08 January 2014, 12:41

Hello Dirk and Don,

For sites that need to have registration open there is another option that you can choose: Click the "Confirm registration" checkbox in the institution settings. Then an admin needs to approve every account before it's being created. We don't do this here on mahara.org because there are too many registrations waiting otherwise and people can't post directly, but it might be an idea for your sites.

Cheers

Kristina

08 January 2014, 13:22

Hi Kristina:

I was getting 50+ confirmation requests a day, so I shut it off. That's spam directed just at me!

08 January 2014, 15:21

Another thing you could consider is using the Persona auth plugin. That allows members of the general public to create an account on your site, but they have to have a Persona account in order to do so. And that seems to be a fairly effective speedbump against spammers, because we haven't seen any spammers using Persona on mahara.org.

The downside is, I think most members of the general public don't know how to get a Persona account either (the easiest way is to go to https://persona.org/ )

13 January 2014, 6:14

Hi,
some spammers create accounts without entering a first name, last name even though those are locked fields I thought.
I am considering to make my site persona auth only, however what would be a good approach to deal with legitimate existing users? Ideally I'd ike to remove the standard login box altogether to avoid confusion.

20 January 2014, 14:53

Hello Dirk,

When you register, you must provide a first and last name, but when you go into Content -> Profile information, you can change your name to spaces and then there is no name shown. That could be what's happening here.

Unfortunately, there is nothing we can do against people who try to register on a site. It does not only affect Mahara, but any site on the internet that offers free registration. Spammers try to exploit the sites and they pay humans to do so. Thus, moderation queues, registration confirmations etc. are implemented to catch them before they can do harm on the site. In Mahara's case because we don't want to be the bottleneck for new accounts, Aaron's recent implementation on mahara.org of the probation is a good step. It doesn't keep spammers out, but at least they cannot spam the public via pages or forum posts with links. They could still do so by sending people direct messages or creating pages they share only with other users, but at least it's not a ful-blown spam attack anymore.

Cheers

Kristina