To catch a sock puppet...

LSPoorEeyorick · 10-12-2006, 12:21 PM

Anybody have experience with identifying them?

Any ideas about checking/identifying anonymizer IPs?

Alex · 10-12-2006, 12:29 PM

You won't be able to track someone using an anonymizer IP service. However, if they were logged in to something, they probably weren't using one (most of the anonymizer services can't maintain cookies and session headers).

LSPoorEeyorick · 10-12-2006, 12:38 PM

If the sockpuppet isn't using an anonymizer, is there another way they could mask an IP so that they would be able to log in and post?

Alex · 10-12-2006, 01:19 PM

Mask an IP? No, not even the anonymizers do that. An IP has to be revealed to your server for every transaction otherwise there would be no way for it to send information back to the user. It would be like getting mail without a return address.

The way anonymizers work is that they act as a middle man for the traffic. User tells anonymizer to get page A, anonymizer requests it, gets it, and then passes it along to user. So from the Web sites perspective the anonymizer is the user.

The other factor is static vs. dynamic IP addresses and this is what makes it hard to catch the intelligent sock puppet. I have cable for my internet and therefore have a static IP address assigned specifically to me. So everytime I've been on the internet for the last 18 months it has been with the same IP address.

Dial-up users and most DSL users, however, get a new IP address at the beginning of every session. So a smart sock puppet will use different sessions for different activities so that the IP addresses will be different. Or go so far as to use completely different computers (say only posting as the sock puppet from work while as themselves from home or using a library computer for one of the identities).

If you don't have direct IP matches, you generally can only build a circumstantial case against a sock puppet. For example, if they are just logging out of their DSL and then back in, both sets of IP addresses might resolve to a pool of IP addresses owned by a Cincinnatti ISP. Posting styles may be similar (maybe they both always misspell the same word). They gave the same birthdates when registering, etc., etc.

But if they continue to deny it and nobody knows the people personally, it will always boil down to a circumstantial case without absolute certainty.

Mary Poppins · 10-12-2006, 01:25 PM

And pray tell, miss LS, why would one want to catch a.. what do you call them?... Sock Puppet ?

As if that sort of thing exists around here. Pshaw !

Alex · 10-12-2006, 01:34 PM

And then when that circumstantial case is very strong they'll say it is their [husband|sister|mom|dog|son] posting from the same computer.

Moonliner · 10-12-2006, 01:37 PM

IP's ain't what they used to be.

To start with most people still have a dynamic IP address which means that each time they login it's probable they are using a unique IP address. Add in work, home, public terminals, wireless access sites, etc.. and a users IP address does not mean much.

Your best bet would be to try and identify the individual PC and that's what cookies are for and even then you can only prove that the same PC was used for multiple accounts, not the same person.

LSPoorEeyorick · 10-12-2006, 01:42 PM

How exactly would one identify the PC with cookies? I guess I don't have a lot of experience with this kind of thing.

And, no, Mary, I'm not looking to ensnare any LoTters. I moderate another message board.

Alex · 10-12-2006, 01:59 PM

The way vBulletin (and most message boards work) is that when you log in several cookies are created that allow you to maintain session without constantly logging in every time you want to post, for example.

When you log out, those are all deleted to be recreated the next time you log in.

But they don't have to be. They could just be written and left on your computer until some defined expiration date. This is how online advertising networks work. When you visit site A, the cookie is written to your computer and when you later visit site B the cookie is seen and reported back to the advertising network. So they know that you visited both Site A and Site B.

So, you could track a single computer sock puppet by making a persistent cookie.

When they log in as User A:

If cookie-x does not exist, create it including Username A. If it does exist, add Username A to cookie and report to server all Usernames listed in cookie.

Then they log in as User B:

If cookie-x does not exist, create it including Username B. If it does exist, add Username B to cookie and report to server all Usernames listed in cookie.

The result of this is that you would know that User A and User B had logged in from the same physical computer. But your software probably does not have any inbuilt ability to do this and a hack would have to be put together to implement it.

But this wouldn't help if they are posting from different computers as different people or if they can make a legitimate claim that someone in the house is posting as well.

LSPoorEeyorick · 10-12-2006, 02:27 PM

Thanks, guys.

We don't actually have standard software... it's created from scratch. But I will pass this along to our coder and look into it.

I appreciate the help!

