How to prevent programmatic Stellar account creation

Question

I've created an app that includes a Stellar account creation as part of he sign up process. Someone is problematically creating accounts, which keeps draining my distribution account that I use to seed the account creation step with 1XLM.

How can I keep my app live and prevent this?

My login methods include Google, Facebook and email/password. The latest attack used the email/password option. The implementation is a Firebase one, and requires email verification.

Answer 1

When someone is programmatically creating accounts, the simple way to stop them is by increasing their cost of account creation. This problem is not only existent for you, but even my company also underwent such bot attacks, and invalid signups. So what can you do to check the authenticity of signup? and how exactly can you increase the costs for the program owner?

1. Implement Captcha. Captcha solving is expensive for most of the attackers. So a captcha would for sure stop them creating random accounts on your site, and the best part of it is, you'll get the result almost immediately.
2. Log the IP, check the Whois. Program some code which actually blocks usage of Datacenter IP addresses and forces the user not to use a VPN. Attackers don't get residential proxies for a cheaper price. So, if you do this alone, they would leave your site.
3. Finally, if feasible for you, get new signups with a VPN flagged for a manual review and KYC. Because processing KYC for all your users won't be a viable option. If you ask KYC only for flagged ones, the volume of work would reduce.

Hope this answer helps you :)

Answer 2

This is a really good questions and one without a specific "right" answer. It essentially boils down to what the most acceptable compromise is.

Either A) You force users to pay their base fee for account creation.
Or B) You live with the possibility of manipulation.
C) Some combination of the two.

Here are some possible compromises:

1. Lobstr uses a loan repayment method where you "borrow" the base fee until you have enough XLM in your account to pay it back. In essence you have an unfunded account which doesn't really exist until you pay back the base fee from some external account.
2. You maintain signing control over newly created accounts for a short period of time until you're able to prove the account is legitimate. (If the base fee is 5 XLM don't sign for txns which would take the balance below 5 XLM).
3. Employ better unique personhood proofs. This one is the most difficult as at the end of the day it's just not that hard to spoof unique personhood without invasive KYC forms. Depending on your app though this may be an acceptable compromise.

Right now my ideal scenario is a spin on 2. involving a new in-progress SEP involving smart contracts and Turing Signing Servers. Essentially you'd write a smart contract which would lock up an account either indefinitely, for a period of time or until specific condition(s) were met. Some actions could be allowed but only through the Turing Signing Server. You'd maintain a custody free operation while still holding contractural control over newly created accounts.

You can watch this video to get a sense of what I'm talking about: https://youtu.be/T7FlHKbew4U

Hopefully that helps, I'm certainly happy to explain more or to help setup such a smart contract. You can find me on Keybase tyvdh.