Using third party login options to prevent re-registrations

Question

Several answers on my previous question indicated that there should be ways to get around a permanent ban. While this wasn't my intention, it did raise a couple questions in my mind.

A couple comments for reference from that question:

Unless the developers/administrators of the site go to a lot of effort it is possible to get round any ban by creating new accounts, using proxies etc. - ChrisF

A permanent ban on an account is a penalty issued against an account that takes time and effort to build up. Banning against such an account can be a disciplinary measure to take away the result of that effort for a serious offense or series of offenses. - AJ Henderson

I thought there was another one too, but it seems to have been removed. That one focused creating a new account and telling others who I am.

Stack Overflow is one of many sites that lets me sign in through Google or Facebook. My assumption is that utilizing this external resource to manage my identity makes it harder to get around bans. There must be a couple restricts though, such as not having a method to register via email address alone.

Is there any data that shows this assumption is true (or false)?

Answer 1

The ultimate advantage in allowing a user to register using their social network credentials is that it saves them time. The user doesn't want to go through that mundane process of filling out yet another email address field or generating a new password, and so being able to avoid that through the click of just a few buttons arguably converts a user into a registered member. There is no circumvention prevention using these external logins, you can create an account on Facebook in seconds.

In light of what ChrisF said, it's common for websites to collect a whole host of information surrounding individuals including their IP address and the user agent. Whilst these are by no means unique identifiers, they, combined with other data (the user's date of birth, email address, and even their registration date), allow a site administrator to build a repository of information that can feed into a case where an individual has been questioned as evading a ban. In addition to this I've seen some websites place "tracking cookies" that act as intermediaries between accounts. If that tracking cookie exists on my system when I login under a different account, and that system detects this duplicate cookie reference, then it becomes very obvious very quickly there is a link between the two accounts.

It is frankly impossible to prevent permanently banned users from returning (unless you somehow link real-world identification - e.g. a passport - into your site's registration process).

--

(It's a little off-topic but may be of interest to you: https://econsultancy.com/blog/61911-the-pros-and-cons-of-a-facebook-login-on-ecommerce-sites#i.1cnq63zkuldc3q)

Answer 2

Using a third party to manage your user's identities only makes it slightly more inconvenient for users to create duplicate accounts, it doesn't stop them.

If allow sign up via Facebook, Twitter and Google+ say, then a person could create three accounts on your system one each with each of the external sources. To create more they'd have to create duplicate Facebook, Twitter or Google+ accounts - which, while potentially inconvenient is perfectly possible.

I don't know how easy this would be, but if the user has linked their Facebook and Twitter accounts (say) and you can discover this, then you could prevent a second account being created. You could add the second external id as an alternate to their existing account (as Stack Exchange does). This doesn't prevent them signing in with an unlinked account.

Tracking the IPs people use is probably desirable, but shouldn't be used as the sole criteria to detect duplicate accounts. The user could be logging in from a workplace, college or internet café where lots of other people log in. Even if they're logging in from home other members of their family could have accounts on your site too.