Hacker News new | ask | show | jobs
by gregw134 618 days ago
What's best practice for preventing bot abuse, for mere mortal developers? Would requiring a non-voip phone number at registration be effective?
3 comments

There is no such thing as a "non-VoIP phone number". All phone numbers are phone numbers. Some people try to ban blocks assigned to small phone providers, but some actual humans use those. Meanwhile major carriers are leasing numbers to anyone who pays from the same blocks they issue to cellular customers. Also, number portability means even blocks don't mean anything anymore.

Large companies sometimes claim to do this "to fight spam" because it's an excuse to collect phone numbers, but that's because most humans only have one or two and it serves as a tracking ID, not because spammers don't have access to a million. Be suspicious of anyone who demands this.

If it’s really important to you then use Apple / Google / GitHub login.

Obviously this has many downsides, especially from a privacy perspective, but it quickly allows you to stop all but the most sophisticated bots from registering.

Personally I just stick my sites behind Cloudflare until they’re big enough to warrant more effort. It prevents most bots without too much burden on users. Also relatively simple to move away from.

Does that really work? I'm trying to build a site with upvotes--wouldn't it be really easy for someone with 100 bought Google accounts to make 100 accounts on my site?
Google is working hard to make it so you shouldn't be able to easily make new accounts. New accounts basically require a phone number and you can only use one phone number so many times before they won't let you use that phone number any more times. Grandfathered accounts don't have this problem yet so this is why Google is trying to crack down on long-unused accounts.
And, annoyingly, being a little too aggressive about it.

Google apparently decided my wife's gmail account was unused. The mail part was other than some forwarding rules (she lives on WeChat, not email.) She's been consistently logged in with YouTube and Translate, though--and now the only way I can get Translate to work is by logging her out.

Unfortunately, every anti-bot feature also harms real people. As a voip user, I wouldn't be able to sign up for your app.