Detecting abuse for post rating system - sql

I am using a wordpress plugin called "GD Star Rating" to allow my users to vote on stories that I post to one of my websites. http://everydayfiction.com/ Recently we have been having a lot of abuse of the system. Stories that have obviously been voted up artificially. "GD Star Rating" creates some detailed logs when a user votes on a story. Including; IP, Time of vote, and user_adgent, ect..
For example this story has 181 votes with an average of 5.7 http://www.everydayfiction.com/snowman-by-shaun-simon/ Most other stories only get around ~40 votes each day.
At first I thought that the story got on to a social bookmarking site Digg, Stumbleupon ect... but after checking the logs I found that this story is getting the same amount of traffic that a normal story gets ~2k-3k.
I checked if all the votes for this perpendicular story where coming from a the same IP address. I could see this happening if a user was at a school's computer lab using all their lab computers to vote up this story. Not one duplicate IP address in the log for this story.
SELECT ip, COUNT(*) as count FROM wp_gdsr_votes_log WHERE id=3932 GROUP BY (ip ) ORDER BY count DESC
Next I thought that a use might be using a proxy to vote up a story. I checked this by grouping all the browser user_agent together to see if there a single browser voting in a perpendicular way. At most 7 users where using a similar browser but voted sporadically (1-5), no evidence of wrong doing.
SELECT user_agent, COUNT(*) as count FROM wp_gdsr_votes_log WHERE id=3932 GROUP BY ( user_agent) ORDER BY count DESC
I also check to see if all the votes came in at a once. Maybe someone has a really interesting bot that can change the user_adgent and uses proxies, ect... At most 5 votes came with in 2 mins of each other. It doesn't seem to be any regularity on how people vote (IE a 5 vote does not come in once a min)
SELECT * FROM wp_gdsr_votes_log WHERE id =3932 AND vote=5 ORDER BY wp_gdsr_votes_log.voted DESC
The obvious solution to this problem is to force people to login before they are allowed to vote. But I would prefer to not have to go down that route unless it is absolutely necessary.
I'm looking for suggestions on things to test for to detect the abuse.
Edit
Anther thing that I just tested was to see if all the people that voted on this perdicutre story were first time voters on the site by IP address. It appears that about 80 people by IP address voted on this story first and no other story. I check it against other stories and found that most of the time it is the opposite where 80% of the people that do vote, vote in several different stories as well. I think this proves that there is something fishy going on here but i'm not sure how they would have done it or how I could filter out the artificial votes.
SELECT id, `ip`, COUNT(*) as count FROM `wp_gdsr_votes_log` GROUP BY (`ip` ) ORDER BY `count` ASC
Edit 2
Wow OK, it looks like one of the band members from http://www.mychemicalromance.com/ (rhythm guitarist) posted a link about the article in their twitter and on the bands website. I'm just surprised that there hasn't been a big increase of visitors only people up voting the story..

Maybe it's not a problem at all. Maybe you hit on a story that more people cared enough about to actually vote on.
One thing you might check is the percentage of votes versus traffic as compared to other stories that have similiar traffic.
I read it. Nice story. I voted as well. ;)

You must ensure that your voting is at least establishing a session when they first hit the page, and that the session is still active when they vote. If you're not at least requiring some type of token that you specify, the client could post data to your server all day, spoofing IP addresses and User Agents.
If you're using sessions, or some other type of token access that forces the use of your forms, then it seems, according to the information that you have so far, that the votes are indeed coming from different computers.
Check your web server logs for the referrer to see how they're finding the article.
If you can't prove that a vote is invalid, then I think you have to accept it.

If there's a flaw in your rating system it most likely situated with the form itself. A simple F5/refresh could get multiple votes in if no checking is done. There must at least be a session or userid as well as a unique token you can check against to avoid F5 exploits.

Related

What does Disqus API 'reputation' score mean?

