Hacker News Reader

Comment by alcover | Hacker News Reader

  > some, very old
  > I had sworn were done anonymously

How in the hell did they do it ? I presume you changed IP and user-agent many times over since then... How ?

View on HN

With a sticky fingerprint. I’ve built a system like this for managing trolls. You fingerprint the user and associate it with an IP. There are multiple mechanisms that can contribute to the fingerprint (cookie, user agent, supported media codecs, etc. See https://github.com/fingerprintjs/fingerprints for an example implementation).

Then if another user registers with the same fingerprint we link the accounts together.

In our case the whole thing is also requiring human moderator input to actually keep the whole thing going though.

Your link 404s. I believe this is what you meant to include: https://github.com/fingerprintjs/fingerprintjs.

There is also a premium verson: https://fingerprint.com/

I once helped nuked a user who was a persistent sexual harasser with access to multiple /16 ranges - but their device config (browser and etc.) was unique to users of the service in question, so we just hellbanned that.

(apologies for the level of vague here but I don't believe it's fair to anybody else involved to be less vague - including the user in question, who seemed relatively young and I hope has grown up since)

I wouldn't presume anything. But email, phone number, cookies, other machine finger printing stuff, wifi and other location giveaways are also possible.

Likely they drop a cookie with a session ID. I believe (but have no knowledge) that Disqus presents in an iframe, so the cookie persists whenever it loads on a page. So they can attribute all posts from that common session id. That said, chrome does not sync cookies, so this method only works as long as cookies don't get cleared (or computer replaced etc).

So it might be something else, given the implied age of the comments.

About the proposed clues in the sub-thread :

- cookies are temporary. Even 'ever-cookies' wouldn't have survived brower upgrades.

- email, tel : the parent insists having had privacy opsec so reusing those over time would not fit in this view

I have no idea. This was before all the machine learning stuff came into fashion.

Perhaps same email address?

They keep all the data posted since the early days of the internet, and are applying machine learning to it now (and will continue to into the future).

That's chilling.. The only long-going thread of attribution would rely on stylometry - a good fit for ML though..

3rd party cookies perhaps? I'm actually very curious how this was possible too

Reply on news.ycombinator.com