How would you establish user credibility for your web app?

Question

One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many different users with many different open ID accounts.

Notice that this question is beyond authentication - I'm assuming that the user behind the fake user accounts takes the time to authenticate by email, and uses a legitimate username and password.

In StackExchange apps this is done by giving a minimum of 15 rep before the user can do anything significant on the site. Not all webapps have this luxury, as some apps are built for short-lived user accounts, such as e-commerce apps or certain forums, which usually do not build a long term relationship with users.

Is there a systematic way to establish user credibility?

Answer 1

I don't think that there's any systematic way - after all if there were the spammers would be working on ways to defeat it as it would unlock everybody's site for them.

You need to have something on your site that only genuine users would want to do. You've mentioned the Stack Exchange model of reputation, another is to encourage people to spend real money.

For example, Steam have just started requiring that you actually buy a game before unlocking features. A while ago I signed up to Steam to get their offer of Portal for free and added a couple of people as friends. I've just tried to add someone else and that failed because I don't have any paid for content in my profile.

Now while this won't work for everyone - after all you might not have paid for content! - but it's certainly an option. The one thing that spammers won't want to part with is money.

Another option would be to have the user contribute some content. Say you were running a art site or writing site users could only gain access to the full site once they'd submitted a piece of art or writing. You'd probably have to have a real human look at it to ensure it wasn't just a random jpg or a chunk of "ipsum lorem" text!

So the answer is that it depends on what your site is

Answer 2

There is a systematic way to establish with a high degree of certainty that the user is indeed a human being. After that, you can only go by what that user does.

Depending on the nature of your web app, "bad" users will probably be those who:

• Try to dump links for SEO and run
• Create sock puppets to promote (or demote) another user

API's like Akismet let you catch a significant amount of SPAM before it even shows. Beyond that, you should have a means for "good" users to flag the post / auction / whatever as being inappropriate.

Sock puppets are really nothing new, and are discovered by analyzing usage patterns. Rooting them out on a site like Wikipedia is a bit different than rooting them out on a site like SO, where someone's 'normal' use is quite deterministic. That means misuse, (abusing the up / down vote buttons) is easier to catch. Its hard to give specific recommendations without more information on what 'good' behavior would be on your site.

What I would do is offer some kind of reward for the behavior that you want. If you want people to post items for sale, give them a star or something next to their name after they've done that for a few times. Reward the 'star' with something else, like reduced fees, reduced advertising, whatever. Make it worth while for "good" users to give you something in order to get something.

If your site really is that 'disposable' in the eyes of your visitors, you'll get a lot of drive by users. Perhaps, think of a way to make people want to participate over the span of at least a few days, this will give you (in most cases) the time that you need to root out the bad elements and reward the behavior that you want.

Stack Overflow itself is 'disposable' to some of its users, there are many who never actually register, ask a single question, get their answer and vanish as soon as their cookie does. But, the quality of what they do while there determines their credibility, and how likely they are to get what they want.

Answer 3

The answers from the question Is there any way to really ban people from a website? could help give you a few ideas.