On the Disqus moderation page, you can see each commenter's reputation badge: High Rep, Low Rep, Average, and undefined. If you request the comment data using the Disqus API, it returns a reputation number "reputation":1.233156 instead of the default badges.
What does this reputation number mean? And how does this score translate to badges? Also, how is the score calculated?
(Reference)
Was wondering the same thing, from an API query I saw:
'rep': 3.3011290000000004,
'reputation': 3.3011290000000004,
'reputationLabel': 'High'
On the definitions page it confirms that rep and reputation are the same thing (obvious..)
Here are the descriptions of what it is on the Disqus site.
I looked around, they don't seem to reveal their exact formula for calculating the score but you can guess the nature of it from what it says there: everyone starts at 'average', lots of activity and up-votes makes it 'high' and deleted by moderator, marked as spam, flagged by other users makes it low.
Badges does not seem to be adequately defined anywhere not totally sure what it is but it is possibly something assigned by the moderators or users themselves rather than calculated by the system, the small icons in the usernames here for example.

Account verification: Only 1 account per person

In my community, every user should only have one account.
So I need a solution to verify that the specific account is the only one the user owns. For the time being, I use email verification. But I don't really need the users' email adresses. I just try to prevent multiple accounts per person.
But this doesn't work, of course. People create temporary email addresses or they own several addresses, anyway. So they register using different email addresses and so they get more than one account - which is not allowed.
So I need a better solution than the (easy to circumvent) email verification. By the way, I do not want to use OpenID, Facebook Connect etc.
The requirements:
verification method must be accessible for all users
there should be no costs for the user (at least 1$)
the verification has to be safe (safer than the email approach)
the user should not be demanded to expose too much private details
...
Do you have ideas for good approaches? Thank you very much in advance!
Additional information:
My community is a browser game, namely a soccer manager game. The thing which makes multiple accounts attractive is that users can trade their players. So if you have two accounts, you can buy weak players for excessive prices which no "real" buyer would pay. So your "first account" gets huge amounts of money while the "second account" becomes poor. But you don't have to care: Just create another account to make the first one richer.
You should ask for something more unique than an email. But there is no way to be absolutly sure a player don't own two account.
The IP solution is not a solution, as people playing from a compagny/school/3G will have the same IP. Also, Changing IP is easy (reset the router, proxy, use your 3G vs wifi)
Some web site (job-offer, ...) ask you for an official ID number (ID, passport, social security, driver licence, visa (without the security number, so peolple will feel safe that you won't charge them), ...)
This solution got a few draw back:
minor don't always have an ID / visa
pepole don't like to give away this kind of info. (in fact, depending where you live: in spain for example, it is very common to ask for ID number)
people own more than one visa.
it is possible to generate valide ID/visa number.
Alternative way:
ask for a fee of 1$
to be allow to trade more than X players / spend more than X money.
people that pay the fee got some advantage : less ads, extra players, ...
paying a fee, will limitate creation of multiple account.
fee can be payed using taxed phone number (some compagny provide international system)
the payment medium could be use as an ID (visa number)
put some restriction in new account (like SO).
eg: "you have to play at least 1 hour before trading a player"
eg: "you have to play at least 3 hour before trading more than 3 players"
Use logic to detect multiple account
use cookie to detect multiple account
check last connection time of both player before a transaction. (if player A logout 1 minute before player B login : somethings is going on)
My recommandation :
Use a mix of all thoses methode, but keep the user experience fluide without "form to fill now to continue"
Very interesting question! The basic problem here is multi-part -
Opening an account is trivial (because creating new email IDs is trivial).
But the effect of opening an account in the game is NOT trivial. Opening a new account basically gives you a certain sum of money with which to buy players.
Transferring money to another account is trivial (by trading players).
Combining 1 & 2, you have the problem that new players have an unfair advantage (which they would not have in the real world). This is probably okay, as it drives new users to your site.
However adding 3 to the mix, you have the problem that new players are easily able to transfer their advantage to the old players. This allows old users to game the system, ruining fun for others.
The solution can be removing either 1,2,3.
Remove 1 - This is the part you are focusing on. As others have suggested, this is impossible to do with 100% accuracy. But there are ways that will be good enough, depending on how stringent your criterion for "good enough" is. I think the best compromise is to ask the user for their mobile phone numbers. It's effective and allows you to contact your users in one more way. Another way would be to make your service "invite only" - assuring that there is a well defined "trail" of invites that can uniquely identify users.
