14

In my community, every user should only have one account.

So I need a solution to verify that the specific account is the only one the user owns. For the time being, I use email verification. But I don't really need the users' email adresses. I just try to prevent multiple accounts per person.

But this doesn't work, of course. People create temporary email addresses or they own several addresses, anyway. So they register using different email addresses and so they get more than one account - which is not allowed.

So I need a better solution than the (easy to circumvent) email verification. By the way, I do not want to use OpenID, Facebook Connect etc.

The requirements:

  • verification method must be accessible for all users
  • there should be no costs for the user (at least 1$)
  • the verification has to be safe (safer than the email approach)
  • the user should not be demanded to expose too much private details
  • ...

Do you have ideas for good approaches? Thank you very much in advance!

Additional information:

My community is a browser game, namely a soccer manager game. The thing which makes multiple accounts attractive is that users can trade their players. So if you have two accounts, you can buy weak players for excessive prices which no "real" buyer would pay. So your "first account" gets huge amounts of money while the "second account" becomes poor. But you don't have to care: Just create another account to make the first one richer.

caw
  • 30,999
  • 61
  • 181
  • 291
  • 2
    What language do you want to do this in? Also, it's not entirely possible, as users can always find at least one way around; let it be via a dynamic IP, proxy, different email addresses, separate persona... – cbroughton May 11 '11 at 13:11
  • Thank you for this comment :) The language I would choose is PHP. I know that this is not entirely possible, but what I want is the best solution within one's means, of course. So I'm looking for an approach which makes all this more difficult, not impossible. – caw May 12 '11 at 16:09

13 Answers13

10

You should ask for something more unique than an email. But there is no way to be absolutly sure a player don't own two account.

The IP solution is not a solution, as people playing from a compagny/school/3G will have the same IP. Also, Changing IP is easy (reset the router, proxy, use your 3G vs wifi)

Some web site (job-offer, ...) ask you for an official ID number (ID, passport, social security, driver licence, visa (without the security number, so peolple will feel safe that you won't charge them), ...)

This solution got a few draw back:

  • minor don't always have an ID / visa
  • pepole don't like to give away this kind of info. (in fact, depending where you live: in spain for example, it is very common to ask for ID number)
  • people own more than one visa.
  • it is possible to generate valide ID/visa number.

Alternative way:

ask for a fee of 1$

  • to be allow to trade more than X players / spend more than X money.
  • people that pay the fee got some advantage : less ads, extra players, ...
  • paying a fee, will limitate creation of multiple account.
  • fee can be payed using taxed phone number (some compagny provide international system)
  • the payment medium could be use as an ID (visa number)

put some restriction in new account (like SO).

  • eg: "you have to play at least 1 hour before trading a player"
  • eg: "you have to play at least 3 hour before trading more than 3 players"

Use logic to detect multiple account

  • use cookie to detect multiple account
  • check last connection time of both player before a transaction. (if player A logout 1 minute before player B login : somethings is going on)

My recommandation :

Use a mix of all thoses methode, but keep the user experience fluide without "form to fill now to continue"

Loda
  • 1,970
  • 2
  • 20
  • 40
  • Thank you very much, Loda :) Your answer was really, really good. This why you've got 8 upvotes (currently) - including my vote :) Unfortunately, the answer I selected helps me even more. But I think these upvotes show that we all appreciate your answer. Unfortunatley, I can only choose one ... – caw May 24 '11 at 21:19
  • No problem. I'm glad it helped you out. PS: If you decide to implement a fee system, it's important that it is optional. – Loda May 25 '11 at 09:04
7

Very interesting question! The basic problem here is multi-part -

  1. Opening an account is trivial (because creating new email IDs is trivial).
  2. But the effect of opening an account in the game is NOT trivial. Opening a new account basically gives you a certain sum of money with which to buy players.
  3. Transferring money to another account is trivial (by trading players).

Combining 1 & 2, you have the problem that new players have an unfair advantage (which they would not have in the real world). This is probably okay, as it drives new users to your site.

However adding 3 to the mix, you have the problem that new players are easily able to transfer their advantage to the old players. This allows old users to game the system, ruining fun for others.

The solution can be removing either 1,2,3.

  1. Remove 1 - This is the part you are focusing on. As others have suggested, this is impossible to do with 100% accuracy. But there are ways that will be good enough, depending on how stringent your criterion for "good enough" is. I think the best compromise is to ask the user for their mobile phone numbers. It's effective and allows you to contact your users in one more way. Another way would be to make your service "invite only" - assuring that there is a well defined "trail" of invites that can uniquely identify users.

  2. Remove 2 - No one has suggested this which is a bit surprising. Don't give new users a bunch of money just for signing up! Make them work for it, similar to raising seed capital in the real world. Does your soccer simulation have social aspects? How about only giving the users money once their "friend" count goes above a certain number (increasing the number of potential investors who will give them money)?

