基于邮箱密码认证的虚假账号创建防护问题咨询

1. Why can't the per-IP per-hour limit be set permanently, and why is the default value 100? #

• Permanent limit restriction: Most authentication systems cap this rate limit at 7 days (or similar short windows) for two core reasons:
  • IP address volatility: Public IPs (especially residential ones) get recycled frequently. A permanent limit could accidentally block innocent users who end up with an IP that was previously flagged for malicious activity.
  • Performance overhead: Storing permanent rate limit rules or historical logs would consume unnecessary system resources over time, and managing exceptions for legitimate edge cases becomes far more complex.
• Default value of 100: This is a balanced choice between security and user experience. For normal human users—even active ones—100 requests/actions per hour is more than enough to cover legitimate use cases (like logging in, resetting passwords, or creating accounts if allowed). It’s high enough to avoid frustrating false positives, but low enough to slow down most automated bulk attacks.

2. Is there a feature to allow account creation only from specified email domains, and is it practical? #

Absolutely—this is a standard feature in most enterprise-grade authentication systems, often labeled as "email domain whitelisting" in the provider settings.

It’s extremely practical in several key scenarios:

• Internal company tools: Restrict access exclusively to employees with @yourcompany.com emails, ensuring no external users can register or gain entry.
• Niche communities/educational platforms: Limit sign-ups to specific domains (like @university.edu) to maintain a targeted, trusted user base and cut down on spam accounts.
• Reduced attack surface: Malicious actors struggle to generate large numbers of valid emails from restricted domains, making bulk fake account creation much harder to pull off.

3. Recommended protection against malicious bulk account creation or automated mass requests #

Here are proven, practical strategies to defend against these attacks:

• Advanced CAPTCHA/behavioral verification: Ditch basic image CAPTCHAs—use tools that analyze user behavior (like mouse movement, click patterns) or require interactive challenges (sliding puzzles, object selection). Combine this with device fingerprinting to track repeat offenders across changing IPs.
• Multi-layered rate limiting: Go beyond per-IP limits—add restrictions per device, email domain, or even user behavior (e.g., block requests if someone tries to create 5+ accounts in 10 minutes).
• Mandatory email/phone verification: Require users to verify their contact info before activating their account. Most bulk-created fake accounts use invalid or disposable emails, which won’t pass this check.
• Anomaly detection: Set up alerts for unusual patterns, like a single IP creating 20+ accounts in an hour, or a spike in password reset requests from an unrecognized region. Trigger temporary bans or route these requests to manual review.
• Whitelist controls: For closed systems, restrict sign-ups to pre-approved IP ranges or email domains (building on the feature from question 2).
• Dynamic rate limiting: Adjust limits in real-time based on traffic—if you detect an ongoing attack, temporarily lower the per-IP request cap to slow down the bot network.

内容的提问来源于stack exchange，提问作者Stanislau Buzunko