How are "socks" (banned posters with new pseudonyms) discovered?

[wheresmymind]

Mods: Not sure where it's appropriate to ask this question, please move it to the correct forum if need be. Also, I realize that for obvious reasons the mods might not want to answer this question. If this question is inappropriate, feel free to close it right away.

I've pondered this question before, but was reminded of it by some things that were said in this thread about zombies. When I notice someone who is "BANNED" while I'm reading through old threads, I'll sometimes search their history for the offending posts for fun. It's like rubbernecking at a car crash, you just can't look away. Anyway, sometimes there is no juicy "offending" series of posts (booo!), and the poster is just quietly disappeared for apparently no reason. Now obviously, I know the mods on this site don't ban people without good reason, reasons that may not be apparent to someone only reading their posts. It's really none of my business, and I accept that.

I understand that one of the reasons can be that the poster was a "sock," that is, someone who was already banned, only to return with a new pseudonym.

I'm curious as to how the powers that be determine if someone is a "sock?" I assume it starts with someone saying "hmm, ABC seems to be the same kind of jerk that XYZ was." But how can you be even 50% certain that the same person is behind the new name? I suppose you could cross-reference personal details they've dropped about themselves ("Well, IRL both seem to be gay born-again Christian plumbers from rural Arkansas who like Futurama fanfic and are active in SCA. Probably aren't too many people that applies to.") But it could take over a year for someone to casually mention that much personal information about themselves, especially if they were even remotely worried about their identity being discovered. Also, it seems this approach would take a lot of investigative effort. So how are socks discovered?

...and, um, I swear I'm not a sock...

[hajario]

1. See if you can compare IP addresses. If they match, you might have a sock.

2. Read the snackpit for clues.

[Idle Thoughts]

Going to move this to ATMB.

[user_hostile]

Originally Posted by hajario

1. See if you can compare IP addresses. If they match, you might have a sock.

2. Read the snackpit for clues.

What about the case of a DHCP?

[Lord Feldon]

I can't speak for the SDMB, but on a board I'm a moderator on, they mainly out themselves by being conspicuously similar to the "old" poster.

[Rhythmdvl]

Are there automated tools that compare IPs and usernames and highlight duplicates? If not, is it because few messageboards prohibit socks or is it technically tricky?

[sandra_nz]

I used to run a vBulletin board and it definitely captured IP addresses.

[pseudotriton ruber ruber]

The thing I don't understand about it is why I haven't been banned. Seriously. I get my IP, which constantly changes, through my university, and I've often referred my students to one thread or other on the SD. How can they tell it's a different person, and not me under a new username?

[sandra_nz]

<deleted, misunderstood>

[Telemark]

Originally Posted by pseudotriton ruber ruber

The thing I don't understand about it is why I haven't been banned. Seriously. I get my IP, which constantly changes, through my university, and I've often referred my students to one thread or other on the SD. How can they tell it's a different person, and not me under a new username?

Because there's no reason to look at your posts with the intent of identifying a sock. It's only a tool to help identify socks once you suspect there is something to investigate.

[What the .... ?!?!]

Are there any stats available on bannings and the reason?

[hajario]

Originally Posted by user_hostile

What about the case of a DHCP?

You can check if the first three digits of the IP match or if the IPs are from the same provider but then you would probably need more evidence to be sure.

Even if the sock uses a totally different proxy each time, they often aren't smart enough to hide certain patterns. If they really seem like they're a sock, and the IPs are from a selection of obvious proxies, that can clue one in as well.

[Cheesesteak]

Originally Posted by Telemark

Because there's no reason to look at your posts with the intent of identifying a sock.

... until now.

[kayaker]

I've seen posters (unaware they are in violation of the rules) mention that they have multiple names.

[C K Dexter Haven]

There are a number of techniques, and we're not going to discuss or reveal them all. Why give people ideas on how to evade the rules? The bottom line is that unwashed socks start to smell after a while, and thus become detectible.

[TubaDiva]

To quote from John Prine: "You are who you are and you ain't what you ain't."

Now that doesn't mean that we can't be fooled -- because we can and have been and doubtless will be again -- but ultimately who you are becomes evident.

Not sure if stats on bannings are available and not sure if they would be relevant even so as the system does not differentiate between the reasons for bannings. So someone banned for socking and someone banned for spamming, it's all the same. We do have far, far more banned spammers than offenders for other reasons and actuallyl these days bannings for causes that are not spammers are not so frequent.

[hajario]

Originally Posted by C K Dexter Haven

There are a number of techniques, and we're not going to discuss or reveal them all. Why give people ideas on how to evade the rules? The bottom line is that unwashed socks start to smell after a while, and thus become detectible.

