The largest problem facing the site today is the flood of terrible questions coming in, mostly from new user accounts. I've mentioned this before, but I suspect that some of the worst of this is due to people who have created multiple throwaway accounts to evade question bans and other limits. Others create fake sock puppet accounts to vote for themselves, and the vast majority of voting fraud seems to take place in order to circumvent question bans and other quality safeguards.
In recent discussions, there have been comments that it's time for Stack Overflow to be more restrictive towards new user accounts. At first, you didn't even have to register to post a question, but complaints about hit-and-run askers led to a change. I think it might be worth exploring what could be done next, if anything.
I strongly believe that placing a reputation requirement on asking a first question would be a disaster for the site, for reasons I describe here. People would spam non-answers and trash until they could game their way into posting a question, and vote fraud would run rampant. You think the 100+ non-answers a day we see now due to the 50-rep comment threshold are bad? Wait until you can't ask questions below some rep threshold.
So Stack Overflow needs to make it possible for a legitimate new user to ask a question without any previous posts on the site. With that as a restriction, how can "legitimate" accounts be determined?
An obvious first step would be to prevent the use of throwaway email providers for new accounts. In my experience, there's a very high correlation between people using sharklasers.com, mailinator.com, yopmail.com, etc. addresses and bad behavior (question-ban evasion, trolling, and sock puppetry). That seems like low-hanging fruit.
However, that's only a small fraction of the fake accounts I encounter. Almost all of them are created using Gmail or other legitimate mail hosts, often even using the mail host of the company the puppet operators work for. Moderators commonly trace people based on patterns of how they create email addresses, but these patterns don't seem easy for a machine to pick out. There are the obvious cases (an account using [email protected] voting for an account using [email protected]), but again those might only be obvious to a human looking at them.
The recent locking of accounts deleted as trolls or spammers has really helped to prevent re-use of credentials. I still think that should be expanded to accounts deleted as sock puppets, but it at least blocks common cases of credential re-use.
IP-based restrictions are already used, but they're tricky to get right. Many, many public-facing IP addresses have dozens to hundreds of Stack Overflow users associated with them. That makes it difficult to associate a new fake account with the existing original, even if they are on the same IP. However, I have started tagging question-ban evasion accounts as trolls when deleting them in order to block near-future posts from that location. It has been effective at stopping more persistent ban evaders, but I worry about people getting hit in the crossfire with that. There might be a way to leverage more intelligence here.
Requiring some kind of two-factor authentication for new user signups has been suggested, but is this something that would work across the world? Would it be effective at slowing the creation of these new accounts? What form would this take?
I don't have any great solutions for this, and it's a topic that has come up recently, so I thought I'd start a discussion about this. Do you think there should be additional restrictions on the creation of new accounts, and if so, what should they be?
For now, I'm asking here due to the unique challenges faced by this site and because I can only speak to my own experience as a moderator here. I also figure that Stack Overflow has a number of people with experience in this area that might be able to provide useful suggestions.