How can I prevent users from creating multiple accounts on a web site?

Question

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only solutions I have thought of are allowing users to:

• Link to their (verified) PayPal account through PayPal Account Authentication
• Provide their PGP public key, and checking that the MSD (a metric of trustworthiness) is below a certain value

Of course, even these methods aren't bulletproof, but are likely to make creating a sock-puppet account very difficult. Are there any others I haven't considered?

Answer 1

You can't Prevent it, you have to provide incentives against it.

You problem is that your system has a built in incentive to create multiple accounts. Remove that incentive or give a better one for sticking with one account.

Answer 2

I'd be very wary about requiring users to use their PayPal account. This would imply that you were going to be taking money from users at some point. This would put even more off.

The best solution is probably the simplest. Do what Stack Exchange does. Allow the user to sign up with OpenID (or even just e-mail and password) and then track the IP addresses the user logs in from and who the user gives reputation to and who they get it from. There are probably other things you can track such as the time of day they usually log in etc.

Then have tools for your site moderators (you'll need moderators) to show users that share IP addresses and have interacted with each other a little too much (for example). Depending on what you track you can show different data.

Obviously one drawback with the IP address is that it's not unique. People at the same workplace will share one as will people using the site from internet cafes or libraries.

Now on Stack Exchange where the post is more important that the person colleagues shouldn't be voting for each other more than they would for any random person on the site. However, if on your site the person is more important then the reverse could well be true.

What ever system you implement people will try to circumvent it, so this will be an ongoing process of changing sign-in rules etc.

Answer 3

One way a lot of websites use is adding a SMS verification code to their signup process. It delegates the uniqueness problem to some mobile phones company.

It's still not bullet proof, it will diminish your user signup numbers a lot. But rare are those who have access to multiple mobile phone numbers. It may cost you some money if you're operating in an area where SMS have to be paid by the sender.

But couple this with some IP and behavior tracking and -as mentioned by other people- incentives to having only one account and you should be set.

Answer 4

User reputation (assuming you have some upvote-feature like the Stack Exchange sites) will never be a truly accurate score. Even if you really make sure that no natural person can create two accounts by whatever means (I doubt that this will be possible), you still have these problems:

• People can upvote their friends more often than other people (or gang together to downvote someone else).
• If high reputation is really valuable for some people and sockpuppeting is a way to get it, people will sell (or lease) verified accounts for sockpuppeting.

So, don't rely on such a feature.

Answer 5

Give users a range of options to verify? Combine a good "user policy" ("We won't share your information with third parties", etc) with a good behind-the-scenes "points" scheme give points for stuff like:
- Verified phone number (SMS them a code that they enter)
- Facebook
- OpenID
- Paypal
- etc

Give each option a point value (Paypal is worth more than a GMail account, for example)... and let them choose how to get enough points to become "verified". Make this information available to the "owner" of the account.

If the account changes hands, the new owner now has that personal information... if the information changes (new email address) you can increase/decrease the "verified score", make the re-verify phone numbers or whatever. Fishy activity on an account can increase the needed "verified" score.

I'd do something like this, combined with the aforementioned IP/usage tracking to try and identify bad behavior and "gamificaton" to reward good behavior.

Answer 6

In South Korea and the PRC they do this by requiring users register with their personal ID number (Social Security # for U.S. folks). But in these societies that number is a lot less "secret" than it is in America.

While not legally/politically/socially acceptable in every country, this is the only really good method for limiting registrations that I've ever seen.

Not really a solution for you, probably, but of interest nonetheless.