3 ms·

Out of curiosity, how are you guys handling anonymous user actions without fingerprinting? For example if you want to setup a user poll, without requiring a use

Out of curiosity, how are you guys handling anonymous user actions without fingerprinting? For example if you want to setup a user poll, without requiring a user account? Storing it in a cookie can just be deleted, which the agent can just clear and resubmit.

lisper 7y ago
Browser fingerprints can be spoofed too. Sock puppet accounts are equally easy to create. There is no easy way to insure that people don't cheat on on-line polls. This is why (for example) on-line voting in IRL elections is a Really Bad Idea.
sdoering 7y ago
There are multiple ways. All can be cheated. * Cookies: Can be deleted * IP-Adress: Not unique, because ISPs rotate them; also VPN * Login: Well create a second one * Methods from Universities using nth letter of name and nth digit of birthdate: Just make up a new name. Sorry - but unless you are using an analog medium or asking the questions in person the numbers can be inflated and there is no way to have 100% data quality. But in most contexts this is ok. So I would probably go the most easy way: Cookie. I would - at least not in the European Union go with fingerprinting and such stuff, as I am not sure how this plays out regarding GDPR as this would be PII you are storing.
TheAceOfHearts 7y ago
Fingerprinting is not an effective deterrent either, as you can just open a different browser. The user could also have multiple devices with internet access. You could use IP address, although that only works if the user isn't on a public / shared network. It's also easily bypassed by spinning up a VM on a cloud service provider and using an SSH tunnel. Since you used polls as an example: StrawPoll.me [0] is an online poll site which lets you select different duplication checks based on your requirements. The choices are: IP, browser cookie, none, or require user sign in. They also give you an option to add a CAPTCHA. [0] https://www.strawpoll.me/ https://www.strawpoll.me/
- OrgNet 7y ago
  I can change my semi-static IP address whenever I want by spoofing my router's MAC address (Comcast)
steve76 7y ago
Run a honeypot, and blacklist. Create a scoring system where fake votes get a lower count. Put a margin on your polls that takes into account fake votes, like you need to win by 10%, or 1/2 public and 1/2 editors. Put momentum against voting. You need to keep this page open for an hour, then vote appears. Or you need to donate. The biggest danger of browser fingerprinting I see is that someone can track across different sites. Buy an ad from a network, and have the image load from a server that gobbles up all the data it can. You can get a good context of the user, and can ID them when they hit your site. One user might see one page, and the other user might see another. If you have enough web properties, tens of thousands of pages, you can send people down black holes and amplify their worst behaviors. The internet looks a lot different for one person than another, and smart people manipulate naive ones with very little effort.
wyattjoh 7y ago
Definitely think that it would have been a good tool to counter fraud/abuse. The issue of course would be that abuse of said tooling and the rise of ad-tech is what's caused the major issues we see today. I'd imagine that it would be useful to perhaps, flag accounts that were created on the same machine as a tool to help detect when users are trying to circumvent abuse control tools. Sure, someone can create another account using a new browser, within a VM, from another computer, inside a VPN. It's all about making it much harder. If the primary use of fingerprinting was to protect community from bad actors, like those violating a set of community guidelines, then maybe the extra effort it would take to get around those issues might give them enough time to diffuse.
dredmorbius 7y ago
You're looking for an anti-Sybil defence. Generally, some chain-of-trust involving nonduplicable demonstration of identity. Depending on the strength of defence required, anything from a low-cost registration fee (see Metafilter) to some form of recommendation-and-vetting or simultaneous in-person token-granting event (simultaneous to avoid entities being in two places at once). And auditing for abuse. There have been several proposals for such systems also assuring some level of anonymity. It's unlikely any approach will be perfect, though an arbitrary level of assurance is likely possible at some cost. Note that surreptitiously fingerprinting and preemptively certifying to establish entity uniqueness are vastly different from a user awareness and concent perspective.

lisper 7y ago

Browser fingerprints can be spoofed too. Sock puppet accounts are equally easy to create. There is no easy way to insure that people don't cheat on on-line polls. This is why (for example) on-line voting in IRL elections is a Really Bad Idea.

sdoering 7y ago

There are multiple ways. All can be cheated. * Cookies: Can be deleted * IP-Adress: Not unique, because ISPs rotate them; also VPN * Login: Well create a second one * Methods from Universities using nth letter of name and nth digit of birthdate: Just make up a new name. Sorry - but unless you are using an analog medium or asking the questions in person the numbers can be inflated and there is no way to have 100% data quality. But in most contexts this is ok. So I would probably go the most easy way: Cookie. I would - at least not in the European Union go with fingerprinting and such stuff, as I am not sure how this plays out regarding GDPR as this would be PII you are storing.

TheAceOfHearts 7y ago

Fingerprinting is not an effective deterrent either, as you can just open a different browser. The user could also have multiple devices with internet access. You could use IP address, although that only works if the user isn't on a public / shared network. It's also easily bypassed by spinning up a VM on a cloud service provider and using an SSH tunnel. Since you used polls as an example: StrawPoll.me [0] is an online poll site which lets you select different duplication checks based on your requirements. The choices are: IP, browser cookie, none, or require user sign in. They also give you an option to add a CAPTCHA. [0] https://www.strawpoll.me/ https://www.strawpoll.me/

OrgNet 7y ago
I can change my semi-static IP address whenever I want by spoofing my router's MAC address (Comcast)

steve76 7y ago

Run a honeypot, and blacklist. Create a scoring system where fake votes get a lower count. Put a margin on your polls that takes into account fake votes, like you need to win by 10%, or 1/2 public and 1/2 editors. Put momentum against voting. You need to keep this page open for an hour, then vote appears. Or you need to donate. The biggest danger of browser fingerprinting I see is that someone can track across different sites. Buy an ad from a network, and have the image load from a server that gobbles up all the data it can. You can get a good context of the user, and can ID them when they hit your site. One user might see one page, and the other user might see another. If you have enough web properties, tens of thousands of pages, you can send people down black holes and amplify their worst behaviors. The internet looks a lot different for one person than another, and smart people manipulate naive ones with very little effort.

wyattjoh 7y ago

Definitely think that it would have been a good tool to counter fraud/abuse. The issue of course would be that abuse of said tooling and the rise of ad-tech is what's caused the major issues we see today. I'd imagine that it would be useful to perhaps, flag accounts that were created on the same machine as a tool to help detect when users are trying to circumvent abuse control tools. Sure, someone can create another account using a new browser, within a VM, from another computer, inside a VPN. It's all about making it much harder. If the primary use of fingerprinting was to protect community from bad actors, like those violating a set of community guidelines, then maybe the extra effort it would take to get around those issues might give them enough time to diffuse.

dredmorbius 7y ago

You're looking for an anti-Sybil defence. Generally, some chain-of-trust involving nonduplicable demonstration of identity. Depending on the strength of defence required, anything from a low-cost registration fee (see Metafilter) to some form of recommendation-and-vetting or simultaneous in-person token-granting event (simultaneous to avoid entities being in two places at once). And auditing for abuse. There have been several proposals for such systems also assuring some level of anonymity. It's unlikely any approach will be perfect, though an arbitrary level of assurance is likely possible at some cost. Note that surreptitiously fingerprinting and preemptively certifying to establish entity uniqueness are vastly different from a user awareness and concent perspective.