Oh c'mon, Dex, it's not like there's anything that hasn't been mentioned so far at least in a general sense. The good socks don't get caught because they hide their tracks well. It's impossible to say how many there are.

The bad ones are caught because they are suspicious and a little bit of research verifies the truth. That is some combination of information revealed by IP locations, patterns in writing style and matching of personal information revealed either here or elsewhere on the net like in blogs. Sometimes you're lucky and the Nonnies do the research for you.

[Darth Panda]

Are people with dissociative identity disorder allowed to have mutiple accounts?

[Czarcasm]

Originally Posted by Darth Panda

Are people with dissociative identity disorder allowed to have mutiple accounts?

Can they prove that:
1. They have no way of knowing each other's passwords, and
2. That it would be impossible to change personalities in the middle of posting?

[Lemur866]

Thing is, if you're such an asshole that you get yourself banned, and then start another sock account, you're probably still an asshole. If you could stop being an asshole to not draw attention to your sock account, why couldn't you stop being an asshole the first time and not get yourself banned?

So the problem for a sock puppeteer is that almost by definition they can't stop themselves from acting like an asshole, which means they're going to annoy people, which means they'll come to the attention of the administration, and they'll do a few of their secret tests (hint: they compare your IP to the IP of previously banned assholes), and then they get banned.

[Doug K.]

Originally Posted by hajario

You can check if the first three digits of the IP match or if the IPs are from the same provider but then you would probably need more evidence to be sure.

Even if the sock uses a totally different proxy each time, they often aren't smart enough to hide certain patterns. If they really seem like they're a sock, and the IPs are from a selection of obvious proxies, that can clue one in as well.

I work for a small public school district. With the exception of a handful of machines, the IP of every device on our network is hidden by NAT. The end result is we have hundreds of computers that appear to the outside world to have the same IP. So seeing the same IP is no guarantee it's coming from the same computer.

[Chronos]

So the problem for a sock puppeteer is that almost by definition they can't stop themselves from acting like an asshole, which means they're going to annoy people, which means they'll come to the attention of the administration, and they'll do a few of their secret tests (hint: they compare your IP to the IP of previously banned assholes), and then they get banned.

The super-secret tests don't even necessarily have to come back positive. Often, a previously-banned poster will come back and immediately do something else that would be ban-worthy in its own right.

And then there are those who seem to want to be caught. Many socks use a consistent pattern for all of their usernames. One I remember registered 26 usernames in a row, one for each letter of the alphabet. Another one always had a metal in its username. Other times, they'll jump right back into the threads they were in before and continue the conversation (if it can be called that) as though nothing had ever happened.

[Lemur866]

Originally Posted by Doug K.

I work for a small public school district. With the exception of a handful of machines, the IP of every device on our network is hidden by NAT. The end result is we have hundreds of computers that appear to the outside world to have the same IP. So seeing the same IP is no guarantee it's coming from the same computer.

And this is why they don't routinely sweep the membership lists to see if two users have the same IP number, and if they do, ban them both. We have plenty of cases where two members live together and use the same computer, and this is not a problem. They only bother to check a user's IP if someone comes to their attention as a troublemaker.

[Lukeinva]

Getting banned from an internet discussion board is truly lame. That's like being refused access to the bathroom at a gas station.

[hajario]

Originally Posted by Doug K.

I work for a small public school district. With the exception of a handful of machines, the IP of every device on our network is hidden by NAT. The end result is we have hundreds of computers that appear to the outside world to have the same IP. So seeing the same IP is no guarantee it's coming from the same computer.

Obviously. Two users could also have the same IP if they live in the same house or if they both post from the same smartphone using the same carrier in the same city. The same IP is not proof positive but it's a very good indication if other patterns are there.

[ZipperJJ]

Originally Posted by hajario

Obviously. Two users could also have the same IP if they live in the same house or if they both post from the same smartphone using the same carrier in the same city. The same IP is not proof positive but it's a very good indication if other patterns are there.

That's why the board software doesn't automatically ban people trying to log in from the same IP with a different username.

[hajario]

Originally Posted by ZipperJJ

That's why the board software doesn't automatically ban people trying to log in from the same IP with a different username.

I don't know if that's even possible with standard vB. What can happen is that an Admin can block an IP address or a range of IP addresses. People who are on one of those won't even be able to read the board.

[Blaster Master]

Originally Posted by Lemur866

Thing is, if you're such an asshole that you get yourself banned, and then start another sock account, you're probably still an asshole. If you could stop being an asshole to not draw attention to your sock account, why couldn't you stop being an asshole the first time and not get yourself banned?

