Additional Captcha when using Facebook/Google Registration

[_Vault_]

I'm getting quite a lot of Bots registering on my site using Google & Facebook Sign in. There is currently no way to stop this from happening.  Some of the bots get stuck and register with "No Name" because I have configured "Display name to use when creating an account" to "Ask the user to provide a display name" - but some bots, even provide a name here.

It would be good to have some kind of (invisible) captcha at some point, to eliminate bots!

Thanks.

[bfarber]

I haven't reviewed the third party requirements recently, but there used to be prohibitions on interstitial pages for such things.

[_Vault_]

That is very unfortunate. Already thinking about turning this feature off, because every 2nd account coming over a 3rd party login provider is fake.

[bfarber]

Let me ask you this - do you think that a "fake" account is capable of supplying a username, but not passing a CAPTCHA challenge? Something tells me those accounts are likely being created by real people, even if the details are later turned over to a bot to abuse.

As a general rule, when you allow people to sign in using other social login services, you are putting your trust in those services to properly vet and validate the account signups on their end. A better long term solution might be require moderation of new submissions for all new users until they have 2 or 3 approved content submissions. This would help you weed out fake or spam users without allowing their content to be visible to the community at large, while not placing a heavy burden on the signup/login process.

[All Astronauts]

1 hour ago, bfarber said:

Something tells me those accounts are likely being created by real people, even if the details are later turned over to a bot to abuse.

This. There are farms in India, China, etc. Literally. People whos job is to just make accounts and then turn those over to whatever bot needs to do whatever. Have dealt with mitigating this on a contract basis. The plus side? The accounts are often/usually created in those countries with IP addresses from those countries. It gets much worse when the IP addresses these farms use jump country to country. 

[Jordan Miller]

This is happening to me too 😩 

Tons of new "members" from India just posting spam. They're using FB and Google to login. Not sure what to do. 

[Afrodude]

18 minutes ago, breatheheavy said:

This is happening to me too 😩 

Tons of new "members" from India just posting spam. They're using FB and Google to login. Not sure what to do. 

I have a solution for you. 

Go to New Members group sittings, and from Content go down to Moderation. Next enable option "Require approval before content shows?", and then use "Remove content moderation" put the number you are seeing fits to make sure this member he doesn't post any spamming topics or replies. I myself use it for only the first post I put just "1", and like this if the new member is a spammer, you can flag him as spammer or ban him. 

[Jordan Miller]

8 minutes ago, Afrodude said:

I have a solution for you. 

Go to New Members group sittings, and from Content go down to Moderation. Next enable option "Require approval before content shows?", and then use "Remove content moderation" put the number you are seeing fits to make sure this member he doesn't post any spamming topics or replies. I myself use it for only the first post I put just "1", and like this if the new member is a spammer, you can flag him as spammer or ban him. 

Ahh thank you. That's smart. I just enabled this. It doesn't entirely solve the problem, but is a great start. 

I also blocked India from having access to my website for now. 

[Afrodude]

2 minutes ago, breatheheavy said:

Ahh thank you. That's smart. I just enabled this. It doesn't entirely solve the problem, but is a great start. 

I also blocked India from having access to my website for now. 

No problem mate.