What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

There isn't any good way to definitively identify puppets. Quite often, it takes a lot of effort to bring your certainty up above 80%, and IMHO even that's not good enough to merge accounts.

I'd suggest adding the ability to "fingerprint" a user's browser instance/machine in the mod tools section. An example of how this can work can be found at http://panopticlick.eff.org

I don't think it would be reasonable to do this on every request for every user, as it would require lots of code, schema updates and other nonsense. I would request that a mod be able to indicate on a user that they would like the system to record some specific information about the user the next time that user visits. That information can be stored for comparison later. I wrote a story about it, like to read it here it goes:

  • A mod, having sniffed something dirty, roots around and identifies two users, one who appears to be a sock, the other appearing to be the puppeteer.
  • The mod annotates the puppeteer: "I believe this user has a sock [link to the sock's account]"
  • The mod goes into each account, clicks the Mod link and selects "Fingerprint this user's next request"
    enter image description here
  • The mod goes on their merry way

After a couple days, the mod checks back and sees that both users have returned, and both have been fingerprinted.

  • The mod opens each user's account page in a different tab
  • The mod clicks the Mod link, selects the Info tab, and selects the "Fingerprint" link enter image description here
  • The mod then compares the information in the fingerprint, determining if both users have been using the same browser on the same machine.

Is it perfect? Hell no. Obviously, if two users share the same machine and use the same browser they'll still appear to be the same person. But it will give us more information, which will help us make better decisions.

share|improve this question
    
Whaaaa? Panopticlick manages to get my installed fonts? Now that's a giveaway. –  Pëkka Nov 23 '11 at 21:28
1  
resists urge to add Feature Request:... to title... –  JNK Nov 23 '11 at 21:30
3  
Ah, so have hide a sock-puppet, all I have to do is boot off my live-cd in a VM and use a proxy. No problem... –  Zoredache Nov 23 '11 at 21:53
4  
@zoredache I'd wager 99% of puppet masters are morons. If you're smart enough to pull that, you're smart enough not to need to. –  Won't Nov 24 '11 at 3:14
    
@BrockAdams, having your system setup to report almost nothing is also somewhat of a fingerprint, even if a burned off fingerprint is not conclusive. –  Kortuk Jul 21 '12 at 4:08

4 Answers 4

The road to hell is paved with good intentions. There is absolutely no good reason, not even to sniff out sock puppets, that Stack Exchange should be:

  1. Giving this type of access to non-employees who do not act as legal representatives of Stack Exchange, Inc.
  2. Doing this in the first place

The purpose of Panopticlick is to highlight how big of a security and privacy hole this is in current browsers, not to outline a way for sites to uniquely track people. If anything, Stack Exchange should be doing everything in its power to prevent this type of unique tracking, despite how easy it is to get it.

Is rooting out sock puppets hard? Yes, it is. That's the nature of the beast. Stack Exchange is a Q&A site, albeit a very good one with great quality. It's not Big Brother, and sock puppets are not an issue of national security that requires exploiting a privacy hole in browsers.

And despite being difficult to definitively identify a sock puppet, Stack Exchange does fine. There is no problem so large right now (or arguably, ever) that necessitates going down this path.

