How can I recognize a banned user trying to sneak their way back in after wiping the basic, standard traces - new account, cookies wiped, IP address changed (and of course different email at registration time)?
Are there some automated tools/plugins for "fingerprinting" visitors in order to recognize concealed return? Is there some way to keep record of banned users to look for hints on new accounts that they are in fact a returning troll?
For every technological approach you can come up with, a determined user can come up with a way to evade it -- new browser, security/privacy-related browser plugins, fake credentials, and so on. I think this is an area where you do the basics that are easy and routine, but it's not worth investing heavily.
That leaves the behavioral side. If the new user repeats the behaviors that got the first account banned, it won't be long before you ban that one too. He might come back a third time and you do the dance again, but in my experience, eventually they get tired of it and go away. (I think my worst case was about six accounts. I understand that it can be worse on large sites, though large sites may have more moderators to carry the load.) Further, certain types of bad behavior, like rudeness, tend to stand out, so once you see such behavior from a new user you can start paying closer attention to that user.
If the bad behavior doesn't continue, if the new account is not objectionable other than having been created to evade a ban, then the harm being done is that he "won", but he's not harming the site any more. That rankles, but if it stopped the bad behavior maybe you can live with it anyway.
Actually, everything that you use to track someone can be cleared or changed. There are just some not-so-standard things you can try:
In agreement with everyone else in that there is no fool-proof way to accomplish what you are asking for.
That said, the best you can do is to consistently implement checks for small things you might notice as the undesired behavior is being carried out.
For example, in the typical forum or community scenario, most "bad actor" users trying to get around a ban will still be located in a geographically similar region. Their dynamic IP typically comes from their ISP, and all of their unique IPs would typically map to the same region.
In the past, we've created a process which geocodes the users IP. Then we build queries/reports where you query the IP of any banned users, then join to all other users based on similar IP... at first you would look at matches for the first three blocks of the IP... e.g. join on the IP minus the last chunk after the last ., and include a join condition where the non-banned accounts are created after the ban occurred.
The banned user might have had IP 123.456.79.65, and you might find several more users registered after the ban with ips matching, e.g. 123.456.79.xx or whatever.
Put these into a review queue for your admins or moderators to review.
The key is to have a good communication loop between the people reviewing potential matches and the dev team - so that the processes can be fine-tuned over time.
It could be accomplished if we implement a feature that restricts banned user to log out and lock the account preventing them from changing password or other user information. However, this only works if the user uses the same browser. My guess is that tech savvy users would only use a second browser to create a new account.
It could be a start even if the method described above is somewhat questionable from an Information Security and ethical point of view.
