vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Community Lounge (https://vborg.vbsupport.ru/forumdisplay.php?f=13)
-   -   What's The Point of E-Mail Confirmation? (https://vborg.vbsupport.ru/showthread.php?t=264837)

8thos 06-07-2011 10:22 AM
What's The Point of E-Mail Confirmation?
 
My site's e-mail confirmation is broke so I disabled it.

So I started thinking, if someone uses a fake e-mail account to register, would it matter since their IP is logged?

If they forget their password and the e-mail account is wrong then their screwed. Yes I know.

Nor will they get notifications. But is it really that serious? I've noticed a lot of people will sign up but not get to post because of email confirmations.

and I'm not worried about spam bots. Question and Answer fixes that easily.

Disasterpiece 06-07-2011 11:34 AM
Discussed this recently: https://vborg.vbsupport.ru/showthrea...24#post2204324

Quote:
So I started thinking, if someone uses a fake e-mail account to register
Your choice to do something against this. There are enough methods to keep trashmail adresses outside and it's only important that the user specifies an email adress where he can receive emails.

Quote:
If they forget their password and the e-mail account is wrong then their screwed.
Not your problem.
Also: There's a contact form users can use if their account is important to them.

Quote:
I've noticed a lot of people will sign up but not get to post because of email confirmations.
If they won't even click on a simple activation link, I wouldn't bother much about them. But that's just my opinion.

8thos 06-07-2011 05:42 PM
Quote:
Originally Posted by Disasterpiece (Post 2204573)
Discussed this recently: https://vborg.vbsupport.ru/showthrea...24#post2204324


Your choice to do something against this. There are enough methods to keep trashmail adresses outside and it's only important that the user specifies an email adress where he can receive emails.


Not your problem.
Also: There's a contact form users can use if their account is important to them.


If they won't even click on a simple activation link, I wouldn't bother much about them. But that's just my opinion.
I clicked on your link and says I don't have permission to view.

I also didn't care if a member wouldn't bother clicking to view activation links.

but as I've been having lots of issues with my site crashing etc, I'll take em however way I can.

Boofo 06-07-2011 07:01 PM
And watch your SPAM count up up right along with it. ;)

8thos 06-07-2011 09:08 PM
Quote:
Originally Posted by Boofo (Post 2204714)
And watch your SPAM count up up right along with it. ;)
Nah. Security Question and Answer fixes that easily.

For instance, ask a spam bot a random question like:

'Name of member with ninja avatar'

and it can't answer. If it's a person who joins just to spam, they'd have to do some searching first. Most spammers don't have time for that so they'll give up.

Boofo 06-07-2011 09:33 PM
Spammers will use the lack of email verification to get in and post their links. That is the general idea. Plus, when you start getting emails bounced because they gave you a fake email address, hosts usually don't like it.

nitra1000 06-07-2011 10:48 PM
While the QandA might solve your spam problem, hotmail and the like will spambox you if you send too many notifications to incorrect accounts

Disasterpiece 06-07-2011 10:50 PM
Quote:
Originally Posted by Octavius. (Post 2204764)
Nah. Security Question and Answer fixes that easily.

For instance, ask a spam bot a random question like:

'Name of member with ninja avatar'

and it can't answer. If it's a person who joins just to spam, they'd have to do some searching first. Most spammers don't have time for that so they'll give up.
for automated attacks, you're right.
For attacks directed specificly to your forum, this might be one less barrier.

vijayninel 06-08-2011 04:31 AM
Quote:
Originally Posted by Boofo (Post 2204714)
And watch your SPAM count up up right along with it. ;)
This is completely wrong an misleading. I dont have e-mail verification on my site and have 0 spam despite being specifically targeted by human spammers in addition to bots.

Bots and human spammers can create e-mail accounts and verify them as well. e-mail verification is quite useless for preventing spam and is an inconvenience to general users. I would suggest not to use it.

Boofo 06-08-2011 06:52 AM
Quote:
Originally Posted by vijayninel (Post 2204912)
This is completely wrong an misleading. I dont have e-mail verification on my site and have 0 spam despite being specifically targeted by human spammers in addition to bots.

Bots and human spammers can create e-mail accounts and verify them as well. e-mail verification is quite useless for preventing spam and is an inconvenience to general users. I would suggest not to use it.
No, it is not wrong and misleading. Spammers look for sites like yours where they don't have to prove who they are. That makes dissemination of spam all that much easier. If they aren't doing spam in posts, you can almost bet they are doing it in PMs.

vijayninel 06-08-2011 07:22 AM
Quote:
Originally Posted by Boofo (Post 2204939)
If they aren't doing spam in posts, you can almost bet they are doing it in PMs.
No they are not doing it in PM's either. My forum members immediately report any spam PM's and I am also very aware of what is generally going on on my forum.

