How effective is checkuser? Options

[Ather]

If I wanted to run several accounts how likely is checkuser to pick me up? If I changed my IP each time I logged on how would they trap me? How long to they log IP addresses for? Do they keep a permanent record of my account creation IP? Do they record me logging on but not editing? What other info do they store and for how long? All this info is needed purely for research purposes

[Kelly Martin]

It's my understanding that checkuser now also captures your browser identification string, which can be pretty distinctive. However, interpreting the data that checkuser provides requires a good deal of knowledge about how the Internet is structured, and my experience is that very few of the holders of the checkuser privilege actually have that knowledge. It's my conclusion that they're making it up as they go along, and that means expectation bias plays a large role in the outcome of any investigation.

[Krimpet]

It's my understanding that checkuser now also captures your browser identification string, which can be pretty distinctive. However, interpreting the data that checkuser provides requires a good deal of knowledge about how the Internet is structured, and my experience is that very few of the holders of the checkuser privilege actually have that knowledge. It's my conclusion that they're making it up as they go along, and that means expectation bias plays a large role in the outcome of any investigation.

User-agent identification has been there for a pretty long time, at least since 2007. It is of course easily spoofable; some pranksters knowing they're going to be checked have left secret messages in their string for that reason.

I think the average competence of the checkusers has risen considerably since they started appointing or electing non-arbs to the position - it was much worse when all of the checkusers were arbs or former arbs, since the technical know-how to read and interpret the data doesn't exactly overlap with the mediation skills the arbs are selected for.

[gomi]

... since the technical know-how to read and interpret the data doesn't exactly overlap with the mediation skills the arbs are selected for.

[Krimpet]

... since the technical know-how to read and interpret the data doesn't exactly overlap with the mediation skills the arbs are selected for.

I'm talking in theoretical terms, here.

For some reason Wikipedians get hyper-excited about Wikipedia recording IPs when just about every web site in the world does it as part of its basic funtionality.

Funny thing is, just about every other wiki software package in wide use other than MediaWiki displays the hostname and IP address of logged-in users, including the UseModWiki software Wikipedia originally ran on. Apparently a conscious design decision was made in the development of what's now MediaWiki to start keeping hostnames private; kind of silly in my opinion.

This post has been edited by Krimpet: Thu 31st December 2009, 5:41pm

[anthony]

For some reason Wikipedians get hyper-excited about Wikipedia recording IPs when just about every web site in the world does it as part of its basic funtionality.

Funny thing is, just about every other wiki software package in wide use other than MediaWiki displays the hostname and IP address of logged-in users, including the UseModWiki software Wikipedia originally ran on. Apparently a conscious design decision was made in the development of what's now MediaWiki to start keeping hostnames private; kind of silly in my opinion.

Good point. I think anonymity was only a side-effect of the original wikis. The intended design principle was "we aren't going to put you through the hassle of signing up", not "we're going to let you sign up 100 times under 100 different pseudonyms". IIRC, the original software didn't even have logins. You were expected to sign your name, but the only guard against signing someone else's name was that the first three parts of your IP were in the history for everyone to see (e.g. 192.168.88.xxx). One funny thing is that nowadays you can't even edit this way without getting yelled at by a bunch of admins who want you to sign your posts with ~~~~ instead of with "- Your Name" (they've even got a bot which adds those stupid "unsigned post by #.#.#.#" messages).

I can understand why they got rid of the feature of including the IP addresses in the history (since it generally reveals your location), but in hindsight at that point they probably should have instituted some sort of "one username per person" policy, and given themselves at least a rough method of enforcing it (like an email address which could be passively checked after-the-fact or something).

[Krimpet]

I can understand why they got rid of the feature of including the IP addresses in the history (since it generally reveals your location), but in hindsight at that point they probably should have instituted some sort of "one username per person" policy, and given themselves at least a rough method of enforcing it (like an email address which could be passively checked after-the-fact or something).

I personally don't understand the anxiety over having one's IP address revealed. The Internet wasn't designed to be anonymous; your IP address is always going to be known to every host you communicate with. It's akin to your license plate, not your home address; everywhere you go with your car, it's going to be parked outside and someone can look at it and determine your home country and state (and even sometimes county) and track your movements if they have the resources. But no reasonable person would try to hide their license plate from public view.

Anyone with a legitimate need for anonymity (living under an oppressive regime, blowing the whistle on a powerful company, being targeted by organized crime, etc.) can simply use an anonymizing proxy and acknowledge why they're doing so. (And if someone uses an proxy without providing a reason, they can probably be considered suspicious.) But otherwise, most users shouldn't worry about keeping their IP address private.

[anthony]

I can understand why they got rid of the feature of including the IP addresses in the history (since it generally reveals your location), but in hindsight at that point they probably should have instituted some sort of "one username per person" policy, and given themselves at least a rough method of enforcing it (like an email address which could be passively checked after-the-fact or something).

I personally don't understand the anxiety over having one's IP address revealed. The Internet wasn't designed to be anonymous; your IP address is always going to be known to every host you communicate with. It's akin to your license plate, not your home address; everywhere you go with your car, it's going to be parked outside and someone can look at it and determine your home country and state (and even sometimes county) and track your movements if they have the resources. But no reasonable person would try to hide their license plate from public view.

O RLY? "Watch out for things like license plate numbers on cars or images of the outside of your home which might accidentally appear in the background of a video and help a stranger to track you down." http://www.google.com/support/youtube/bin/...k&answer=126263

Personally, I know how easy it is for anyone with half a brain and 15 minutes of spare time, to figure out my home address, so I don't bother trying to hide the city I live in (which is about the maximum amount of geolocation easily revealed by my IP address). But not everyone feels that way about things, and I don't blame them for it.

Furthermore, not wanting to reveal one's IP address isn't always a matter of anonymity. There are lots of reasons why someone might use their real name but still not want to reveal their IP address. Which brings us to...

Anyone with a legitimate need for anonymity (living under an oppressive regime, blowing the whistle on a powerful company, being targeted by organized crime, etc.) can simply use an anonymizing proxy and acknowledge why they're doing so. (And if someone uses an proxy without providing a reason, they can probably be considered suspicious.) But otherwise, most users shouldn't worry about keeping their IP address private.

I don't buy it. You're telling me if I ask for an account, saying that I live in an oppressive regime, that my request will be granted? That's just too easy.

Besides, what counts as an oppressive regime? I'd rather not have the US government compiling information about what websites I visit. If Tor wasn't so slow, and wasn't so commonly blocked, and if all the websites I log into offered https connections so my passwords/cookies couldn't be stolen by the proxies, I'd probably use Tor for everything.

It's not very effective at all.

Certainly not very efficient. It's amusing when you think about how much time some people are wasting so that account creation can be 15 seconds shorter.

But no reasonable person would try to hide their license plate from public view.

By the way, what's your license plate number?

[Ather]

But no reasonable person would try to hide their license plate from public view.

By the way, what's your license plate number?

Here in England the police are rapidly developing a country-wide ANPR system to ultimately log all journeys. Creepy or what?

This post has been edited by Ather: Thu 31st December 2009, 10:15pm