Stop making it so easy for suspended users to create puppet accounts


(Mittineague) #1

I don’t know if many sites have a problem with multiple accounts.
Nor do I know if this would be desirable to do or an easy fix

It seems to me having “create new account” on a suspended users login modal is kind of “asking for it”


#2

Oh, we have the problem a lot. I’d say about 1/3 people we suspend decide to make another account. I just delete that account and lengthen the user’s ban.


(Mittineague) #3

I doubt if removing it from the modal will stop many. But on the other hand, why give them a hint if they didn’t think of doing it themselves.


#4

How would it be removed? It wouldn’t know the user has been suspended until he tried to sign in.


(Sam Saffron) #5

Instead of that error redirect to google :japanese_ogre:


(Joshua Rosenfeld) #6

All jokes aside, could the error be in a desperate dialog as opposed to being displayed above the credential input boxes? Close the Log In dialog, pop up another dialog that displays the message regarding account suspension.


(Mittineague) #7

Yes, I hadn’t thought of that.
“create new account” would be there - as it should in case login was clicked by mistake.
Then after the failed attempt it could be gone.

I like that idea much better.


(Felix Freiberger) #8

We could even ban an IP from creating accounts for a day or two once a suspended account tried to log in from it… :troll:


(Stephen) #9

About ten years ago we would stuff a cookie into the browser of any suspended user when they tried to log in. If they attempted to use another account, or registered a new one, those account would be flagged as a ‘miserable user’ and be subjected to fake server errors and slow page loading times.

As soon as the ban on the primary account was lifted all of their accounts would suddenly start behaving again. :smiley:


(Joshua Rosenfeld) #10

This I don’t like…think about places where users might share a public IP address, like large companies, schools, government, etc. I don’t want to have a situation where User A is suspended, attempts to log in, and then new User B who goes to school with User A cannot create an account. That could be disastrous for a community!


(Felix Freiberger) #11

This rule could have the same exceptions as max new accounts per registration ip (which boil down to “if there are multiple good users from a single address, it won’t be affected”).


(Dean Taylor) #12

There is one “community” that comes to mind when thinking of “bans”. The community has probably “banned” more users than any other, bans are effectively equivalent suspensions in Discourse.

I’m not saying these should be copied, just that the messaging here in these screenshots is perhaps more clear regarding actions when compared to Discourse currently.

Taken from b& of the what looks like two types of messages:
Short Ban:

Long Ban:

Note the longer ban includes a way of contacting for an appeal, but also includes additional information to identify why a ban might affect you.


(Stephen) #13

Just for fun, I dug out the full list of behaviours for miserable users:

  1. Slow response (time delay) on every page (20 to 60 seconds default).
  2. A chance they will get the “server busy” message (50% by default).
  3. A chance that no search facilities will be available (75% by default).
  4. A chance they will get redirected to another preset page (25% & homepage by default).
  5. A chance they will simply get a blank page (25% by default).
  6. Post flood limit increased by a defined factor (10 times by default).
  7. If they get past all this okay, then they will be served up their proper page.

(Joshua Rosenfeld) #14

I’ll be honest here: I don’t like this. Users should be suspended for a reason - typically, that reason is due to violation of the sites rules and guidelines, repeatedly, after warnings are given by staff. If a suspension is warranted, I want it to be clear as day to the user that they are suspended, and why. By making a site do strange things that appear to be server issues, there is nothing telling the user “Hey, you broke the rules and lost privileges here for a while. This is what you did wrong, don’t do it again!”. Instead, it almost encourages the user to start complaining about issues, potentially causing more issues instead of letting them “cool down”, understand why they were suspended, and try and correct the issue when they return to the site.


(Sam Saffron) #15

This is my favorite type of message here, after trying to log in, display a canned message and present the IP address on the page.

… but …

Users that are banned really don’t care about any of this stuff, if they REALLLY need to log in they will find a way, also I feel a lot less compelled to invest time here for something that is not a huge problem.

Simplest thing I support doing now is hiding “Log In” and “Create New Account” if the error “Account suspended” comes up.


(Stephen) #16

You wouldn’t feel that way had you read my original post earlier in the thread. The point was that this behaviour was applied to any suspended user who attempted to circumvent a ban by creating a new account.

Hence:

It had more impact back when smartphones and mobile data wasn’t the norm. Most everyone has a second device, and address, that they can use.


(Joshua Rosenfeld) #17

I did read your previous post, however I misinterpreted it. I thought that a banned user would get the cookie and be allowed to log in to their main account, in addtion to any encountering issues with any new accounts they attempted to create.


(Jeff Atwood) #18

Great idea, if this is relatively easy @neil can you add it to your list?


(Neil Lalonde) #19

Done! If the person logging in is suspended, the login modal is closed and a new modal is shown with the “Account suspended until…” message.


(Jeff Atwood) #20

I agree this is a nice change, no reason to encourage suspended users by dangling the new account dialog in front of them. Great idea @Mittineague.