We occasionally do get reports of spam PM's but it is never more than a handful out of the tens of thousands of PM's sent every year.

Quote:
Originally Posted by Boofo (Post 2204939)
No, it is not wrong and misleading. Spammers look for sites like yours where they don't have to prove who they are. That makes dissemination of spam all that much easier.
Secondly, verifying a e-mail doesn't prove anything about the identity of a person. E-mail services don't verify the identity of any person creating an E-mail. The E-mail providers are running a business, they are not a government or international institution. They don't have any people who verify any documents or background of the person creating the email ID. Anyone can make a fake e-mail ID in minutes.

E-mail verification is useful for verifying the e-mail the member has submitted to you exists and occasionally it can help in wearing down trolls who keep re-registering very rapidly. But overall it has a negative effect on member registration and participation.

If you are not paranoid about verifying the existence of your members e-mail addresses then don't use this feature.

Boofo 06-08-2011 08:38 AM
Quote:
Originally Posted by vijayninel (Post 2204947)
If you are not paranoid about verifying the existence of your members e-mail addresses then don't use this feature.
It has nothing to do with being paranoid. It is just good common sense.

mrt12345 06-08-2011 04:43 PM
Very interesting points here, I was wonder about these things myself. How about limiting just to face book registrations, it almost seem everybody is on facebook, ok you do get spammers on facebook but this kills the bots registration for now. I don?t know if vb will allows only facebook users to join, but I think it would be a cool mod to be made plus you don't need to worry about the email Verification ,facebook took care of that for you ;)

8thos 06-09-2011 01:44 PM
How do I ban this troll's e-mail address? I don't want to accidentally ban all g-mail accounts, just this person's e-mail.

For instance, they registered with this email. sohhuser+88@gmail.com
I banned the troll and they came back with this sohhuser+99@gmail.com

If I banned sohhuser@gmail.com will they still be able to come back just by putting a + and a number a the end?

vijayninel 06-09-2011 03:08 PM
Quote:
Originally Posted by Octavius. (Post 2205458)
If I banned sohhuser@gmail.com will they still be able to come back just by putting a + and a number a the end?
Yes he will still be able to come back. Also banning e-mail addresses is quite useless for fighting trolls.

Also please stop making your posts completely in bold. Use bold only to highlight certain text which you want to stand out.

8thos 06-09-2011 06:54 PM
I've been bolding posts since 2001. I can't help it, it's a habit. I do it for my poor eyesight. Easier for me to tell when someone replies to my post in long threads.

Simon Lloyd 06-09-2011 07:19 PM
Quote:
Originally Posted by Octavius. (Post 2205458)
How do I ban this troll's e-mail address? I don't want to accidentally ban all g-mail accounts, just this person's e-mail.

For instance, they registered with this email. sohhuser+88@gmail.com
I banned the troll and they came back with this sohhuser+99@gmail.com

If I banned sohhuser@gmail.com will they still be able to come back just by putting a + and a number a the end?
This might seem like a shameless plug, but, if you find out their user agent (in who's online) and use this mod https://vborg.vbsupport.ru/showthread.php?t=264932 you can stop them getting in :)

8thos 06-09-2011 08:44 PM
This chick uses proxies.

Alfa1 06-10-2011 12:05 AM
If you do not verify email addresses, then your site will send out email to non existent email addresses. As a result email providers will blacklist your site as a spammer. In time many of the major email providers will refuse your email.

8thos 06-10-2011 12:18 AM
Makes sense.

Boofo 06-10-2011 01:40 AM
Quote:
Originally Posted by Alfa1 (Post 2205637)
If you do not verify email addresses, then your site will send out email to non existent email addresses. As a result email providers will blacklist your site as a spammer. In time many of the major email providers will refuse your email.
Exactly what I was trying to point out, but you worded it so much more eloquently. ;)

vijayninel 06-10-2011 05:01 AM
Quote:
Originally Posted by Alfa1 (Post 2205637)
If you do not verify email addresses, then your site will send out email to non existent email addresses. As a result email providers will blacklist your site as a spammer. In time many of the major email providers will refuse your email.
This is also not true. I use phplist to send newsletters to my members in which you can manage bounces. If a e-mail bounces from some address then phplist will not send any more mails to those addresses.

Boofo 06-10-2011 07:33 AM
If an admin doesn't use phplist, what then? That would make his statement true, huh? We understand, You don't use email verification, for whatever reason. Others of us do for the reasons we stated, which ARE true, by the way.

vijayninel 06-10-2011 08:35 AM
Let me rephrase my statement then. If you use a newsletter manager then you wont be repeatedly sending e-mails to addresses which do not exist.

It is advisable to use a newsletter manager for sending mails not just because it gives you many more controls and options but also because even verified addresses can be become deactivated over a period of time and this will result in bounced e-mails. A newsletter manager will prevent this from happening.