So the problem for a sock puppeteer is that almost by definition they can't stop themselves from acting like an asshole, which means they're going to annoy people, which means they'll come to the attention of the administration, and they'll do a few of their secret tests (hint: they compare your IP to the IP of previously banned assholes), and then they get banned.

I was going to say pretty much the same thing. Someone doesn't get banned for occassionally being a jerk or obnoxious, but usually from repeat behavior. They then usually come back and either repeat the behavior because they just can't really stop or because they deliberately want to prove something or come back deliberately to troll. I imagine those cases are pretty easy to pick out.

If the person is legitimately different, they seem to be harder to pick out, I only recall ever seeing a few long term socks banned, but it's probably difficult to make any sort of judgment about how many of them there actually are because, well, if they can't be traced back because they're acting legitimately different, we're not going to find them, and if they are legitimately contributing now, how much does it really matter anymore?

[Lynn Bodoni]

Originally Posted by Lemur866

Thing is, if you're such an asshole that you get yourself banned, and then start another sock account, you're probably still an asshole. If you could stop being an asshole to not draw attention to your sock account, why couldn't you stop being an asshole the first time and not get yourself banned?

So the problem for a sock puppeteer is that almost by definition they can't stop themselves from acting like an asshole, which means they're going to annoy people, which means they'll come to the attention of the administration, and they'll do a few of their secret tests (hint: they compare your IP to the IP of previously banned assholes), and then they get banned.

Dammit, our secret is out!

It's true, if a sock could refrain from acting in whatever way got him/her banned in the first place, it's possible that the staff would never notice the footwear. Maybe even likely.

[TubaDiva]

Originally Posted by Doug K.

I work for a small public school district. With the exception of a handful of machines, the IP of every device on our network is hidden by NAT. The end result is we have hundreds of computers that appear to the outside world to have the same IP. So seeing the same IP is no guarantee it's coming from the same computer.

Yep. This is sometimes a problem and we end up IP blocking an entire something -- a department, a company, a building, a school -- when it's just one jerk.

We do try not to block innocent people but sometimes it happens. We're usually able to sort out the situation and make it right.

[billfish678]

Originally Posted by Lynn Bodoni

Dammit, our secret is out!

It's true, if a sock could refrain from acting in whatever way got him/her banned in the first place, it's possible that the staff would never notice the footwear. Maybe even likely.

Usual progression. Poster, bad poster, banned poster, comes back as sock. Gets caught or not caught but still banned again eventually. Wonder how many of these there are? Good poster, creates sock once in awhile. Sock gets banned. "Good poster" remains. Kinda a Dr Jekyl/Mr Hide poster rather than degenerating asshole poster.

[Doug K.]

Originally Posted by billfish678

Usual progression. Poster, bad poster, banned poster, comes back as sock. Gets caught or not caught but still banned again eventually. Wonder how many of these there are? Good poster, creates sock once in awhile. Sock gets banned. "Good poster" remains. Kinda a Dr Jekyl/Mr Hide poster rather than degenerating asshole poster.

I can think of a couple of scenarios, one hypothetical and probably unlikely, and one that has happened at least a few times, that don't end in banning.

Poster creates sock, posts as sock once or twice, but doesn't cause any trouble, then abandons sock and never gets caught.

Past poster wants to return but forgot username or password. Creates sock but is upfront about it. Admin patiently explains what poster should have done, then merges new account with old account.

[billfish678]

Originally Posted by Doug K.

Past poster wants to return but forgot username or password. Creates sock but is upfront about it. Admin patiently explains what poster should have done, then merges new account with old account.

I did that. Had the 90 day or whatever it was freebee back when you HAD to pay to stay long term. It expired. A good while later I came back in as a "guest" when I found out it could be free, explained it to the powers that be and they merged names ala THE FLY or changed my past posts ala Stalanistic Russia or something like that.

[Chronos]

Usual progression. Poster, bad poster, banned poster, comes back as sock. Gets caught or not caught but still banned again eventually. Wonder how many of these there are? Good poster, creates sock once in awhile. Sock gets banned. "Good poster" remains. Kinda a Dr Jekyl/Mr Hide poster rather than degenerating asshole poster.

Probably not as common as you think. That alphabet sock I mentioned bragged under several of its other names that it was actually a prolific and well-respected poster, and that everyone would be shocked and amazed when we found out who it actually was. Well, eventually, it got impatient, and confessed under its "established" name. Whereupon everyone responded with "Who are you again? Do we know you?".

[billfish678]

Now thats funny.

[Siam Sam]

I was an unintentional sock. In my earlier, naive days, I did not realize it might not be a good idea to use your real name as my user name and so registered like that. Later I realized my mistake and reupped as Siam Sam, then forgot about that first incarnation. Then one day the Dope police caught up with me in the form of an e-mail telling me I'd been discovered and that I could not post under this name anymore. I told them my mistake, and those earlier messages were all changed to my present user name. I still don't know what tipped them off.