  3. Remove 3 - Someone else has already posted the best solution for this. Adopt an SO like strategy where a new user has to play for 3 hours before they are allowed to transfer players. Or maybe add a "training" stage to your game which forces a new player to prove their worth by making enough money in a simulated environment before they are allowed to play with the real users.

Or any combination of the above! Combined with heuristics like matching IP addresses and looking for suspicious transactions, it is possible to make cheating on the game completely unviable.

Of course a final thing you need to keep in mind is that it is just a game. If someone goes to a lot of trouble just to gain a little bit of advantage in your simulation, they probably deserve to keep it. As long as everyone is having fun!

Anupam Jain
  • 7,851
  • 2
  • 39
  • 74
  • Thank you very much, I really like your detailed reply :) It perfectly fits my needs! – caw May 24 '11 at 20:24
2

I know this is probably nothing you have expected, but...

My suggestion would be to discourage people from creating another account by offering some bonus values if they use the same account for a longer period, a kind of loyalty program. For some reason using a new account gives some advantages. Let's eliminate them. There are a lot of smart people here, so if you share more details on the advantages someone could come up with some idea. I am fully convinced this is on-topic on SO though.

Grzegorz Oledzki
  • 23,614
  • 16
  • 68
  • 106
  • They can "use the same account for a longer period" and register a second account, nevertheless. So the "second account" is to improve the first account's ranking position. I've added some details about the advantages of new accounts. Maybe someone (you?) can help me :) Thanks for so far! – caw May 23 '11 at 21:31
  • 2
    Spot on. There is absolutely no sure way to enforce this. Even if you force them to submit their social security number/scans of their ID, they still can fool you. Rather than focusing on that, perhaps you could use some sort of fraud detection, IIRC in SO if an account is used to upvote the same user over and over again, the fishy votes are detected using an algorithm and revoked the next day. – rickchristie May 24 '11 at 04:19
  • Thanks for this tip. Discouraging people from creating another account is probably the thing to do. But the hard thing is to eliminate those advantages. – caw May 24 '11 at 20:08
2

We have implemented this by hiding the registration form. Our customers only see the login form where we use their mobile number as username and send the password by text message.

The backend systems match the mobile number to our master customer database which enforces that the mobile number is unique.

Frode Stenstrøm
  • 1,048
  • 7
  • 24
  • 1
    movile number sound reasonable, Google App Engine does that too, however that is a very private detail not everybody wants to give away. – Tim Büthe May 24 '11 at 09:34
  • You are right, that is why we are in the midst of setting opp a security federation service like Ping Federation Service and Microsoft ACS. – Frode Stenstrøm May 24 '11 at 14:12
  • I'm not sure if I got it right: You have no registration form but only a login form, right? The data from the login form are checked against the master database. If the entry (mobile number) is already there, the user is just logged in. Otherwise he/she is first registered automatically. Correct? – caw May 24 '11 at 20:04
  • Correct. We have also linked our application to all the national telecom providers, so that for all new users, the registration form is prepolulated with the information that the customer has provided to his/her telecom operator. – Frode Stenstrøm May 25 '11 at 11:56
2

Here is an idea:

  • Store UUID in a cookie at clients. Each user login store the UUID from Cookie in relation to the account entity in the databse.
  • Do the same with the IP adresses instead of UUID.

After that write a program interface for your game masters that:

  • Show up different account names but same IP (within last x hours)
  • Show up different account names but same UUID (nevertheless how long ago)
  • Highlight datasets from the two point above where actions (like player transfers) happened which can be abused by using multiple accounts

I do not think you should solve that problem by preventing people having two or more accounts. This is not possible and ineffective. Make it easier to find that evil activities and (automatically temporarly) ban these people.

Fabian Barney
  • 14,219
  • 5
  • 40
  • 60
  • This manual approach is probably very time-consuming and not that efficient, is it? It doesn't solve the problem. – caw May 24 '11 at 20:17
  • Well, I am with you that this does not exactly solve the problem in the way you want to address it. But that's the way modern multiplayer games work (so far as I know): Give Gamemasters good tools and manually review what these tools give you. Having clear indicators then do an automatically temp-ban or automatically temporarly disabling the abused functions until it got reviewed by a gamemaster. – Fabian Barney May 25 '11 at 07:47
  • I think it is effective, because banning people abusing game's functions is exemplary. In most cases they and others won't do it again when they know that they're losing their accounts. – Fabian Barney May 25 '11 at 07:56
1

It's impossible to accomplish this with a program.

The closest you can do is to check the ip address. But it can change, and proxies exist.

Then you could get the computer MAC address, but a network card can be changed. And a computer too.

Then, there is one way to do this, but you need to see the people face to face. Hand them a piece of paper with a unique code. They can only subscribe if they have the code.

