Account verification: Only 1 account per person

Question

In my community, every user should only have one account.

So I need a solution to verify that the specific account is the only one the user owns. For the time being, I use email verification. But I don't really need the users' email adresses. I just try to prevent multiple accounts per person.

But this doesn't work, of course. People create temporary email addresses or they own several addresses, anyway. So they register using different email addresses and so they get more than one account - which is not allowed.

So I need a better solution than the (easy to circumvent) email verification. By the way, I do not want to use OpenID, Facebook Connect etc.

The requirements:

• verification method must be accessible for all users
• there should be no costs for the user (at least 1$)
• the verification has to be safe (safer than the email approach)
• the user should not be demanded to expose too much private details
• ...

Do you have ideas for good approaches? Thank you very much in advance!

Additional information:

My community is a browser game, namely a soccer manager game. The thing which makes multiple accounts attractive is that users can trade their players. So if you have two accounts, you can buy weak players for excessive prices which no "real" buyer would pay. So your "first account" gets huge amounts of money while the "second account" becomes poor. But you don't have to care: Just create another account to make the first one richer.

Answer 1

I think 1 account per email address should be good enough for your needs. After all, account verification doesn't have to end right after signup.

You can publish the IP address of the computer each message was posted from to help your users detect when someone is using multiple accounts from the same computer, and you can use a ranking system to discourage people from using temporary accounts.

Answer 2

We have implemented this by hiding the registration form. Our customers only see the login form where we use their mobile number as username and send the password by text message.

The backend systems match the mobile number to our master customer database which enforces that the mobile number is unique.

Answer 3

The most effective solution might be the use of keystroke biometrics. A person can be identified by the way the person writes a sentence.

This company provides a product which can be used to implement your requirements: http://www.psylock.com/en

Answer 4

actually you can use fingerprintjs to track every user, use js encrypt the fingerprint in browser and decrypt in server

Answer 5

Here is an idea:

• Store UUID in a cookie at clients. Each user login store the UUID from Cookie in relation to the account entity in the databse.
• Do the same with the IP adresses instead of UUID.

After that write a program interface for your game masters that:

• Show up different account names but same IP (within last x hours)
• Show up different account names but same UUID (nevertheless how long ago)
• Highlight datasets from the two point above where actions (like player transfers) happened which can be abused by using multiple accounts

I do not think you should solve that problem by preventing people having two or more accounts. This is not possible and ineffective. Make it easier to find that evil activities and (automatically temporarly) ban these people.

Answer 6

Have them enter their phone number and send a text message to it. Then, keep a unique of all the cell phone numbers. Most people have one cell phone, and aren't going to ask their friend to borrow it just to create a second account.

http://en.wikipedia.org/wiki/List_of_SMS_gateways