How are "socks" (banned posters with new pseudonyms) discovered?

Mods: Not sure where it’s appropriate to ask this question, please move it to the correct forum if need be. Also, I realize that for obvious reasons the mods might not want to answer this question. If this question is inappropriate, feel free to close it right away.

I’ve pondered this question before, but was reminded of it by some things that were said in this thread about zombies. When I notice someone who is “BANNED” while I’m reading through old threads, I’ll sometimes search their history for the offending posts for fun. It’s like rubbernecking at a car crash, you just can’t look away. Anyway, sometimes there is no juicy “offending” series of posts (booo!), and the poster is just quietly disappeared for apparently no reason. Now obviously, I know the mods on this site don’t ban people without good reason, reasons that may not be apparent to someone only reading their posts. It’s really none of my business, and I accept that.

I understand that one of the reasons can be that the poster was a “sock,” that is, someone who was already banned, only to return with a new pseudonym.

I’m curious as to how the powers that be determine if someone is a “sock?” I assume it starts with someone saying “hmm, ABC seems to be the same kind of jerk that XYZ was.” But how can you be even 50% certain that the same person is behind the new name? I suppose you could cross-reference personal details they’ve dropped about themselves (“Well, IRL both seem to be gay born-again Christian plumbers from rural Arkansas who like Futurama fanfic and are active in SCA. Probably aren’t too many people that applies to.”) But it could take over a year for someone to casually mention that much personal information about themselves, especially if they were even remotely worried about their identity being discovered. Also, it seems this approach would take a lot of investigative effort. So how are socks discovered?

…and, um, I swear I’m not a sock…:smiley:

  1. See if you can compare IP addresses. If they match, you might have a sock.

  2. Read the snackpit for clues.

Going to move this to ATMB.

What about the case of a DHCP?

I can’t speak for the SDMB, but on a board I’m a moderator on, they mainly out themselves by being conspicuously similar to the “old” poster.

Are there automated tools that compare IPs and usernames and highlight duplicates? If not, is it because few messageboards prohibit socks or is it technically tricky?

I used to run a vBulletin board and it definitely captured IP addresses.

The thing I don’t understand about it is why I haven’t been banned. Seriously. I get my IP, which constantly changes, through my university, and I’ve often referred my students to one thread or other on the SD. How can they tell it’s a different person, and not me under a new username?

<deleted, misunderstood>

Because there’s no reason to look at your posts with the intent of identifying a sock. It’s only a tool to help identify socks once you suspect there is something to investigate.

Are there any stats available on bannings and the reason?

You can check if the first three digits of the IP match or if the IPs are from the same provider but then you would probably need more evidence to be sure.

Even if the sock uses a totally different proxy each time, they often aren’t smart enough to hide certain patterns. If they really seem like they’re a sock, and the IPs are from a selection of obvious proxies, that can clue one in as well.

… until now.

:dubious:

I’ve seen posters (unaware they are in violation of the rules) mention that they have multiple names.

There are a number of techniques, and we’re not going to discuss or reveal them all. Why give people ideas on how to evade the rules? The bottom line is that unwashed socks start to smell after a while, and thus become detectible.

To quote from John Prine: “You are who you are and you ain’t what you ain’t.”

Now that doesn’t mean that we can’t be fooled – because we can and have been and doubtless will be again – but ultimately who you are becomes evident.

Not sure if stats on bannings are available and not sure if they would be relevant even so as the system does not differentiate between the reasons for bannings. So someone banned for socking and someone banned for spamming, it’s all the same. We do have far, far more banned spammers than offenders for other reasons and actuallyl these days bannings for causes that are not spammers are not so frequent.

Oh c’mon, Dex, it’s not like there’s anything that hasn’t been mentioned so far at least in a general sense. The good socks don’t get caught because they hide their tracks well. It’s impossible to say how many there are.

The bad ones are caught because they are suspicious and a little bit of research verifies the truth. That is some combination of information revealed by IP locations, patterns in writing style and matching of personal information revealed either here or elsewhere on the net like in blogs. Sometimes you’re lucky and the Nonnies do the research for you.

Are people with dissociative identity disorder allowed to have mutiple accounts?

Can they prove that:

  1. They have no way of knowing each other’s passwords, and
  2. That it would be impossible to change personalities in the middle of posting?

Thing is, if you’re such an asshole that you get yourself banned, and then start another sock account, you’re probably still an asshole. If you could stop being an asshole to not draw attention to your sock account, why couldn’t you stop being an asshole the first time and not get yourself banned?

So the problem for a sock puppeteer is that almost by definition they can’t stop themselves from acting like an asshole, which means they’re going to annoy people, which means they’ll come to the attention of the administration, and they’ll do a few of their secret tests (hint: they compare your IP to the IP of previously banned assholes), and then they get banned.