In any case at least on my forum most of the members provide the correct e-mail address even without verification. The circumstances may be different on different forums.

Alfa1 06-10-2011 10:53 AM
Im afraid that is incorrect. vbulletin sends out a lot of email notifications for subscriptions, birthdays, member to member emails, etc. For example: my site sends out over 30.000 of such emails per month, while I have 65.000 active email addresses. If you use a a newsletter manager, then that does not affect default vbulletin notification emails. Your newsletter manager only manages your bulk email newsletters.

PHPlist does not have very good bounced email processing btw. It has fallen way behind the times.

Panzer Max 06-11-2011 01:40 AM
Quote:
Originally Posted by Octavius. (Post 2204764)
Nah. Security Question and Answer fixes that easily.

For instance, ask a spam bot a random question like:

'Name of member with ninja avatar'

and it can't answer. If it's a person who joins just to spam, they'd have to do some searching first. Most spammers don't have time for that so they'll give up.
Wait till your forum actually gets popular. We have two levels of Q&A, and we still get 10+ spammers a day.

8thos 06-14-2011 09:32 PM
A tranny troll alias took advantage of no email confirmation and made a lot of accounts today.

As a result, I had to re-enable e-mail verification and install the first two modifications and upgrade the last two for my moderators:

Quick Banning Tool: https://vborg.vbsupport.ru/showthread.php?t=238189

New Thread on User Banning: https://vborg.vbsupport.ru/showthread.php?t=257041

Ban from Thread: https://vborg.vbsupport.ru/showthread.php?t=263142

Banned Users List: https://vborg.vbsupport.ru/showthread.php?t=228217

final kaoss 06-20-2011 07:53 PM
Just use this if you want to keep email verification disabled.

Quote:
Originally Posted by Glowhost.com.;[url
https://vborg.vbsupport.ru/showthread.php?t=248042]If[/url] you install this mod, please mark this as "Installed."


About Spam-O-Matic 2.0:
Spam-O-Matic 2.0 is a spam firewall for your vBulletin Forums version 4.x and later. It prevents known spammers from registering on your forums. If they can't register, they can't spam! This data comes from the stopforumspam.com spammer database.

It also does a ton of other cool stuff like moderating posts automatically if the post is found in the Akismet database, or if it contains words on your "Bad Words" keyword list.

This is without a doubt, one of the most important mods that you will be using on your forum.

The mod WORKS with vBulletin's new Facebook integration.
This module works with all of the Facebook functions that are built into the vB4 series. Similar mods do not handle Facebook integration completely.

This module has the ability to submit new spammer details to the StopForumSpam or Akismet databases automatically, all without any new templates or manual template modifications!

This means other forums that are running Spam-O-Matic will not have the same spammer on their forums if you have (automatically) reported the spammer to the SFS database.

Just install the product in the product manager, upload a few files, configure the system and you are done. (Estimated time: 5-10 minutes)

What's new in Version 2.0: (a lot!)

Statistics. Now show off to the world how many bad guys you have automatically prevented from posting junk on your forum.
Auto-Moderation now ignores your RSS posts.
Improved, more accurate logs available from admincp
Newbies Manager! After registration, newly registered users can be placed in a "Newbies" group which has more limited permissions as compared to your regular "Registered Users" group. Newbies will graduate to your Registered Users group based on your required post count settings.
Auto-Submit Spammers from the moderation tools menu on each postbit.
Remove Posts, threads, PMs, Calendar Events from your spammer in one easy wizard. No double logins needed.
Shows other users who signed up with the same IP. (Sleeping Spammers)
Optional Affiliate System
~50 customizable settings to fine-tune Spam-O-Matic to your exact needs.


How it works:
New registrations are checked against the known spammer database at StopForumSpam.com. If the email, IP, or username exists in their database, the user (or bot as the case may be) is denied registration on your forums. If they make it past the SFS check, they are checked against several Automatic Moderation rules, and are also checked against the Akismet service for known comment spam.

A) StopForumSpam:
The StopForumSpam Module lets you:

Check a registrant's IP address.
Check a registrant's email address.
Check a registrants Username.
Disable or enable any of the above checks.
Block and log, or, allow and log known spammers.
All registration attempts are logged for your viewing pleasure.
Several other performance tuning options

If a user (or bot) tries to register on your forum and they pass the built-in vBulletin registration system. (Human verification, etc), their registration details are then passed to the Spam-O-Matic firewall for further checking.

NOTE: You should use some sort of human verification checking in vBulletin's built-in options to limit the number of requests to the already heavily-loaded StopForumSpam database servers. This will also prevent additional load because SOM will not have to do anything if the bot fails preliminary registration validation.

It is completely invisible to humans who are registering that this process is taking place. Bots are stopped dead in their tracks.