share|improve this answer
7  
It can still be a fingerprint without actually knowing the raw browser data. i.e. certain key headers are chosen and compared but not revealed, that data remains opaque, all we know is how many indicators matched. There is no problem so large right now (or arguably, ever) that necessitates going down this path - maybe not on PSE. The sock puppet takedown I did last week had about eight socks, it took me about an hour and a half to analyse the data. Having extra data as opaque fingerprints could help reduce this amount of time. –  The Anti-Santa Nov 23 '11 at 21:50
2  
+1 @Kev - You don't know how big the sock puppet problem is by its very nature. –  JNK Nov 23 '11 at 21:55
2  
I agree with @Kev. I'm against actively exploiting security holes, no doubt. But I don't see anything unethical in having a generic fingerprint (that is broadcast anyway all the time) that helps determine if two users are using the same browser. I think the problem is big, the more SO grows and the more important (to a degree) reputation becomes in the industry –  Pëkka Nov 23 '11 at 21:56
6  
@Kev Do you seriously believe sock puppets are a crippling pandemic to Stack Overflow? That Stack Overflow would've come crashing down had you not spent the hour and half analyzing those eight? Yes, it's difficult and time consuming to find them, and we as moderators don't do it with certainty. But despite that, Stack Overflow still runs, and is still considered to be a bastion of quality. The world doesn't end if the sock puppet problem isn't solved and this "feature" isn't implemented. –  user149432 Nov 23 '11 at 22:08
3  
@Mark it's not a crippling pandemic, but sock puppetry is a bit like counterfeit money. It undermines trust in the system; it's a slow poison to a community and should be fought, even when it is not big enough to be a mortal danger to it. –  Pëkka Nov 23 '11 at 22:11
3  
It's part of our roles as mods to close down socks, users flag them often when they smell a rat, why not make the tools more sophisticated to allow us to detect and shut down more easily. Why should a minority of users get away with artificially inflating their rep to ask more crap questions and waste the community's time. After all, we do have a sockpuppet upvoting option in the private message mod tool, so it's enough of a problem if it's necessary to have that particular option, and trust me, it's used a lot. –  The Anti-Santa Nov 23 '11 at 22:16
3  
it's a shift in how Stack Exchange views the privacy of its users. - there is no "reveal" of that data, all that's being created is a fingerprint. –  The Anti-Santa Nov 23 '11 at 22:18
3  
Panopticlick is being used by Will as an example, the actual implementation can be different, probably would have to be. If it's a case of fingerprinting or comparing data that's already in the W3SVC logs but without actually revealing this to us as mods then it's hardly the egregious breach of privacy you make it out to be. That data is already being collected. Now if we started pushing "evercookies" to enable this then I'd be pretty pissed off. –  The Anti-Santa Nov 23 '11 at 22:55
3  
@Kev If SE is collecting personally identifiable information beyond the user profile and IP address, or rather, uses that information to uniquely identify its visitors, it's in violation of its own privacy policy. At a minimum, if this feature were implemented, the privacy policy would have to be amended. –  user149432 Nov 23 '11 at 23:02
3  
I'll have to -1 this. Mods have access to much more personally identifiable information than what's being proposed. Think about, a mod can easily find and contact a user outside of this site with the information they have access to. A "browser-fingerprint" doesn't tell anything about the user besides the browser they are using. Also the privacy policy states that SE collects this kind of information. –  NullUserException อ_อ Nov 24 '11 at 0:14
3  
Wow. Also, wow. And wow. And wow again. I'd put this in the "way to overreact" bucket. Okay, maybe I could eff up your life by knowing what fonts are installed on your machine, but I think this fact (and all the others that could possibly be gathered by remote methods) is pretty inconsequential. If we could use it to reduce the likelihood we screw up your experience here, I think you would be willing to fingerprint you. Or, we could just screw up your SO experience and merge you with the next guy who shares your IP. –  Won't Nov 24 '11 at 2:54
3  
@ಠ_ಠWon't Or, you could do what we've been doing for as long as I can remember (and what you yourself have said is the best option): suspending, not merging or doing any other non-undoable action unless we're absolutely sure it's a 100% match given the information we're privy to. You've set up a false dilemma: it's not "Either we get this or people get screwed by moderators incorrectly merging accounts". We have tools and policies to handle sockpuppetry, they're just not as efficient as you might want them to be. I'd rather sockpuppets get suspended than SE pull something like this. –  user149432 Nov 24 '11 at 2:59
4  
@ಠ_ಠWon't 1) The information collected as a whole uniquely identifies a browser: that's the whole point. If the fingerprint didn't uniquely identify a user, you wouldn't be asking for it. 2) The issue is consent: it doesn't matter what mundane information is used to create it: the end result is a unique identifier I did not consent to. I consented to providing my real name and my picture. I tacitly consented to providing my IP. I did not consent to SE actively recording my browser configuration for the purposes of uniquely identifying me outside of the information I explicitly volunteered. –  user149432 Nov 24 '11 at 5:40
4  
@NullUserExceptionอ_อ I think you don't understand what the concept of PII is: "Personally Identifiable Information (PII), as used in information security, is information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual." That's exactly what this feature request is for. The fingerprint is meant to uniquely identify an individual for the purposes of figuring out if they have sockpuppets. –  user149432 Nov 24 '11 at 19:32
3  
@NullUserExceptionอ_อ Or, you know, you could read the rest of the conversation here and the advice you were given in TL and don't merge or delete accounts you're not 100% sure did something wrong. A moderator jumping the gun and making a mistake with an irrecoverable action is not an adequate reason for this feature. –  user149432 Nov 25 '11 at 15:16

