866156 - Add rate limiting to number of accounts created per day

Status: RESOLVED WONTFIX

(support.mozilla.org :: Knowledge Base Software, task, P4)

Description

[Kadir Topal [:atopal]]

Please limit the number of accounts you can create per day to 1, excluding staff.

Comment 1

[Ricky Rosario [:rrosario, :r1cky]]

Can you be more specific?

Is this about limiting the number of times you can register from a specific IP address? How does staff come into play?

Also, we are already protecting accounts by requiring email validation.

I might be just totally confusing what this is about though.

Comment 2

[Ricky Rosario [:rrosario, :r1cky]]

Moving to backlog until details

Comment 3

[Kadir Topal [:atopal]]

Ricky, yeah, this is about limiting that by IP too. Staff is excluded because we sometimes have to try things on production. This is actually rather low priority. But let me know if you see a big issue with limiting by IP.

Comment 4

[Ricky Rosario [:rrosario, :r1cky]]

(In reply to Kadir Topal [:atopal] from comment #3)
> Ricky, yeah, this is about limiting that by IP too. Staff is excluded
> because we sometimes have to try things on production. This is actually
> rather low priority. But let me know if you see a big issue with limiting by
> IP.

How can we limit this to staff? You need to be logged out to register.

Comment 5

[Ricky Rosario [:rrosario, :r1cky]]

Also, I am worried that limiting to 1 by IP will affect people at mozcamps for example where everybody is sharing an IP address.

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

My vote is to WONTFIX this. The ratelimiting is already in place. You have to go to your inbox and activate your account to use it. That should slow things down enough without affecting valid reasons to register.

Comment 7

[Michael Cooper [:mythmon]]

I agree we should WONTFIX this. I think that limiting registrations is going to be a minefield of problems for legitimate users, and not very useful in blocking spam. I think we should not do this unless there is clear evidence that we are getting spam due to users registering too many accounts.

Yes, spammers could automate checking their email, but if they are that sophisticated, they can use multiple ip addresses as well. I think this will only server to harm legitimate users.

Comment 8

[Kadir Topal [:atopal]]

Yeah, in retrospect this was a pretty dumb idea.

Comment 9

[Ricky Rosario [:rrosario, :r1cky]]

Cleaning out the backlog.