[ARCHIVED] Spam Users

[caroline_foley]

In order to run online on-demand courses for non-students, we have to enable open registration. This makes us vulnerable to spam users and, since March, we have been attacked repeatedly with spam user accounts. They don't do anything in Canvas, just create accounts.

When we reached out to Canvas, besides disabling open registration (which isn't an option for us), they provided no other solutions. There was a similar spam issue with Catalog and a CAPTCHA has now been implemented there. It's possible that a CAPTCHA could be added to the log in page as well, but it is not definite and there is no project completion date for it.

I was wondering if anyone else has been this issue with spam users recently. If so, has anyone come up with a workaround to prevent more spam users? I know it might be a no go but figured I'd throw it out there to folks that might be better coders than I am!

Thanks!

[natacha_hes]

We are experiencing this issue too - 100s of fake accounts daily!! Caroline please let me know if you find a workaround!

Would love a solution like this one https://community.canvaslms.com/ideas/17303-recaptcha-option-in-self-registration?sr=search&searchId... 

[caroline_foley]

Yes! I would love a ReCaptcha option! Our Canvas Customer Success rep said that they recently added ReCaptcha for Catalog and it **might** be added to the registration page as well. I'm hoping that this is a feature that they add soon!

[caroline_foley]

Oh! One more tip until ReCaptcha is added: Canvas support will remove the users for you. If we're hit with a small amount of fake accounts, I remove them myself, but, when we're hit with 10,000s of fake accounts, I put in a support ticket for it and they'll remove it. It's a lower priority ticket compared to other needs, but they'll do it!

[dgrobani]

We're in the same situation. I wrote a Python script that identifies all users created since the last time the script was run and checks them for an SIS ID and enrollments. Users with neither get deleted.

[caroline_foley]

Thanks so much for sharing, dgrobani! Do you think this script could help others or is it specific to your institution? And, if it's the former, would you be willing to share more?! 

[dgrobani]

@caroline_foley, apologies for the delay in replying. Unfortunately, unless you have experience with running Python scripts against the Canvas API, I don't think my rough script will help you.

[caroline_foley]

Thanks for the update! I know a bit of Java and Javascript, but sadly no Python for me. Yet...!

[Tasha_Biesinger]

@caroline_foley Do you have ePortfolios enabled in your Canvas account? If so, you may want to check whether these spam accounts are creating ePortfolios. We and other institutions have found ePortfolios associated with these no-enrollment spam accounts that are peddling goods or other things that are against our Acceptable Use policy. If you have this issue, and your normal users aren't using the ePortfolio feature, your Canvas CSM should be able to turn off ePortfolios. 

[caroline_foley]

Thanks for sharing, @Tasha_Biesinger ! Canvas Support had mentioned this issue with ePortfolios. So far, these spam users haven't seemed to try to access it yet though. Famous last words!

[dgrobani · Accepted solution]

Now available: reCAPTCHA for Canvas Self Registration

[caroline_foley]

Thanks for sharing! I found out about this from support a couple of days ago but didn't have a chance to update here yet. You beat me to it!