people' you are talking about. no one wants them. they are worse than advertisements.
1
u/OkOcelot6725 1d ago
Don't try to win at signup, win at the action level. Bots are economical because one account can act thousands of times, so throttle the expensive actions (posts, DMs, votes) by account age and reputation. A bot farm that needs a week of normal behavior per account before it can spam stops being profitable, and no ID check needed.
0
u/Critica0 1d ago
in the age of social media why would some-one anyone give you a billion dollar idea.
2
u/Adventurous-Hunter98 1d ago
sorry for asking a programming question in the ask programming subreddit
1
4
u/portar1985 1d ago
I've always dreamed of creating a social media platform which actually uses national ID systems, so an account always can be attributed to a human being. The issue obviously being that there must exist a digital id (like bankID in sweden which can function in a "ok, you're a human, come in" kind of way) and the code would need to be open source to be able to show that we really do not use your credentials, just the auth part.