• Replies 2 replies
  • Subscribers 246 subscribers
  • Views 33 views
  • Users 0 members are here
Related

Mystery "Web Added" patron accounts

Patrick Kelly
$organization

Hi,

So I'm trying to track down the cause of an issue that we have been having which is Mystery accounts.  Every couple of days we end up with an account that was created on the web that has a patrons first and last name (sometimes Jubberish) and email address, but the postal address says "Web Added" and the postal code is 99999. These accounts never have orders and are generally just useless information sitting in our constiuences records. I have read in some forums a similar thing can happen if a patron does not complete the registration process, but I can not seem to recreated this.  It stops me anytime I have not entered information into the required postal information fields, but non of my attempts have resulted in one of these mystery accounts.  Due to the fact that many of the names seem a bit foriegn and the email addresses are often email services I have never heard of my thought thus far is that they may be addresses out side of the U.S. that are not being recognized by the system and then forcing through incomplete accounts.  Has anyone else had this happening and/or have any thoughts on this?

 

Thanks

Parents
  • Former Member
    Former Member $organization
    Hi Patrick
    We had a problem with a bot creating mystery constituents last year too. Rather more than an occasional one though. It was attacking three consortium members eventually. We made a consortium decision that everybody had to put captcha on their registration page, which stopped the problem. 
    Luckily it was a fairly simple-minded bot - always used the same password, used a small number of US cities but paired with Australia as the country,etc, so they were easy to spot and inactivate. Probably just some script kiddie making mischief or testing, rather than a serious attempt at nefarious activity.

    A badly-written script might be able to do what you're describing, and a trap like the one Heather describes, or a captcha service, would be the solution, I think.
    Ken

    Sent from the iPad
    On 18/01/2012, at 7:28, "Heather Kraft" <bounce-@tessituranetwork.com> wrote:

    Hi Patrick -

    We had a problem like that and determined that we were having bots try and create accounts (most likely for nefarious means). We added some behind the scenes checking to our account page which. We added a "jsDetect" blank form field in the registration page. The whole thing is then encoded so it's even less obvious what's going on.

    This is not foolproof... anything that makes things easier for users is also going to make it easier for a hacker, but it at least prevents a simple script from creating users.

    HTH,

    Heather

    From: Patrick Kelly <bounce-patrickkelly5656@tessituranetwork.com>
    Sent: 1/17/2012 2:15:43 PM

    Hi,

    So I'm trying to track down the cause of an issue that we have been having which is Mystery accounts.  Every couple of days we end up with an account that was created on the web that has a patrons first and last name (sometimes Jubberish) and email address, but the postal address says "Web Added" and the postal code is 99999. These accounts never have orders and are generally just useless information sitting in our constiuences records. I have read in some forums a similar thing can happen if a patron does not complete the registration process, but I can not seem to recreated this.  It stops me anytime I have not entered information into the required postal information fields, but non of my attempts have resulted in one of these mystery accounts.  Due to the fact that many of the names seem a bit foriegn and the email addresses are often email services I have never heard of my thought thus far is that they may be addresses out side of the U.S. that are not being recognized by the system and then forcing through incomplete accounts.  Has anyone else had this happening and/or have any thoughts on this?

     

    Thanks




    You were sent this email automatically because you subscribed to the Tessitura Web forum. You may reply to this message to post to the Web forum or visit the site to search, read and post to the forums. In the interest of keeping the forum posts from becoming cluttered, we encourage you to delete previous message text from your reply before sending. Thank you!

    Explore the 2012 season at aco.com.au/season2012

    This email is confidential. If you are not the intended recipient you must not disclose or use the information contained in it. If you have received this email in error please notify us immediately by return email and delete the document. The ACO is not responsible for any changes made to a document other than those made by the ACO or for the effect of the changes on the document's meaning. The ACO accepts no liability for any damage caused by this email or its attachments due to viruses interference, interception, corruption or unauthorised access.
Reply
  • Former Member
    Former Member $organization
    Hi Patrick
    We had a problem with a bot creating mystery constituents last year too. Rather more than an occasional one though. It was attacking three consortium members eventually. We made a consortium decision that everybody had to put captcha on their registration page, which stopped the problem. 
    Luckily it was a fairly simple-minded bot - always used the same password, used a small number of US cities but paired with Australia as the country,etc, so they were easy to spot and inactivate. Probably just some script kiddie making mischief or testing, rather than a serious attempt at nefarious activity.

    A badly-written script might be able to do what you're describing, and a trap like the one Heather describes, or a captcha service, would be the solution, I think.
    Ken

    Sent from the iPad
    On 18/01/2012, at 7:28, "Heather Kraft" <bounce-@tessituranetwork.com> wrote:

    Hi Patrick -

    We had a problem like that and determined that we were having bots try and create accounts (most likely for nefarious means). We added some behind the scenes checking to our account page which. We added a "jsDetect" blank form field in the registration page. The whole thing is then encoded so it's even less obvious what's going on.

    This is not foolproof... anything that makes things easier for users is also going to make it easier for a hacker, but it at least prevents a simple script from creating users.

    HTH,

    Heather

    From: Patrick Kelly <bounce-patrickkelly5656@tessituranetwork.com>
    Sent: 1/17/2012 2:15:43 PM

    Hi,

    So I'm trying to track down the cause of an issue that we have been having which is Mystery accounts.  Every couple of days we end up with an account that was created on the web that has a patrons first and last name (sometimes Jubberish) and email address, but the postal address says "Web Added" and the postal code is 99999. These accounts never have orders and are generally just useless information sitting in our constiuences records. I have read in some forums a similar thing can happen if a patron does not complete the registration process, but I can not seem to recreated this.  It stops me anytime I have not entered information into the required postal information fields, but non of my attempts have resulted in one of these mystery accounts.  Due to the fact that many of the names seem a bit foriegn and the email addresses are often email services I have never heard of my thought thus far is that they may be addresses out side of the U.S. that are not being recognized by the system and then forcing through incomplete accounts.  Has anyone else had this happening and/or have any thoughts on this?

     

    Thanks




    You were sent this email automatically because you subscribed to the Tessitura Web forum. You may reply to this message to post to the Web forum or visit the site to search, read and post to the forums. In the interest of keeping the forum posts from becoming cluttered, we encourage you to delete previous message text from your reply before sending. Thank you!

    Explore the 2012 season at aco.com.au/season2012

    This email is confidential. If you are not the intended recipient you must not disclose or use the information contained in it. If you have received this email in error please notify us immediately by return email and delete the document. The ACO is not responsible for any changes made to a document other than those made by the ACO or for the effect of the changes on the document's meaning. The ACO accepts no liability for any damage caused by this email or its attachments due to viruses interference, interception, corruption or unauthorised access.
Children
No Data