CAPTCHAs and sign‑up quizzes annoy real people and barely slow down determined bots. As the fediverse grows, we need smarter, more humane defences, ones that don’t push away genuine newcomers. What creative, non‑intrusive ideas do you have? Trust‑based vouching, proof‑of‑humanity protocols, behavioural signals… what feels both effective and aligned with the open social web? I’m building a social media platform and I’d love to hear your thoughts on this topic.
I hate to use the example, but one of the worst places on the internet actually found a solution for this a long time ago. $10. By having a small, but meaningful, fee for the account people couldn’t have unlimited accounts and there was a cost to getting banned. If you are posting bot slop you will be banned quickly and lose your $10. If you are not being bot like and also not breaking tonnes of other rules many times then you will not be banned and can keep your account.
This works well enough most of the time. Getting a new account after your previous one has been banned can be done fairly quickly but that $10 adds up quickly and can fund the cost of reviewing and potentially banning bad actors. It doesn’t solve the problem in full, but another thing you can add is region gating. In your profile you set where you are going to be dialling in from, including which VPN providers and so on. This means you have a fairly specific pattern of behaviour that is white listed in advance. Now if your account is compromised and starts logging in from other places it can be blocked quickly, and also potentially the login attempts can be blocked and a password reset process initiated.
Another option would be to require a invite only process and have those you invite reflect on you. For example, if someone invites a friend and that friend invites not accounts then both people are impacted. If someone invites 9 good people and 1 abused account their ratio is 0.9, if they drop below some value then they lose invite privileges. If you consistently invite crappy people or abusive bots you get banned, but if it happens only occasionally then you lose your invite rights for a while. Those parameters are all tunable but should help to get things operating more smoothly.
Also, having invite periods but closing invites most of the time can also kill off many bots. People using bots are lazy, they don’t want to wait for months posting stuff and pretending to be a person to then use the accounts to post 3 junk things and then have the whole set banned. They want a large network of accounts they can throw away as needed. Make it slow, expensive, and consequential. Make botting 50 accounts cost $500 and also be a waste of time and the bots will stop coming.
Using money as a gate has some issues. If you don’t scale the amount to the region, you effectively exclude that region. But if you do scale to the region, it encourages the spammers to simply setup their operations (either physically or virtually) in the cheapest region (physically also has the benefit of cheap labour).
Requiring unique credit cards could mitigate that, but then there is PCI issues there, and its basically no different to requiring ID.
Requiring a fee wont stop anything. Look at old school Rubescape, botters pay monthly for their bot farms on the member’s worlds.
Yeah, sadly I have to agree, a fee won’t do anything on its own. This would require a mix of features working together. Each makes botting a bit more painful and a bit less effective, but putting them all together makes it not worthwhile.
Also, we don’t need to make a space perfect, just better than other places. You don’t need to be faster than the bear to escape, just faster than the slowest member of your group.
Thanks, the third option is what I had in mind but I had completely missed the automated banning feature, reviewing manually each time probably wouldn’t scale well.
It’s old school and expensive compared to what the social media companies use, but there is actually a way to verify they are human without requiring invasive facial scans or uploading your driver’s license to an insecure server. It’s a way to verify with near certainty that someone is human, without requiring them to upload any personal information whatsoever.
Really, this problem was solved a very long time ago. It’s a called a public notary. Traditionally these are used to certify signatures on important paperwork, but notaries could easily serve as a certified human checker.
Let people request or apply for a verified account. Have a system produce a form that lists the user’s screen name, lemmy instance, and the contact details and licensure of the notary. Have a place for the notary’s contact info, but nothing about the account owner’s contact info. The form will state something like, “I,___, licensed notary in the state of ____, observed the owner of this account successfully log in to the account listed on this form.” You could prevent spoofing by requesting that the account owner, while in front of the notary, log into an account, and post a verification code on some thread. Then the notary could confirm that posting through the notary’s own device.
The exact procedure could be tweaked, but the basic idea is to use public notaries (or whatever the local equivalent is) to verify that an account is owned by a human. Now, there wouldn’t actually be anything physically stopping someone from certifying any number of accounts this way. But this is where the hassle factor of in-person verification actually benefits us. Notaries are relatively cheap, but not free. They usually charge around $20 where I’m at. People pay that much for Twitter verification, why not a one-time notary fee? But while the fee is relatively modest, it breaks spammers. Accounts are no longer disposable. They’re pseudo-anonymous, but not disposable.
Online accounts are increasingly necessary to just live in society. And the rise of LLMs means that telling a human from a bot based just on their online behavior is a fool’s errand. And other methods such as uploading IDs and facial scans are privacy nightmares, vulnerable to spoofing, and often biased against minority groups.
Ideally this would be done on a larger scale than just one site. You could have some sort of third party service that just served as a repository for notary-validated human accounts, and then that central repository could send out verification tokens for individual site logins. So you pay $20 to verify you are human once, and you can use that one $20 check to verify your humanity across any number of websites.
That is how you can actually do this without making Orwell spin in his grave.
Plus, I’m sure the notaries could use the business. I’m sure docusign hasn’t helped them out much.
They should publish their “23 nd Me” results or at least prove which parent they loved more. /s
There probably is no magic solution: I would focus on making abuse expensive instead of making honest users miserable. Gradual trust, optional vouching, sensible rate limits, reputation, and behavioral signals together will outperform almost any CAPTCHA while keeping the door open for real newcomers.