I see legitimate reasons to request this feature and very good reasons to want it to never happen. Why not a compromise? We don't need to actually see the fingerprint. We don't need to actually record individual facts - that's far too intrusive.

Instead of storing actual raw data, which is surely a privacy violation, just store an identifier of certain information, and cross-reference them to get a percentage overlap, much like the general idea behind some existing tools. If you can see "fingerprint matches 100%" vs. "fingerprint matches 98%" or "matches 20%", it gives you a useful statistic without revealing any actual sensitive data.

As far as actually storing the raw data, again, this doesn't need to be stored verbatim. Take a hash of each signal in the fingerprint, and compare those. For example, hash the name of each font installed and cross-reference those, hash the user agent ID, etc. If they match, the hashes will match. If they don't, they won't. It might decrease the signal a bit, but gets rid of the problem with having to store personally identifiable information while still retaining the important data. This would allow us to make use of a potentially useful statistic without undermining users' privacy.

As long as the exact details of the hashing/data storage algorithm are kept secret, and the only data shown to moderators is a "% similarity" figure, then I don't think it's a significant privacy issue. There would be no way to abuse it to personally identify somebody, because even at a raw data level, nothing uniquely identifiable beyond the Stack Exchange network would be stored.

share|improve this answer
    
I seriously fail to understand what's so "intrusive" about this fingerprint. Would you be more worried about your privacy if your email somehow leaked from SO or this fingerprint? –  NullUserException อ_อ Nov 24 '11 at 0:18
1  
@NullUserExceptionอ_อ I'm not personally as worried about it as some people, although arguably my email is somewhat public knowledge while a unique browser ID could allow anybody to identify me on any site where I might be attempting to appear anonymously. I do think there are valid concerns on unnecessarily collecting a large quantity of information like this. You have the choice to not provide an email with your SE account, but you would not have the choice to avoid having these data collected if your account were suspect. –  nhinkle Nov 24 '11 at 0:20
    
The solution to that is simple: don't let mods see the actual fingerprint information, but only a % match. –  NullUserException อ_อ Nov 24 '11 at 0:22
    
@NullUserExceptionอ_อ what you just said is exactly what I'm proposing. In order to avoid the perception of unreasonable information being available to mods, only a % match (or % per category or some such) would be shown, and the data would be stored in such a way as to prevent any possible abuse. I don't think it would be intrusive if done in the way I describe above. –  nhinkle Nov 24 '11 at 0:24
    
If you feel the info revealed is intrusive, time to write your own browser. Honestly. Its info that is shared by about every one you run. Oh, by the way, nice Arial family you have there. Makes me feel like sexy time. –  Won't Nov 24 '11 at 2:57

The solution to the sockpuppet problem (and to be honest I'm not convinced this isn't a solution in search of a problem) is to design the reputation system so that there is little or no advantage to creating sockpuppets. Not to add ethically questionable technical measures to root out sockpuppet abuse (which will escalate the arms race but do little to stop such abuse long-term.)

Take a look at Wikipedia for a sobering example of the madness that lies the way of the second approach.

share|improve this answer
7  
The only way to design the reputation system so that there is little or no advantage to creating sock puppets is not to have a reputation system at all. I can see no other way –  Pëkka Nov 23 '11 at 21:55
2  
@Pekka Strictly speaking, you are right -- it's probably impossible to stop a subset of SE users from gaming any conceivable system by colluding to give each other reputation (whether these users are really the same person or not). But there are various measures we can explore to minimize the usefulness of creating a throw-away second account: increasing the number of reputation required to upvote answers to other peoples' questions, for instance. –  user152743 Nov 23 '11 at 22:03
    
that's a fair point. –  Pëkka Nov 23 '11 at 22:04
    
As James Surowiecki writes, the only way to improve the reputation system to greatly reduce the sock-puppet menace is to make everyone have a financial stake in the system. Something Stack Exchange is unlikely to attempt. –  Awesome Poodles Nov 23 '11 at 22:21
    
@BrockAdams: What do you imagine there? Have users pay for contributing? For upvoting? –  Paŭlo Ebermann Nov 23 '11 at 22:59
    
@BrockAdams - Where does James write that? –  Kevin Vermeer Nov 23 '11 at 22:59
    
@KevinVermeer, The Wisdom of Crowds and follow-on work/statements. –  Awesome Poodles Nov 23 '11 at 23:45
    
@Paŭlo Ebermann, I don't imagine SE will do anything along those lines. If it was me, I'd start with a kind of online wagering/pay-for-best type scheme and adjust from there. Money would not be required, but "more skin in the game" would increase the weight of votes, etc. I'll work out the details if I ever decide to implement such a system. –  Awesome Poodles Nov 23 '11 at 23:45
1  
I can appreciate the sentiment. Honestly. But, as soon as you figure out how to accomplish this, please let the governments of the world know. Because it infects just about every system involving human beings. –  Won't Nov 24 '11 at 2:59
    
Another comment, because I can't understand your reasoning. Ethically questionable? To know what information your browser returns when openly queried? Ask me a question, and I'll tell you no lies. Or, if I do, its my bad. If you think what your browser returns from a valid request is questionable, then you need a new browser. –  Won't Nov 24 '11 at 3:10
2  
@Won't If I'm using SE anonymously, my intent is to be anonymous. Maybe I'm not technically savvy enough to know how to strip my browser of all personally identifying information. That does not make it right for SE to exploit my ignorance to try to identity me. My house has many windows. Nothing stops you from "openly querying" them and peering into my living room. But I would hope common sense and decency would restrain you from such a violation of privacy. –  user152743 Nov 24 '11 at 8:23
  • The mod then compares the information in the fingerprint, determining if both users have been using the same browser on the same machine.

This is tedious, unnecessary, and a violation of privacy.

Tedious

Have you looked at the results over there? I (like many users) am a developer, and I'm currently on an old Windows XP image that's seen hundreds of apps installed (and thus I have some 230 fonts) and I've used plenty of browser extensions (278 semicolons in the list, though most of those seem to come with Chrome by default - I've only got some 20 that I've installed personally). The list is dizzying. Please don't make mods sort out whether those fingerprints are identical.

Unnecessary

All that's necessary is a simple boolean "Yes" or "No", these users have/have not demonstrated identical fingerprints. You might consider displaying this for each of the rows in the table; I expect that some users run incognito windows or different browsers to avoid having to log in and out, which would produce negative results on several fields (Time zone, monitor size, and system fonts should not change, though).

Violation of Privacy

Most importantly, as Mark Trapp noted, you're missing the point of the site: This is a privacy issue.

The privacy policy

Stack Exchange's privacy policy states, in part,

Stack Exchange also collects potentially personally-identifying information like Internet Protocol (IP) addresses. Stack Exchange does not use such information to identify its visitors, however, and does not disclose such information, other than under the same circumstances that it uses and discloses personally-identifying information, as described below.

Certain visitors to the Network choose to interact with the Network in ways that require Stack Exchange gather personally-identifying information. The amount and type of information that We gather depends on the nature of the interaction. [snip examples] In each case, Stack Exchange collects such information only insofar as is necessary or appropriate to fulfill the purpose of the visitor’s interaction with the Service. Stack Exchange does not disclose personally-identifying information other than as described below. And visitors can always refuse to supply personally-identifying information, with the caveat that it may prevent them from engaging in certain Network-related activities.

Stack Exchange discloses potentially personally-identifying and personally-identifying information only to those of its employees, contractors and affiliated organizations that (i) need to know that information in order to process it on Our behalf or to provide services available at the Network, and (ii) that have agreed not to disclose it to others. Some of those employees, contractors and affiliated organizations may be located outside of your home country; by using the Network, you consent to the transfer of such information to them.

I'm not a lawyer, so I'm not going to try to analyze whether or not this sort of data revelation is allowable under that policy. Nonetheless, I will say that (1) I, as a user, don't want any information revealed unnecessarily and (2) I, as a moderator, want to respect user privacy whenever possible.

The mod agreement

Sure, the mod agreement says:

  • I acknowledge that I may have access to potentially personally-identifying information about Site users and that in connection with such access
    • I will use such information solely in accordance with the then-current Privacy Policy of the Site,
    • I will not disclose this information to anyone,
    • I will not store or copy this information and
    • I will only use such information in connection with performance as a Site moderator for the benefit of the Site.

Panopticlick's information is globally unique stuff; heavier than the current tools available to mods. It's one thing to state that two Stack Exchange users are socks, but it's another to state that this visitor to a different site is this Stack Exchange user.

In which I make a hyperbolic analogy

You could also study whether two users are the same by comparing their credit card numbers or passwords, but that's completely unnecessary and probably illegal, the above disclaimer notwithstanding. You wouldn't do this. I hope.

TL;DR:

The current tools available to a mod aren't always sufficient to discern well-meaning friends or small businesses sharing an internet connection from malicious vote rings and abusive socks. I'd be OK with adding another tool to the current arsenal, but don't throw panopticlick results back at me. If you do use them, diff them first, and just tell me whether they match or not.

share|improve this answer
4  
Creating a fingerprint from some system parameters is not personally-identifying information. I'm having a really hard time seeing a privacy issue, especially as this will be visible only to mods who see other, much more sensitive information all the time. –  Pëkka Nov 23 '11 at 22:42
4  
I'm globally unique among 1.8 million people on Panopticlick. That's personally identifying information, especially to mods who have their own site and could potentially run the Panopticlick code. What information do mods see that's more personally-identifying than this? IPs are dynamic, emails are free, and that's about it. None of the stuff we currently have access to is nearly as potent for personal identification as the system parameters. –  Kevin Vermeer Nov 23 '11 at 22:48
    
true if you do it exactly like Panopticlick, but the way Will shows in his suggestion, the only information that the moderator gets is whether two users who are already under suspicion share the same system fingerprint. I still fail to see how that, specifically, is a privacy issue. –  Pëkka Nov 23 '11 at 22:55
    
@Pekka - The mod goes into each account... and The mod opens each user's account page in a different tab ... then compares the information in the fingerprint seem to indicate that this wasn't what Will suggested. That's what I suggested. –  Kevin Vermeer Nov 23 '11 at 22:58
    
true re seeing the fingerprint - I didn't read closely there. But the mod has to explicitly activate it for the next request. I agree your suggestion of hiding it completely has merit, though –  Pëkka Nov 23 '11 at 23:02
5  
Tedious? Less than what we have to go through now to investigate socks. Unnecessary? I suppose so. We can do whatever we want. I want to merge your account with someone else's? Who is to stop me? Nobody. After the fact, I suppose I can be chastised for screwing up. You are still merged. It is near impossible to undo. A violation of your privacy? To see what fonts you have installed? Or what version of .NET? Honestly? I already know your email address, and every IP you ever signed in with. I am not sharing this info with anybody. THAT is a violation. Seeing is not. –  Won't Nov 24 '11 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .