1

Disclaimer : temporary mails providers are out of the scope of this question.

Let's say I have a simple web app example.com. And I really want my users to be unique (at least for my database IDs).

So when an user register, the following process is done :

  • a line is inserted in database for this user (the user can't login because he did not verify his mail)
  • a mail is sent to the user with a link allowing him to validate his account (the link is only available for a couple of hours)
  • when the user click the link (assuming it is still valid) he can now login and perform actions

So far so good, however an user with [email protected] could create a lots of account (8192 according to https://thebot.net/api/gmail/)

I am aware that I could check for a gmail address and then removes dot(s), so this would not work. It clearly seems to be the easier road to prevent abusive users to abuse my system.

On the other hand, there might be a lot of other mail provider using the same strategy, and filtering by providers seems kind of clumsy...

What would be the best practice for this usecase without messing user registration and keep users unique ?

Am I just taking the wrong path for this kind of validation ?

Edit: an example of this kind of abuse would be a website with torrents files where you have to maintain a ratio of 1.

When you create an account, you have a ratio of 15 (as if you seeded 15 GB and downloaded 1GB) if an user can create multiple account with the same email it seems to me that this an issue for the site.

(I recently came across a website like this which allow multiple account with same mail) and I was just wondering how you guys would deal with this hence the question.

On the other hand, Facebook where users doesn't really have any advantages to have multiple accounts does not allow multiple accounts with same email.

I don't personally have any website that would really benefit from preventing this trick but I am curious.

4
  • What’s the abuse to your system? What about users that legitimately wish to use this feature of gmail to create a unique address for their login to your system?
    – sasfrog
    Commented Jun 3, 2019 at 21:14
  • Ideally an user would create only one account like [email protected] however he can also create [email protected] and both mail will be sent to the same address, that's the kind of abuse I want to avoid... I don't realy care as long they don't abuse this trick, like [email protected], [email protected] etc do you see my point or should I update my question ?
    – L. Faros
    Commented Jun 3, 2019 at 21:29
  • But what’s the actual abuse? Do they get more somethings if they have more accounts? Is it actually a problem beyond being undesirable, if someone does this in your system?
    – sasfrog
    Commented Jun 4, 2019 at 6:58
  • @sasfrog anwered this in the body of the question (the edit part)
    – L. Faros
    Commented Jun 4, 2019 at 18:20

1 Answer 1

2

You will not be able to uniquely identify if two arbitrary addresses belong to the same user.

The interpretation of the "local" part of an e-mail address (the bit before the "@" sign) is left to each mail server so while you can know the special treatment that Gmail does of dots you can not come up with a general approach for any e-mail address. Even without leaving Gmail for instance you have the "+" trick for different e-mails, let alone the semantics that every other mail server out there may be using. You may try to adapt as you detect abuse, however it will quickly become a resource-expensive game of cat and mouse.

Depending on the cost of the abuse you may decide to do nothing and live with it, implement some basic rules for the main providers or (if protecting abuse is valuable enough) request from the user something that is finite, unique to each individual and that has a high acquisition cost. For instance you could do document verification (driver's license, passport, id card, etc.) or use their mobile to do some SMS verification (obtaining mobile numbers is more expensive than e-mail addresses).

2
  • Very interesting answer (I did not know about the + trick btw). Do you know what are the benefits for facebook to prevent the use of these tricks ?
    – L. Faros
    Commented Jun 4, 2019 at 18:44
  • 1
    I can only speculate on the motivations for Facebook, but as they are adamant on only having real identifiable people on their platform to improve their advertising impact I guess these checks reduce the likelihood of someone creating a 'fake' account.
    – llmora
    Commented Jun 5, 2019 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.