3 ms·

I have a site that requires Facebook to login. For this site, user fraud is a big concern. I would much rather have an easy way to tell if someone is a "real"

by portman 16y ago

I have a site that requires Facebook to login. For this site, user fraud is a big concern. I would much rather have an easy way to tell if someone is a "real" person, and Facebook gives me that. If my market size goes from 1.5B to 500M because of this decision, that's fine. In our case, it's a calculated choice, like the dozens of calculated choices a startup makes every day.

jpeterson 16y ago
I would much rather have an easy way to tell if someone is a "real" person, and Facebook gives me that. How does Facebook give you that, exactly?
- portman 16y ago
  Several ways, none of which is individually full-proof, but taken together they are a very good indicator: - Does the user have a profile photo, or is it the default user icon? - How many friends does the user have? (Generally 0, 1, or 2 is highly suspicious) - Does the user have a real name? [Edit: we have a blacklist of fake names.]
  - zalew 16y ago
    Does the user have a real name? I'm very curious how do you believe you can check that.
  - DeusExMachina 16y ago
    They can be an indicator, but do you check every subscription? Are you going to refuse subscription telling people "sorry, you don't have enough friends"? Here is a very quick experiment I made: - Get the name of one of your contact and the surname of another one and subscribe with that. - Take the picture of a random girl on the internet that looks real, put a copy and paste famous quote in the description like "it will not rain forever". - Subscribe to a couple of groups or pages with the word "sex" in them. Bang, hundred of friends in a couple of days, and the profile now seems legit. Still harder than generating fake profiles automatically, but I think that with a little bit of effort this can be automated too. There are also companies that will give you some hundred of friends for a fee.
  - deleted 16y ago
    [deleted]
- qq66 16y ago
  Most people don't go to the trouble of registering a fake Facebook account to sign up for a random web service. If you want to be even more strict, you can look for people with at least 3 friends -- most real people have more than 10 friends, and very few people with a fake account will register 4.
  - gallerytungsten 16y ago
    Not true. It's easy to find spam accounts with dozens of friends. Try searching on openbook.com with a mildly naughty term, then click through to some of the result profiles. You'll find that they link to porn sites. Example: http://youropenbook.org/?q=panties&gender=female http://youropenbook.org/?q=panties&gender=female
deleted 16y ago
[deleted]
bl4k 16y ago
I have two fake Facebook accounts that I use to sign in to services. I even have a good rep on Quora using a completely fake name. Forcing Facebook because you think it will give you real people and verified accounts is wrong.
- deleted 16y ago
  [deleted]
- portman 16y ago
  Sorry if I wasn't clear. I'm not saying that forcing Facebook will 100% eliminate fraud. But forcing Facebook can reduce fraud, by several orders of magnitude. Authentication isn't -- and shouldn't be -- a one-size-fits-all problem. For us, Facebook has worked extremely well. (We originally supported Twitter and OpenID but dropped them when it turned out that 100% of our fraud incidents had authenticated with one of those two.) That said, I'd love to know if our FB heuristics would "catch" you or not. Email me your fake FBUIDs and I'll publicly post their score. We can all learn something! portman.wills[at]gmail.com
  - kenjackson 16y ago
    This is exactly why I wouldn't join your site. I don't want you crawling my list of friends, likes/dislikes, etc... to determine if I should be able to buy a T-Shirt (or whatever product it is that you sell). With that said, my Facebook account probably wouldn't pass your test as I recently removed all my pictures, and removed all my likes disklikes, and most of my "friends". And have virtually no activity on it.
  - bl4k 16y ago
    The accounts have nothing in common - not IP address, nor cookies nor names nor friends or anything. With the fake accounts I just added fake friends (Facebook was so kind to suggest them) and they approved me. I even wrote 'whats up' on some peoples walls and they replied. No idea who they are, seems people just need somebody to talk to. I am a bit of a privacy nut (multiple browsers, incognito, proxy servers, VPN's, multiple accounts online (including this site)) and I intentionally keep my person, work, online life etc. completely separate. So as interesting as it would be for you to test my accounts, it means I would have to kill you :)

by portman 16y ago

jpeterson 16y ago

I would much rather have an easy way to tell if someone is a "real" person, and Facebook gives me that. How does Facebook give you that, exactly?

portman 16y ago
Several ways, none of which is individually full-proof, but taken together they are a very good indicator: - Does the user have a profile photo, or is it the default user icon? - How many friends does the user have? (Generally 0, 1, or 2 is highly suspicious) - Does the user have a real name? [Edit: we have a blacklist of fake names.]
- zalew 16y ago
  Does the user have a real name? I'm very curious how do you believe you can check that.
- DeusExMachina 16y ago
  They can be an indicator, but do you check every subscription? Are you going to refuse subscription telling people "sorry, you don't have enough friends"? Here is a very quick experiment I made: - Get the name of one of your contact and the surname of another one and subscribe with that. - Take the picture of a random girl on the internet that looks real, put a copy and paste famous quote in the description like "it will not rain forever". - Subscribe to a couple of groups or pages with the word "sex" in them. Bang, hundred of friends in a couple of days, and the profile now seems legit. Still harder than generating fake profiles automatically, but I think that with a little bit of effort this can be automated too. There are also companies that will give you some hundred of friends for a fee.
- deleted 16y ago
  [deleted]
qq66 16y ago
Most people don't go to the trouble of registering a fake Facebook account to sign up for a random web service. If you want to be even more strict, you can look for people with at least 3 friends -- most real people have more than 10 friends, and very few people with a fake account will register 4.
- gallerytungsten 16y ago
  Not true. It's easy to find spam accounts with dozens of friends. Try searching on openbook.com with a mildly naughty term, then click through to some of the result profiles. You'll find that they link to porn sites. Example: http://youropenbook.org/?q=panties&gender=female http://youropenbook.org/?q=panties&gender=female

deleted 16y ago

[deleted]

bl4k 16y ago

I have two fake Facebook accounts that I use to sign in to services. I even have a good rep on Quora using a completely fake name. Forcing Facebook because you think it will give you real people and verified accounts is wrong.

deleted 16y ago
[deleted]
portman 16y ago
Sorry if I wasn't clear. I'm not saying that forcing Facebook will 100% eliminate fraud. But forcing Facebook can reduce fraud, by several orders of magnitude. Authentication isn't -- and shouldn't be -- a one-size-fits-all problem. For us, Facebook has worked extremely well. (We originally supported Twitter and OpenID but dropped them when it turned out that 100% of our fraud incidents had authenticated with one of those two.) That said, I'd love to know if our FB heuristics would "catch" you or not. Email me your fake FBUIDs and I'll publicly post their score. We can all learn something! portman.wills[at]gmail.com
- kenjackson 16y ago
  This is exactly why I wouldn't join your site. I don't want you crawling my list of friends, likes/dislikes, etc... to determine if I should be able to buy a T-Shirt (or whatever product it is that you sell). With that said, my Facebook account probably wouldn't pass your test as I recently removed all my pictures, and removed all my likes disklikes, and most of my "friends". And have virtually no activity on it.
- bl4k 16y ago
  The accounts have nothing in common - not IP address, nor cookies nor names nor friends or anything. With the fake accounts I just added fake friends (Facebook was so kind to suggest them) and they approved me. I even wrote 'whats up' on some peoples walls and they replied. No idea who they are, seems people just need somebody to talk to. I am a bit of a privacy nut (multiple browsers, incognito, proxy servers, VPN's, multiple accounts online (including this site)) and I intentionally keep my person, work, online life etc. completely separate. So as interesting as it would be for you to test my accounts, it means I would have to kill you :)