[Rhythmdvl]

Originally Posted by billfish678

I did that. Had the 90 day or whatever it was freebee back when you HAD to pay to stay long term. It expired. A good while later I came back in as a "guest" when I found out it could be free, explained it to the powers that be and they merged names ala THE FLY or changed my past posts ala Stalanistic Russia or something like that.

Brundlefish!

[samclem]

Originally Posted by hajario

Obviously. Two users could also have the same IP if they live in the same house or if they both post from the same smartphone using the same carrier in the same city. The same IP is not proof positive but it's a very good indication if other patterns are there.

Originally Posted by ZipperJJ

That's why the board software doesn't automatically ban people trying to log in from the same IP with a different username.

This is all true. We hav more sophisticated software vB now. It merely tells us that another user with the same computer has posted. Usually, it's a SO. We pick up on that rather quickly and ignore it. If it's a returnee, it's rather obvious.

[Autolycus]

I can quite easily imagine somebody creating a sock merely to enjoy the pleasure of posting with two different personas.

Of course, in this case, they would have to be very careful to avoid posting something with the wrong account that would blow their cover and expose their footwear, so to speak.

Regards,
Shodan

[user_hostile]

What is the recidivism rate for banned-to-socks?

[TubaDiva]

Originally Posted by Autolycus

I can quite easily imagine somebody creating a sock merely to enjoy the pleasure of posting with two different personas.

Of course, in this case, they would have to be very careful to avoid posting something with the wrong account that would blow their cover and expose their footwear, so to speak.

Regards,
Shodan

We've caught a few that way. It's hard work being someone besides yourself and attention to detail is crucial.

[TubaDiva]

PS My favorites is when we get socks that get into the same thread and argue with one another. It does make you wonder about multiple personalities, if such a thing really existed. Apparently it can on the internet!

[John DiFool]

Originally Posted by Autolycus

I can quite easily imagine somebody creating a sock merely to enjoy the pleasure of posting with two different personas.

Of course, in this case, they would have to be very careful to avoid posting something with the wrong account that would blow their cover and expose their footwear, so to speak.

Regards,
Shodan

I saw what you did there, Auto.

Here is a thread which might shed further light on the sock mentality.

[mlees]

Originally Posted by samclem

This is all true. We hav more sophisticated software vB now. It merely tells us that another user with the same computer has posted. Usually, it's a SO. We pick up on that rather quickly and ignore it. If it's a returnee, it's rather obvious.

Does the software also notify you of the opposite?

I post from both work and home computers (with different IP addresses, and probably different Internet Service Providers). So it looks like two seperate people posting to the same account/name.

[twickster]

Originally Posted by mlees

Does the software also notify you of the opposite?

I post from both work and home computers (with different IP addresses, and probably different Internet Service Providers). So it looks like two seperate people posting to the same account/name.

Nope -- as long as you're legitimately signed in from both machines, that's not a problem. (What a nightmare if it were flagged! I think the people who don't sign in from multiple devices/locations are in the minority.)

[Chronos]

I'm sure the software could notify of that, but why bother? It's not indicative of breaking any rules.

[Colibri]

Originally Posted by mlees

I post from both work and home computers (with different IP addresses, and probably different Internet Service Providers). So it looks like two seperate people posting to the same account/name.

Actually, it looks like one person logging in from two different machines.

I post regularly from at least four different computers. Using my laptop, I'm sure I have posted from from dozens of different IPs in six different countries in the past year.

[hajario]

Originally Posted by samclem

This is all true. We hav more sophisticated software vB now. It merely tells us that another user with the same computer has posted. Usually, it's a SO. We pick up on that rather quickly and ignore it. If it's a returnee, it's rather obvious.

If it's an IP from a home internet service and the last user that used it was just banned two weeks ago, you can pretty safely say that it's a sock.

If the IP is from a Starbucks in London or the Verizon network in San Francisco, it's probably two different legitimate users.

Despite what Dex claimed upthread, there aren't any high level secret things that haven't been revealed. Most socks just aren't smart enough to hide their tracks or simply don't care and are easily found. There are probably quite a few who are smart enough and, obviously, it's impossible to say how many of them that there are.

[Morgenstern]

I imagine the join date and the number of posts is a big clue if there is an investigation.

[etv78]

Originally Posted by TubaDiva

We've caught a few that way. It's hard work being someone besides yourself and attention to detail is crucial.

IMO it's not that hard to masquerade, but it's probably easier on niche boards.