🇬🇧 STRENGTHENING ACCOUNT MANAGEMENT
In summary:
- Automated assistance for moderators to filter out fake sign-up requests,
- Automated cleanup of ghost accounts,
- Automated deletion of accounts inactive for > 3 years after reminder emails.
Our policies have been updated to reflect these changes!
Fake accounts and bots are a plague. Across the Fediverse—and on Mastodon in particular—we regularly face waves of suspicious sign-ups, yet we are poorly equipped and lack the right tools to deal with them.
We already use Anubis to filter out bots, but that isn't enough.
That’s why I built a simple decision-support tool for our moderators: a single web page summarizing all pending sign-up requests. For each request, it provides a risk score based on IP address reputation, email domain risk, language consistency, and a few other indicators. Moderators can review all of this information and approve or reject requests directly from the same page.
This dashboard is now live for Mastodon, and I will gradually add all our other Fediverse applications whenever their APIs allow it.
However, some fake accounts still slip through—or already have. For instance, we see "ghost accounts" that, once registered, have zero activity, no profile information, nothing at all. My tool will now handle them and automatically delete them after one month if they remain inactive. One might think these accounts are harmless, yet they skew our statistics and pose a dormant threat if they turn out to be bots waiting to wake up all at once.
On our instance, roughly 20% of accounts are ghost accounts. Just imagine: the situation is almost certainly the same on other servers, which adds up to a massive number of accounts overall...
Finally, there are accounts that have been abandoned or inactive for three years. These users will receive three reminder emails prompting them to log back in to avoid automatic account deletion. It might serve as a friendly nudge to come back and check us out. Otherwise, this cleanup is good digital hygiene that also supports privacy protection and GDPR compliance.
We have roughly the same percentage of abandoned accounts. Here too, the same likely holds true for most other servers.
For the time being, account deletions are running in dry-run mode, but they will go live in the coming weeks. We want to make sure the system doesn't get carried away, especially since there are a few subtleties in the data returned by Mastodon’s APIs. Be careful if you plan to go down the same path!
These measures will lower our total account count, but they will improve platform hygiene and security for everyone's benefit. I wish all servers would do the same—it would make the Fediverse much more resilient.
I’ll consider open-sourcing the project if there’s interest. In the meantime, here is an (anonymized) screenshot of the moderation dashboard.