Joel
  • 3,427
  • 5
  • 38
  • 60
  • Of course, I want to achieve the best result within the bounds of possibility, not more. That a program cannot solve this problem 100% correct should be obvious to everyone. – caw May 11 '11 at 13:11
1

The most effective solution might be the use of keystroke biometrics. A person can be identified by the way the person writes a sentence.

This company provides a product which can be used to implement your requirements: http://www.psylock.com/en

ceving
  • 21,900
  • 13
  • 104
  • 178
  • But the case we discuss here is the inversion of what Psylock does. Using keystroke biometrics, you can assure that the accessing user is "the one". But our case is that you want to assure that the accessing-user is NOT "the one" who is in the database. So this technique won't work properly, will it? – caw May 23 '11 at 21:28
  • Right. This method is about proving who you are, not proving who you are not. Very intriguing, nonetheless. – njbair May 24 '11 at 03:40
  • @Marco: it will work. If you know who it is, you also know who it is not. – ceving May 24 '11 at 09:13
  • No, this is not right! Typing as if you were somebody else is easier than imitating a person's special keystroke metrics: You can type in a random rhythm so that you seem to be a "new" user. But you cannot fake the typing rhythm of a given user. – caw May 24 '11 at 20:06
1

I think 1 account per email address should be good enough for your needs. After all, account verification doesn't have to end right after signup.

You can publish the IP address of the computer each message was posted from to help your users detect when someone is using multiple accounts from the same computer, and you can use a ranking system to discourage people from using temporary accounts.

Dan Berindei
  • 7,054
  • 3
  • 41
  • 48
  • Yes, this is a really good approach - in general. But how do you want to discourage users from using "seconary accounts" if these "secondary accounts" help the "first account" to climb the ranking ladder? – caw May 23 '11 at 21:29
  • 1
    Just make sure that posting as a single user is more productive than posting as multiple users ;-) You could try to make the reputation boost from another account a function of the other account's reputation, so in order to get a good boost from the secondary accounts the user would have to work on those secondary accounts just as much as on the primary. – Dan Berindei May 24 '11 at 08:26
  • Thank you, making a single account more productive than multiple accounts is probably the thing I will try :) But discouraging people from using multiple accounts is not that easys ... – caw May 24 '11 at 20:12
1

Do your game dynamics allow for you to require that both users be online for a trade to occur? If so, you can verify the IP addresses of both users involved in a trade, which would be the same unless the user was paying for multiple internet connections and accessing two accounts from separate machines.

njbair
  • 1,982
  • 16
  • 14
  • Thanks for this reply, njbair. As some users have already pointed out, the IP address is not a solid evidence. One can use proxies, reset the router, use mobile internet (3G etc) and so on. – caw May 24 '11 at 20:10
1

Address the exact scenario that you're saying is a problem.

Keep track of the expected/fair trade value of players and prevent blatantly lope-sided trades, esp. for new accounts. Assume the vast majority of users in your system are non-cheaters.

You can also do things like trickle in funds/points for non-trading actions/automatically overtime, etc.

peakxu
  • 6,667
  • 1
  • 28
  • 27
  • But if users can't trade things for (much) more than the expected value, the game becomes boring, doesn't it? – caw May 24 '11 at 20:19
  • A cap of 50% to 200% of expected value etc. may nevertheless be reasonable. You can also do this over time. Newer accounts may not do very lope-sided trades. Older accounts can. This may even be helpful in preventing newbies from being eaten alive by veterans. – peakxu May 24 '11 at 20:23
0

actually you can use fingerprintjs to track every user, use js encrypt the fingerprint in browser and decrypt in server

shinebay
  • 1
0

Have them enter their phone number and send a text message to it. Then, keep a unique of all the cell phone numbers. Most people have one cell phone, and aren't going to ask their friend to borrow it just to create a second account.

http://en.wikipedia.org/wiki/List_of_SMS_gateways

Thomas Hunter II
  • 5,081
  • 7
  • 35
  • 54
  • This would probably work, but lots of users don't want to "publish" or reveal their mobile numbers. – caw May 24 '11 at 20:23
  • Reassuring them that the number will never be recorded or published may alleviate that (you could sha1 their number so that you're not keeping a copy of it and still prevent duplicates). – Thomas Hunter II May 24 '11 at 20:31
0

I would suggest an approach using two initiatives:

1) Don't allow brand new accounts to perform trades. Accounts must go through a waiting period and prove that the account is legitimate by performing some non-trade actions.

2) Publicize the fact that cheaters will be disqualified and punished. Periodically perform searches for accounts being used to dump bad players and investigate. Ban/disqualify cheaters and publicize the bans so that people know the rules are being enforced.

No method would be foolproof but the threat of punishment should minimize cheating.

Matt__C
  • 319
  • 2
  • 10
  • Thank you, I especially like the first approach :) The waiting period for new users is useful. It is even better if these new users don't just have to "wait" until the time is over but have to perform actions to get the "trading right". Very good! – caw May 24 '11 at 20:21