8

How can I recognize a banned user trying to sneak their way back in after wiping the basic, standard traces - new account, cookies wiped, IP address changed (and of course different email at registration time)?

Are there some automated tools/plugins for "fingerprinting" visitors in order to recognize concealed return? Is there some way to keep record of banned users to look for hints on new accounts that they are in fact a returning troll?

1
6

For every technological approach you can come up with, a determined user can come up with a way to evade it -- new browser, security/privacy-related browser plugins, fake credentials, and so on. I think this is an area where you do the basics that are easy and routine, but it's not worth investing heavily.

That leaves the behavioral side. If the new user repeats the behaviors that got the first account banned, it won't be long before you ban that one too. He might come back a third time and you do the dance again, but in my experience, eventually they get tired of it and go away. (I think my worst case was about six accounts. I understand that it can be worse on large sites, though large sites may have more moderators to carry the load.) Further, certain types of bad behavior, like rudeness, tend to stand out, so once you see such behavior from a new user you can start paying closer attention to that user.

If the bad behavior doesn't continue, if the new account is not objectionable other than having been created to evade a ban, then the harm being done is that he "won", but he's not harming the site any more. That rankles, but if it stopped the bad behavior maybe you can live with it anyway.

2
  • While every method of fingerprinting can be evaded, there are so many that if you use an obscure one enough, and the user does not know it, it may take them absolutely unreasonable amount of time and effort to hide that particular set of tracks. Moreover, if you use several such methods in parallel, the user must disable all of them at once. Disabling them one by one won't help, as while they hide from method B, they appear on method A's radar again.
    – SF.
    Jul 31 '14 at 13:54
  • 1
    This is the answer. Don't sweat, just keep acting like you've always acted. Chances are, the new account will do the same things that got him banned in the first place. And if he doesn't, you just got a new, good, user!
    – Seth
    Jul 31 '14 at 14:37
3

Actually, everything that you use to track someone can be cleared or changed. There are just some not-so-standard things you can try:

  • Browser fingerprinting (with this tool for example). Note that this data can be easily changed by using an add-on such as FireGloves.
  • Evercookie. This tool stores some data at many places, so it's hard to clear. Note that people can block files with the name evercookie.js using an add-on such as AdBlock Plus, so perhaps you should give the file a different name. Note that the data using this tool can still be cleared, it just takes longer and is more difficult.
3
  • 1
    I had to go look how to clear the Evercookie. To help others I found directions for Chrome and Firefox. Chrome, Firefox, helpful article from Ars Technica
    – Andy
    Jul 31 '14 at 14:08
  • Serious abusers will easily find a way around this. For example, by using a new virtual machine with a VPN with standard Firefox plugins each time.
    – Underverse
    Mar 19 '17 at 11:56
  • @Underverse Indeed. There is no single technical way that can ban a person permanently. You can, however, make it harder.
    – ProgramFOX
    Mar 19 '17 at 12:37
1

In agreement with everyone else in that there is no fool-proof way to accomplish what you are asking for.

That said, the best you can do is to consistently implement checks for small things you might notice as the undesired behavior is being carried out.

For example, in the typical forum or community scenario, most "bad actor" users trying to get around a ban will still be located in a geographically similar region. Their dynamic IP typically comes from their ISP, and all of their unique IPs would typically map to the same region.

In the past, we've created a process which geocodes the users IP. Then we build queries/reports where you query the IP of any banned users, then join to all other users based on similar IP... at first you would look at matches for the first three blocks of the IP... e.g. join on the IP minus the last chunk after the last ., and include a join condition where the non-banned accounts are created after the ban occurred.

The banned user might have had IP 123.456.79.65, and you might find several more users registered after the ban with ips matching, e.g. 123.456.79.xx or whatever.

Put these into a review queue for your admins or moderators to review.

The key is to have a good communication loop between the people reviewing potential matches and the dev team - so that the processes can be fine-tuned over time.

0

It could be accomplished if we implement a feature that restricts banned user to log out and lock the account preventing them from changing password or other user information. However, this only works if the user uses the same browser. My guess is that tech savvy users would only use a second browser to create a new account.

It could be a start even if the method described above is somewhat questionable from an Information Security and ethical point of view.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.