@MastodonEngineering

Please for the love of God put the captcha before the first email is send.

And please also make it configurable to put a manual approval before the fist email is send, since captchas are circumvented today for fractions of a cent.

It would be great if the signup process generated a random verification code that users must write on paper and photograph. This would allow us to verify that accounts are not created by AIs, residential proxies, or malicious bots in general.

@m @MastodonEngineering The suggestion in your last paragraph would make signing up hard to impossible for users with visual disabilities or motor disabilities, while (as someone else mentioned) being of dubious usefulness against subscription spam. Please keep #accessibility #a11y in mind when suggesting solutions.

@pauamma @MastodonEngineering

Please read https://lgbtqia.space/@m/117320713582769721

Please provide a alternative that makes AI signups more detectable or keep your criticism. Criticism is cheap and does mean nothing if you cannot come up with a single solution instead.

As it looks currently mastodon signups don't work at all because you cannot differentiate between a human and a bot.
And this is the most terrible solution.

@m @pauamma @MastodonEngineering "make a better suggestion or shut up" is not how you talk to people who point out massive accessibility problems. That's massively disrespectful.

@ratsnakegames @pauamma @MastodonEngineering

"I don't care about your problems enough but your solution is shit" is not how you make the world a better place, It is massively disrespectful to only destroy the attempts to make something better without providing anything at all on energy to solve the problem by oneself.

@m @pauamma @MastodonEngineering And for the record, the alternative to your weird captcha approach is to just not do anything. Giving admins some more work in reviewing and blocking bot signups is preferrable to pushing disabled people off your platform.

@ratsnakegames @pauamma

"Let the admins and mods that work for free have more work because fuck them and they are beneath my energy to come up with a better solution.

... and you have the audacity speaking to me about what is "massively disrespectful"

@m @pauamma @MastodonEngineering for what it's worth, disabled people being frustrated and hampered by capcha is a fairly common thing, I find another common concern I've heard from other disabled people is that our accessibility needs are ignored and requests for accessibility treated as nuisances

I know admins are getting swamped and having to do even more with than they normally do, but it would be sad to see people rush to solve it by tromping over the needs of disabled people as happens far too often

@m @MastodonEngineering I'm confused. Do you not believe that AIs can write numbers on a piece of paper? I believe the opposition is a bit underestimated.

We'll have to be a little more innovative than that.

@shanie @MastodonEngineering

First of all it increase cost.
And than you can detect these AI images with quite high precision and reliability.

This is not about the numbers on the paper, it is about the pixel data itself, the code is just a tool to make it impossible to use a single image over and over again

@MastodonEngineering
Here are some ideas:
1. Account creation should only be done by the instance not apps
2. Accounts cannot be created without confirming email first
3. Emails that are not on popular services (e.g. gmail, hotmail, yahoo etc) should prompt a difficult captcha to solve even before verification is sent

@samir 2. is already there. The problem with this particular spam wave is that they are using Mastodon servers to flood people's inboxes. The point isn't the mastodon account, it's sending the e-mail. https://en.wikipedia.org/wiki/Email_bomb

@gunchleoc @samir this thread / post is specifically about #bpSpam - not saying all the other conversations about spam in general aren't valid, but the OP is about a specific, novel activity that spams third parties via Mastodon account creation.

@jaz @gunchleoc
To be honest Jaz, I don't understand why apps are allowed to register users
It's not a lot of friction to ask users to register directly on the instance then connect the app
I am sure the bp spam will try the instance directly but at least you can have more control on the instance

@samir @gunchleoc l'll offer a few things in response.

I want an open social web. More friction is bad friction.

Many people expect "the app". They live on their phones. They are mobile-first.

There are a ton of industry standard mitigations that can be applied. Spam is an old problem. Most of this can be mitigated with a mix of time and money. We ask a lot from a very small, overworked team struggling to fund itself.

#GoodNotPerfect needs to be more acceptable to the community at large.

@jaz @gunchleoc I agree 💯 but moving the registration to the insurance instead of API doesn't mean the app is locked out of the process. You just kick the user to the browser or use a webview in the app but the instance is in full control of registration (not the app)
Yes the UI will be different but most users won't even realize what's happening under the hood

@gunchleoc
Regarding email spam, you can throttle email confirmation down to make it useless for them.

Also #3 goes hand in hand with #2 to prevent using own mail server

@samir @MastodonEngineering most of the spam accounts I got have gmail adresses. Blocking gmail drastically reduced spam

@joshix @MastodonEngineering I guess it would also stop people registering lol

So these bots have valid Gmail accounts?

@MastodonEngineering Thanks for raising this, we're dealing with the same wave of spam signups on our side. We tested a soft captcha at registration, but it doesn't trigger reliably every time, so we still end up manually blocking somewhere between one and five accounts a day regardless. We also tried a hard captcha on every signup, it does cut down spam, but it noticeably discourages real people from registering too, so it's not really a clean tradeoff either.

What we're running now is a different approach on the server side, a local model that runs on a schedule every couple of hours and checks new accounts for spam signals. If something looks off, the account gets frozen, and then once a day we manually review whether it's a real person or a bot and unlock or remove accordingly.

Not a perfect solution, but it's keeping things manageable for now. Good luck to everyone dealing with this.

@MastodonEngineering What is their goal anyway? What's the point of the spam?

@jackemled Subscription bombing https://en.wikipedia.org/wiki/Email_bomb

@gunchleoc That would explain the name. I wonder why the target would be every single fediverse server though.

@jackemled @gunchleoc

there doesn't have to be an agenda behind it. although there could be

some people just destroy for giggles

@benroyce There's money in it, it's a service you can sell to scammers. The point is not to notice that "somebody logged into your account" e-mail in between the flood of 2000 pointless e-mails.

Somebody dug out the service that is selling this attack but I can't find that post any more.

@jackemled

@jackemled @MastodonEngineering There's a good article on it here: https://ingo.lantschner.name/post/2026-09-18_mailrelay-mastodon/

It's in German, but Firefox does a good job of translation to English

@MastodonEngineering

How about a mandatory default to "No Open Enrollments"?

Like, you know, @Mastodon dot Social

Oh...

Last Checked: 2026-09-23 06:01

Signups Open: Yes

I see...

Here: https://mastodon.fediverse.observer/mastodon.social

#Mastodon #BPSpam #OpenEnrollment

@FinchHaven @MastodonEngineering @Mastodon I'm relatively certain that is in fact the default at install, along with a warning before allowing new account creation.

Very few of these spam campaigns federate across the network, they tend to be a local problem, so if you have the tooling and/or staff to deal with it...

@jaz @FinchHaven @MastodonEngineering @Mastodon

Yeah, v4.2.8 changed the default to being manual approval for new installs: https://github.com/mastodon/mastodon/releases/tag/v4.2.8

@MastodonEngineering
Basic features such as being able to specify username rules as patterns and an admin UI to manage client applications would go a long way.