10-12-2006, 12:21 PM	#1
LSPoorEeyorick scribblin' Join Date: Jan 2005 Location: in the moment Posts: 3,872	To catch a sock puppet... Anybody have experience with identifying them? Any ideas about checking/identifying anonymizer IPs? Last edited by LSPoorEeyorick : 10-12-2006 at 12:28 PM.
	Submit to Quotes

10-12-2006, 12:29 PM	#2
Alex . Join Date: Feb 2005 Posts: 13,354	You won't be able to track someone using an anonymizer IP service. However, if they were logged in to something, they probably weren't using one (most of the anonymizer services can't maintain cookies and session headers).
	Submit to Quotes

10-12-2006, 12:38 PM	#3
LSPoorEeyorick scribblin' Join Date: Jan 2005 Location: in the moment Posts: 3,872	If the sockpuppet isn't using an anonymizer, is there another way they could mask an IP so that they would be able to log in and post?
	Submit to Quotes

10-12-2006, 01:19 PM	#4
Alex . Join Date: Feb 2005 Posts: 13,354	Mask an IP? No, not even the anonymizers do that. An IP has to be revealed to your server for every transaction otherwise there would be no way for it to send information back to the user. It would be like getting mail without a return address. The way anonymizers work is that they act as a middle man for the traffic. User tells anonymizer to get page A, anonymizer requests it, gets it, and then passes it along to user. So from the Web sites perspective the anonymizer is the user. The other factor is static vs. dynamic IP addresses and this is what makes it hard to catch the intelligent sock puppet. I have cable for my internet and therefore have a static IP address assigned specifically to me. So everytime I've been on the internet for the last 18 months it has been with the same IP address. Dial-up users and most DSL users, however, get a new IP address at the beginning of every session. So a smart sock puppet will use different sessions for different activities so that the IP addresses will be different. Or go so far as to use completely different computers (say only posting as the sock puppet from work while as themselves from home or using a library computer for one of the identities). If you don't have direct IP matches, you generally can only build a circumstantial case against a sock puppet. For example, if they are just logging out of their DSL and then back in, both sets of IP addresses might resolve to a pool of IP addresses owned by a Cincinnatti ISP. Posting styles may be similar (maybe they both always misspell the same word). They gave the same birthdates when registering, etc., etc. But if they continue to deny it and nobody knows the people personally, it will always boil down to a circumstantial case without absolute certainty.
	Submit to Quotes

10-12-2006, 01:25 PM	#5
Mary Poppins Junior Member Join Date: Jan 2005 Location: London Posts: 18	And pray tell, miss LS, why would one want to catch a.. what do you call them?... Sock Puppet ? As if that sort of thing exists around here. Pshaw !
	Submit to Quotes

10-12-2006, 01:34 PM	#6
Alex . Join Date: Feb 2005 Posts: 13,354	And then when that circumstantial case is very strong they'll say it is their [husband\|sister\|mom\|dog\|son] posting from the same computer.
	Submit to Quotes

10-12-2006, 01:37 PM	#7
Moonliner 8/30/14 - Disneyland -10k or Bust. Join Date: Jan 2005 Posts: 9,022	IP's ain't what they used to be. To start with most people still have a dynamic IP address which means that each time they login it's probable they are using a unique IP address. Add in work, home, public terminals, wireless access sites, etc.. and a users IP address does not mean much. Your best bet would be to try and identify the individual PC and that's what cookies are for and even then you can only prove that the same PC was used for multiple accounts, not the same person. __________________ - Taking it one step at a time.
	Submit to Quotes

10-12-2006, 01:42 PM	#8
LSPoorEeyorick scribblin' Join Date: Jan 2005 Location: in the moment Posts: 3,872	How exactly would one identify the PC with cookies? I guess I don't have a lot of experience with this kind of thing. And, no, Mary, I'm not looking to ensnare any LoTters. I moderate another message board.
	Submit to Quotes

10-12-2006, 01:59 PM	#9
Alex . Join Date: Feb 2005 Posts: 13,354	The way vBulletin (and most message boards work) is that when you log in several cookies are created that allow you to maintain session without constantly logging in every time you want to post, for example. When you log out, those are all deleted to be recreated the next time you log in. But they don't have to be. They could just be written and left on your computer until some defined expiration date. This is how online advertising networks work. When you visit site A, the cookie is written to your computer and when you later visit site B the cookie is seen and reported back to the advertising network. So they know that you visited both Site A and Site B. So, you could track a single computer sock puppet by making a persistent cookie. When they log in as User A: If cookie-x does not exist, create it including Username A. If it does exist, add Username A to cookie and report to server all Usernames listed in cookie. Then they log in as User B: If cookie-x does not exist, create it including Username B. If it does exist, add Username B to cookie and report to server all Usernames listed in cookie. The result of this is that you would know that User A and User B had logged in from the same physical computer. But your software probably does not have any inbuilt ability to do this and a hack would have to be put together to implement it. But this wouldn't help if they are posting from different computers as different people or if they can make a legitimate claim that someone in the house is posting as well.
	Submit to Quotes

10-12-2006, 02:27 PM	#10
LSPoorEeyorick scribblin' Join Date: Jan 2005 Location: in the moment Posts: 3,872	Thanks, guys. We don't actually have standard software... it's created from scratch. But I will pass this along to our coder and look into it. I appreciate the help!
	Submit to Quotes