Remove 2 - No one has suggested this which is a bit surprising. Don't give new users a bunch of money just for signing up! Make them work for it, similar to raising seed capital in the real world. Does your soccer simulation have social aspects? How about only giving the users money once their "friend" count goes above a certain number (increasing the number of potential investors who will give them money)?
Remove 3 - Someone else has already posted the best solution for this. Adopt an SO like strategy where a new user has to play for 3 hours before they are allowed to transfer players. Or maybe add a "training" stage to your game which forces a new player to prove their worth by making enough money in a simulated environment before they are allowed to play with the real users.
Or any combination of the above! Combined with heuristics like matching IP addresses and looking for suspicious transactions, it is possible to make cheating on the game completely unviable.
Of course a final thing you need to keep in mind is that it is just a game. If someone goes to a lot of trouble just to gain a little bit of advantage in your simulation, they probably deserve to keep it. As long as everyone is having fun!
I know this is probably nothing you have expected, but...
My suggestion would be to discourage people from creating another account by offering some bonus values if they use the same account for a longer period, a kind of loyalty program. For some reason using a new account gives some advantages. Let's eliminate them. There are a lot of smart people here, so if you share more details on the advantages someone could come up with some idea. I am fully convinced this is on-topic on SO though.
We have implemented this by hiding the registration form. Our customers only see the login form where we use their mobile number as username and send the password by text message.
The backend systems match the mobile number to our master customer database which enforces that the mobile number is unique.
Here is an idea:
Store UUID in a cookie at clients. Each user login store the UUID from Cookie in relation to the account entity in the databse.
Do the same with the IP adresses instead of UUID.
After that write a program interface for your game masters that:
Show up different account names but same IP (within last x hours)
Show up different account names but same UUID (nevertheless how long ago)
Highlight datasets from the two point above where actions (like player transfers) happened which can be abused by using multiple accounts
I do not think you should solve that problem by preventing people having two or more accounts. This is not possible and ineffective. Make it easier to find that evil activities and (automatically temporarly) ban these people.
It's impossible to accomplish this with a program.
The closest you can do is to check the ip address. But it can change, and proxies exist.
Then you could get the computer MAC address, but a network card can be changed. And a computer too.
Then, there is one way to do this, but you need to see the people face to face. Hand them a piece of paper with a unique code. They can only subscribe if they have the code.
The most effective solution might be the use of keystroke biometrics. A person can be identified by the way the person writes a sentence.
This company provides a product which can be used to implement your requirements: http://www.psylock.com/en
I think 1 account per email address should be good enough for your needs. After all, account verification doesn't have to end right after signup.
You can publish the IP address of the computer each message was posted from to help your users detect when someone is using multiple accounts from the same computer, and you can use a ranking system to discourage people from using temporary accounts.
Do your game dynamics allow for you to require that both users be online for a trade to occur? If so, you can verify the IP addresses of both users involved in a trade, which would be the same unless the user was paying for multiple internet connections and accessing two accounts from separate machines.
Address the exact scenario that you're saying is a problem.
Keep track of the expected/fair trade value of players and prevent blatantly lope-sided trades, esp. for new accounts. Assume the vast majority of users in your system are non-cheaters.
You can also do things like trickle in funds/points for non-trading actions/automatically overtime, etc.
Have them enter their phone number and send a text message to it. Then, keep a unique of all the cell phone numbers. Most people have one cell phone, and aren't going to ask their friend to borrow it just to create a second account.
http://en.wikipedia.org/wiki/List_of_SMS_gateways
I would suggest an approach using two initiatives:
1) Don't allow brand new accounts to perform trades. Accounts must go through a waiting period and prove that the account is legitimate by performing some non-trade actions.
2) Publicize the fact that cheaters will be disqualified and punished. Periodically perform searches for accounts being used to dump bad players and investigate. Ban/disqualify cheaters and publicize the bans so that people know the rules are being enforced.
No method would be foolproof but the threat of punishment should minimize cheating.
actually you can use fingerprintjs to track every user, use js encrypt the fingerprint in browser and decrypt in server

