As designed Forum is blocking registrations based on StopforumSpam username matches

[Vekseid]

Affected version

2.0.12

I consider this to be a bug, personally, because out of several million signup attempts on my main forum (SMF), and over a million on the one I host Xenforo on, not once has a username match caught something that wasn't also caught in an email or ip match.

Meanwhile, SFS will proudly flag rather common usernames - in my most recent case on Blue Moon, 'karma'.

When my now Xenforo board was on MyBB, and of course with my SMF forum, this isn't a problem, because both of these integrations let me turn off username matching. This isn't an option in Xenforo, and I have to manually approve a user who had some word for a name that some spammer in SFS's history also happened to use.

Currently, I need to manually correct a user about once a week.

 

[Ozzy47]

Increase the Moderate registrations when this many warning flags are detected setting and the Reject registrations when this many warning flags are detected

 

[Vekseid]

Increase the Moderate registrations when this many warning flags are detected setting and the Reject registrations when this many warning flags are detected

I have.

 

[Ozzy47]

Then perhaps adjust, Only count flags recorded at least this many times:

 

[Brad Padgett]

@Vekseid I just disabled mine. It was doing this exact same type thing for me and I don't use stopforumspam anymore. Only because it does reject viable registrations and is pointless in my opinion

 

[Vekseid]

@Vekseid I just disabled mine. It was doing this exact same type thing for me and I don't use stopforumspam anymore. Only because it does reject viable registrations and is pointless in my opinion

It is a great help once this username nonsense is discounted, like every single open source implementation allows for. My mod team wouldn't need to ask me as many questions, and genuine humans wouldn't need me to review their application before being able to do stuff.

 

[djbaxter]

As @ozzy47 said above, do this:



That way, if the only block is on name, a quick click on Approve solves the problem and no one is actually rejected unless they match on name, email, and IP.

 

[Vekseid]

As @ozzy47 said above, do this:

That way, if the only block is on name, a quick click on Approve solves the problem and no one is actually rejected unless they match on name, email, and IP.

As I already replied to @ozzy47, I have already done this.

I get username hits in the double digits regularly, and my window is only 7 days. I had to approve something like twenty members the day after I converted from MyBB, and made conservative changes accordingly.

I should not have to do this. I did not need to do this in MyBB. I do not need to do this on my SMF or Elkarte forums.

 

[djbaxter]

As I already replied to @ozzy47, I have already done this.

I get username hits in the double digits regularly, and my window is only 7 days. I had to approve something like twenty members the day after I converted from MyBB, and made conservative changes accordingly.

I should not have to do this. I did not need to do this in MyBB. I do not need to do this on my SMF or Elkarte forums.

All right. Then don't screen registrations at all. You'll leave yourself open to having to do more work on spam management but that's your choice.

 

[Vekseid]

All right. Then don't screen registrations at all. You'll leave yourself open to having to do more work on spam management but that's your choice.

I have no idea what you are trying to say here, other than to be condescending.

 

[djbaxter]

I'm not trying to be condescending at all.

It's not a bug. It's by design.

You have been given options around it. You don't like those options.

You really only have two choices:

1. screen registrations to minimize spam; or
2. don't screen registrations and then deal with extra (and IMO unnecessary) spam.

My experience has been that screening takes less time in the long run but that's up to you.

 

[Brad Padgett]

If you use a question and answer capatcha and the question has to do with the category or "niche" so to say of your forum then it blocks bots much better. Also email confirmations. Won't block them all but does a much better job or at least I'm hearing that it really does work. Either that or you could opt. for an add-on that helped you block bots. There are a couple floating out there. I think one by @Xon that I saw but haven't bought

 

[djbaxter]

Currently, I need to manually correct a user about once a week.

Once a week doesn't seem onerous to me.

I get username hits in the double digits regularly, and my window is only 7 days. I had to approve something like twenty members the day after I converted from MyBB, and made conservative changes accordingly.

But now it's only once a week?

 

[Vekseid]

If you use a question and answer capatcha and the question has to do with the category or "niche" so to say of your forum then it blocks bots much better. Also email confirmations. Won't block them all but does a much better job or at least I'm hearing that it really does work. Either that or you could opt. for an add-on that helped you block bots. There are a couple floating out there. I think one by @Xon that I saw but haven't bought

I run two of the world's largest forums. I am here because my smaller 'big' forum caused MyBB to collapse under its own weight. On a 1270v3 with 32 gigs of RAM. i am plenty familiar with how to deal with spammers in general.

Once a week doesn't seem onerous to me.

But now it's only once a week?

Yes.

I'm not so detached that I don't care about the experience of my individual members. I would like to see it improved where possible.

All I am asking is that Xenforo bring its implementation up to the par set by open source implementations written over a decade ago. As you can see above, I'm not the only person with this issue, others just turn it off because it's a mess.

I could write my own 'addon' to correct this, but it feels like patching someone else's bug.

 

[Chris D]

You're not alone in this feedback and we are aware of it. FWIW we get a lot of username flags here and they are nearly all genuine spammers, but it does seem the mileage may vary.

We are tracking this suggestion here:

spam management flags - allow which warning flags to detect

I'm using the stopforumspam database but it only allows you to choose how many warning flags before moderating or rejecting. Can we choose which warning flag(s) to detect before moderating or rejecting? 1 flag isn't a good option because username can very easily return false positives but...

xenforo.com

But for now, this is working as it is designed to.

 

[Alpha1]

SFS is extremely effective if you can turn off username hits. If not then its best turned off because it will affect innocent people.

You will particularly notice this on a large board with a significant number of registrations. Because boards with a lot of accounts will gain more complex usernames. The simpler account names will be taken. And if 1 in 100 people will be wrongfully banned from registration, then its not something you will notice if you have 50 registrations per month, but its much easier to notice if you have thousands of registrations and keep an eye on such things.

This seems to be where mileage varies in many cases.