If a spammer is able to sneak past the first line of defense, and manages to post, then there are secondary, tertiary, and, uh...4th level protections too!

B) Auto-Moderation:
Auto Moderation lets you:

Define how many URLs a new member can post before being sent to moderation.
Define keywords that will send a post to Auto-moderation (viagra, porn, more here)
Define minimum post count to avoid Auto-moderation.
Excludes admin and moderators from Auto-moderation.
Completely disable Auto-moderation if you don't want it.

C) Akismet Service
Spammers that make it past the StopForumSpam and Auto-Moderation will be checked against the Akismet service. If they manage to make a post, and then are found on Akismet, they can be auto-moderated.

The Akismet settings let you:

Set the number of posts that Akismet will check from each user. After this number is exceeded, Akismet checking will be disabled for that user.
Auto-Submit spammers that post on your boards back to the Akismet service so that other forums and blogs do not do not receive the same spam.
Completely disable the Akismet service.

D) Newbies Manager
Should you decide to enable this option, you can create a new usergroup and then tell Spam-O-Matic about it. Once SOM knows about this usergroup, and once enabled, all new users will be part of the Newbies group. The idea here is that you make a Newbies group that has limited forum permissions. For example, no signatures, no BB code, no images, and etc. This group is created completely in the vB admincp. Spam-O-Matic simply makes it the graduation process to the normal Registered Users group, automatic.
Learn More and Discuss the Newbies Manager here.

Punitive Actions:
If you find a spammer has made it past your 4 front-lines of defense, and has managed to post on your forum, then you can help the community...

The spammer's details can be sent to the Stop Forum Spam and Akismet databases automatically, preventing them from registering or posting on other forums. When other forums do the same, the protection is reciprocated.

Simply moderate a post and choose the option to "Delete Posts As Spam..." an then choose the option to "Ban User." Banning the user sends their details to either Akismet, StopForumSpam, (or both) depending on how you set it up.

API Keys:
API Keys are not required for this system to stop spammers on your forums. But you should obtain them so that your forum can contribute to the real-time block lists.

A StopForumSpam API key is required if you want to contribute to the StopForumSpam blacklists by adding your spammers to their database. By submitting spammers you help keep other forums and blogs clean.

An Akismet API key is required if you want to enable any Akismet auto-moderation features in this module. Akismet API key is not required for all Auto-Moderation functions.

You can obtain a Stop Forum Spam API key which is free from stopforumspam.com.

Get your StopForumSpam API Key Here

You can obtain an Akismet API key from Akismet.com.
Akismet offers free and paid API keys so choose your version based on your situation.

Get your Akismet API Key Here

Why it is better than the other anti-spam solutions on vBulletin.org:

Works with all of vBulletin 4 functions including Facebook automatic registration.
Report spammers that you find to the Stop Forum Spam Database.
Report spammers that you find to the Akismet Database.
Built-in Auto-moderation.
Auto-moderation rules based on post count.
Auto-moderation rules based keywords.
Auto-moderation rules based Akismet results.
Enable or disable any actions that you do not want.
Customizable "Registration Rejected" message.
Consolidates 4 popular methods of spam prevention into one product.
No Manual Template Modifications!
Supported!

======================
Compatibility:
vBulletin 4.0.x

Server Requirements:
Curl or allow_url_fopen must be compiled/enabled into PHP. Ask your web host to enable curl or allow_url_fopen if it is not already available on your server's PHP configuration. (Or just host with GlowHost, where it already is

======================
Reported Conflicts or reproducible known issues:

MySQL Error : Unknown column 'akvbghsfs_akismet_permissions' in 'field list'

KeyCpatcha Mod breaks Spam-O-Matic logs and Statistics.

No new templates or template modifications!
Yessss!

Uploads:3 files (2 PHP, 1 XML)
1 Product Manager Upload
======================

=====================
Donations:

If you like this mod, sure, you can donate.
But the best donation would be to nominate us for MOTM to tell your friends and others about this mod, and if you are in need of web hosting, order it from GlowHost.com to show your thanks and help support product development for SOM.

We hope you enjoy the mod, spread the word to keep all of our forums clean.

=====================
Installation:

1) Download the attached file
2) Mark As Installed
3) SOM 2.0 does not support updates from the v1.x series.
When upgrading to version 2.x, please, be sure to remove any other existing version of SOM 1.x from the product manager before installing v2.x series. Also make sure to remove /forum/includes/xml/bitfield_glowhostspamomatic.xml from version 1 if you had it installed.

4) Extract the zip file, and view the readme file for the rest of the instructions.

=====================

Original concept credits go to the authors of vBStopForumSpam, MonkeyStop, and a couple of others I probably forgot about.


All times are GMT. The time now is 04:54 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01353 seconds
  • Memory Usage 1,854KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (17)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (28)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete