Note: Not a duplicate of Please don't use a spam filter based on IP address. That proposes that we stop blocking IPs; this one suggests implementing an additional feature while keeping the existing IP blocking system.
Over at Charcoal, we've detected at least a few persistent spammers and trolls that have the time/motivation to keep spamming or trolling. Some of these tend to hop IPs in order to get around the existing built-in spam prevention system SpamRam, which is currently solely based on IP addresses.
The folks over at Wikipedia recently implemented a new cookie blocking system into their existing autoblocking system, which attempts to prevent users blocked for many reasons, including spam or vandalism, from coming back, and before that feature was implemented, was solely based on IP addresses (and X-Forwarded-For headers in certain cases). The way it works is that whenever a user is blocked and autoblocking is enabled, a cookie is set on the blocked user's device. Then, if they try to hop IPs, the system will detect the cookie on their device and prevent them from editing.
I'd like to propose that this cookie-blocking system be adopted into SpamRam, to prevent spammers and trolls from simply hopping IPs to keep at it. Basically, when it decides to block an IP, it should also set a cookie on the user's device set to expire at the same time the IP block expires, and then that cookie should prevent the user from posting.
One way to track the effectiveness of this before implementing this would be to keep the current status quo with regards to how blocks are made, but also set a cookie whenever someone's posting results in an IP block. Then, keep statistics to check and see if many users who post here have the cookie set on their system, and if those posts are also deleted as spam or abuse.
According to the Wikipedia page on cookie blocking:
The feature is intended to provide a small extra level of protection against blocks being circumvented.
I believe that any hurdle, big or small, is useful, per Byte Commander's comment.
When I edited as the anonymous editor, and my IP would be blocked (which was common since anonymous edits are subject to a content filter and a single edit that trips it will insta-ban the IP), bypassing the block was as simple as enabling my VPN. Based on what I've heard about SpamRam in Charcoal, I imagine that that system would be that easy to evade as well in the same manner.
Also, I believe that this would be compliant with GDPR, as we do display cookie warnings to all users, and we could list this as a use of cookies in our cookie policy (which Wikipedia also does).
