Methods of suspending users?

Question

Most online community software supports banning a user by username, login address or IP. These are all relatively trivial to evade.

Other methods include the hellban, shadowban, and slowing down page loads. As someone who hasn't implemented any of these three method, it seems trivial to avoid these as well once you realize what happened.

How do you implement a policy of denying access to certain users in a manner that doesn't eat up moderation time and is still technically feasible for small communities?

Answer 1

A long-standing rule of thumb is that a user who wants to avoid a ban will find a way to avoid the ban. At the end of the day, getting rid of ban evaders is a battle you cannot win.

You can only make it harder for them to notice, and evade the ban. The various forms of silent bans (hellban being the prime example) are already very hard to notice - assuming you don't tell the user what's going on. There isn't much more you can do about this - after all, if their actions aren't coming through, they will notice that one way or another.

Now, making it harder to evade the ban is also fairly complicated. A solution I found rather useful a while back is storing the previous IP of a banned user on the client side (say, with a cookie, or in localStorage). Of course the user can actively wipe that - but it gives you something to weed out lazy or technically inexperienced users (those who just reboot their router) by comparing to that previous IP, rather than the current one (after they changed it).

You could also try to identify the user through less obvious means. Browser identification is possible in a lot of ways - many are very subtle, very unique and ultimately also hard to change for the user. The more sophisticated the method, however, the less technically feasible it becomes.

Personally, I don't have much of a problem with ban evaders. If they come back and instantly cause trouble again, you can just ban them again. If they start to behave, you have just (at least temporarily) rehabilitated a user. Either way, it generally isn't worth the trouble just to get rid of that one-in-a-hundred banned users that has the energy to keep coming back over and over again.

Answer 2

Depending on the community size, it may be rather trivial to notice that you've been hellbanned/shadowbanned.

If you have to implement one of the ban types you mentioned, slowbans are probably your best bet as they are the hardest to detect... even Internet routing issues could cause the behavior they're seeing.

In fact, it might not be a bad idea to only make the slowdown appear to happen sometimes, as if it were a problem with the site itself or Internet routing (although a traceroute could prove the latter wrong).

It might even be worth throwing the occasionally 503 Service Unavailable error or 500 Internal Server Error at the user... both are legitimate HTTP errors caused when the server is having issues serving requests.

Other considerations

The software your community uses may have the ability to block known open proxies. If it does, I highly suggest using it as open proxies are a common method of ban evasion.

Unfortunately, the increasing size of Internet Service Providers in certain countries (such as Comcast in the United States) makes it easy for people to just reset their cable/DSL/fiber router and get a new IP address. This presents a second related problem: While you can likely ban IPs by ranges, the larger the ISP the more likely you are to catch innocent users in these ban blocks.

There isn't a lot that you can do about this unless you implement one of the solutions FEichinger mentioned in his answer. However, keep in mind that a determined troublemaker can switch browsers fairly easily to defeat a lot of those measures as browsers limit the amount of OS information they give to you. You may be able to gather more specific information about users using things like Flash or Java, but more paranoid users may wonder why these plugins are loading when they are seemingly unused.

Answer 3

A lot of the answers here seem to focus on hellbans/shadowbans but don't make very good mention of the other types of bans.

In most cases, username bans are going to be the most effective against your target. While people can get around bans by creating a new account or changing their IP, determined users will get around these bans. Unless there is a hoop that all users must clear before getting privileges, anyone will be able to perform any action that normally is available to any registered user.

Fortunately, most users will wait out their suspension or ban. Determined users that you absolutely do not want might be deterred by IP bans, but most of these users already have some technical knowledge that allows them to bypass these bans.

While moderating communities and forums, I've found that IP bans are ineffective and usually can block the wrong people.

Other than IP banning, there is also the forms of hell/shadowbans, employed in some software such as reddit (along with a suspension and ban system). Making them think that their stuff is working but inevitably just removing all of it can deter users from creating new accounts.

I've found it works well with spammers.

Although for small communities, it is often just faster to just keep banning, as the users who are going to ban evading already are usually the ones determined to do so.