How to implement a friction-less auth

Question

I'm kinda new to coding and developing a very simple two-player board game and need guidance in how to design the auth system. Right now I have a normal username+password auth wall for a registered users only queue and a guest system for non registered users that mints a guest account when someone not logged in queues. I'm happy with the friction-less this provides but I'm not so happy with anyone being able to spam either my guest creation endpoint or my username+pwd signup.I love sites that offer either functional guests or fast non-email signups, but I don't know how to prevent someone from creating fake accounts and making the matchmaking awful besides rate limiting, but as the expected pool of legitimate players is small, any trivial amount of fake accounts (10s) can severely impact the queues.I know, I know, "0 users" and "just put something out there", but I really enjoy the back-and-forth of the design and implementation, just a bit lost here so any guidance on what to do, but scoped to the small stakes of the project, would be much appreciated.

gojkoa · Accepted Answer

Adding "sign in with google" and "sign in with apple" (especially google with FedCM) gives you auth with the least amount of friction you can get, since they end up being one-click events for most users.Having said that, none of this prevents people from creating fake accounts. On our system I can see people regularly signin in with multiple google accounts, with incrementing digits in the name, trying to abuse the free tier. You'll need to build something yourself for that, depending on your risk surface. For us this involves tracking requests across IP addresses, blocking free access from data centre IPs, blocking bots using AWS WAF, analyzing task patterns to spot people who use multiple residential IPs and a bit more.

verdverm · Answer

use oauth buttons, it's a single click for users with apple/google (i.e.)
there are several auth SaaS providers you could look to for inspiration or adoption
tl;dr - clicking a few buttons at prompts is much less effort (and more commonplace) than unam+pword

How to implement a friction-less auth

use oauth buttons, it's a single click for users with apple/google (i.e.)there are several auth SaaS providers you could look to for inspiration or adoptiontl;dr - clicking a few buttons at prompts is much less effort (and more commonplace) than unam+pword

use oauth buttons, it's a single click for users with apple/google (i.e.)
there are several auth SaaS providers you could look to for inspiration or adoption
tl;dr - clicking a few buttons at prompts is much less effort (and more commonplace) than unam+pword