How to unique referrals so I can prevent users from referring the same person

I want to track unique referrals, something that is not easily cheated.. I'll present a use case to better present my problem:
If I put a link on twitter, and someone clicked the link. I have no way to know that the clicker is unique. Maybe he clicked the link before or maybe he changed his ip by using something like proxy or he's using a wifi that have dynamic ip.
I need a way to find unique users to my system. That is not easily cheated..
There is no way to 100% guarantee the user is unique. Checking for a cookie can be used but it is super easy for a user to delete. Checking IP address is slightly better but as you have already mentioned, it is also fairly easy to get around.
Requiring a user to register before it counts is currently the best way to ensure unique visitors. How solid it is depends on what you require of the user in order to register. Requiring user to validate registration through a code sent in an email greatly helps. Requiring personal information like credit card, ss#, etc.. helps even more, though it depends on your site as to whether you can realistically expect that sort of information from them.
Other than that...sorry, there is no other way. As Brad said, "welcome to the internet" :)

User Fast Switching Ideas Needed

I'm looking for ideas on how to implement some type of fast login scenario for an application that will allow employees to quickly login.
I work with an organization that has employees rotate every 30 minutes to a different location. If there are 3 employees, then the first employee won't come back to the checkout station for an hour. The checkout station is a higher traffic area where different things are borrowed by customers. Right now they have a generic login, but the organization wants to track which employee checked out/in a borrowed item. The problem is when they rotate there are customers there many times and having them logoff and login either via a workstation login or an application login is too slow for customer service.
Any suggestions?
I think a fingerprint reader would work well for logging in users. Then, they wouldn't have to type anything to log in.
There are plenty of biometric SDKs online that should be able to help you with this. And, I think some commercial readers will do something similar already, so you wouldn't even need to write any code.
Here's an article on Microsoft's Upgraded Fingerprint Reader
Also, you can have them scan once to log in, and once they are logged in, they can scan again to get logged completely out of the system (instead of just locking the screen or forgetting to log out and walk away.)
Use an application-level login, but make it only based on typing in their employee ID. This will simply identify who they are, exchanging security for speed while not giving up identity. Using employee ID's for this is a good way of guaranteeing uniqueness. I've seen systems like this work in retail, and it's really fast. Employees get used to typing this number into the console.
I'm not sure if it's in your budget but this sounds like a good use for those little button 1-wire devices. Basically it's an electronic "key" that is about the size of a button and can be read very quickly.
So Employee A goes to the station, puts his button on the pad(takes like 2 seconds) and he's logged in. When he needs to leave he pushes one button to log out, then employee B can come and log in, etc etc.
a picture of the button:

Web store: will customers come back to re-place orders?

Recently a bug in our web store caused the prices to be doubled at checkout. This lead to a drop in orders from about 25 to 2 over a period of 19 hours. We have lost quite some money over this. What I wonder is: is there any way to measure how many of those "dropped" customers will come back and re-place their orders?
If they logged in, their user details. If not, compare IP addresses from your server log, IPs which left without buying during the price doubling, to IPs in the next week, to get a rough idea.
I would say if your product is good your customers will come back. I would say now is a good time to start collecting some analytics on your site. You won't have much to compare to but it would be a place to start. To tell if your customers are coming back you could compare the purchase data from before the issue to after. I would think you'd have some type of userid they would have to either log in with or enter when purchasing. Our sites all require a username to login, we also offer a guest checkout which is just an email address but we could comparisons if we needed to.
A non-programming solution is to offer customers who had the problem some kind of discount or additional product if they finalise their order. This doesn't help you find out how many come back because you are changing the rules, but it will help you lose some of the lost money.
If you have a mailing list, mail out the special offer, else put it up on your website somewhere.
Ask them to fill in the details of the order again, if it matches a previous order in that time period offer them the special deal.