Who knows "unregistered"

jnmeade

Cleared for Takeoff
Joined
Sep 25, 2005
Messages
1,220
Location
Eastern Iowa
Display Name

Display name:
Jim Meade
If a person posts a message in an unregistered status, can the sender be identified by the administrators? Via IP address or any of the other computer addresses that are probably tracked on registered members? For that matter, can the unregistered person be identified if requested by authorities?
 
If a person posts a message in an unregistered status, can the sender be identified by the administrators? Via IP address or any of the other computer addresses that are probably tracked on registered members? For that matter, can the unregistered person be identified if requested by authorities?

Uh oh, what did you do NOW?
 
This is a topic that the management council has been discussing in private. I sort of dropped the ball on it though and will resume the conversation. Please give me a few days.
 
Here's my take based on moderating a different vBulletin forum.

The ip address of the poster is recorded. It would be well within our administrators capabilities to delete that from the database.

IP addresses are not positive id in all cases. If you post unregistered from your home computer, it's pretty positive. If you post from a public computer with a lot of PoA activity it narrows it down. If you go to a WiFi hotspot that is only used for one post it still gives city and state.

I'm not a lawyer but I believe a judge can order PoA to turn over any information we have on a post.

Joe
 
Here's my take based on moderating a different vBulletin forum.

The ip address of the poster is recorded. It would be well within our administrators capabilities to delete that from the database.

IP addresses are not positive id in all cases. If you post unregistered from your home computer, it's pretty positive. If you post from a public computer with a lot of PoA activity it narrows it down. If you go to a WiFi hotspot that is only used for one post it still gives city and state.

I'm not a lawyer but I believe a judge can order PoA to turn over any information we have on a post.

Joe

Do most homes fed by cable modem or DSL have a dedicated IP for the link? According to the status page of my wireless router my ISP has assigned me 173.31.223.237 via DHCP. If I release and renew that IP it stays the same but I it was different when I checked it last January. If IPs change would knowing a post's IP really prove anything?
 
Last edited:
Do most homes fed by cable modem or DSL have a dedicated IP for the link? According to the status page of my wireless router my ISP has assigned me 173.31.223.237 via DHCP. If I release and renew that IP it stays the same but I it was different when I checked it last January. If IPs change would knowing a post's IP really prove anything?
It's been my experience that dynamic IPs from ISPs like cable and DSL are fairly stable, months or even years at a time.

For PROOF it would take cooperation of the ISP to say this IP was assigned to that physical address on the date/time of the post. I believe a judge can order that and that most ISPs will not release that information without an order. I also assume PoA operates the same way.

I wonder if the question is "can the management council make a pretty good guess who posted an unregistered comment" or "can law enforcement prove I admitted something I wish I hadn't".

I think the answer to both is probably if they want to bad enough.

Joe
 
It's been my experience that dynamic IPs from ISPs like cable and DSL are fairly stable, months or even years at a time.

Same experience here. DHCP tends to favor reassigning the dyn. IP to the same network device unless forced to do otherwise or unless the pool is pretty well saturated.

For PROOF it would take cooperation of the ISP to say this IP was assigned to that physical address on the date/time of the post. I believe a judge can order that and that most ISPs will not release that information without an order. I also assume PoA operates the same way.

Or someone sniffing a wifi connection via wardriving. The admissibility is harder with that one.

Another alternative is asking for the IP access records from any Yahoo, Gmail or other email accounts (or any other service that associates your user ID with your access).

Some providers do not record the IP association for a given user/address, others do meticulously. YMMV.

I wonder if the question is "can the management council make a pretty good guess who posted an unregistered comment" or "can law enforcement prove I admitted something I wish I hadn't".

I think the answer to both is probably if they want to bad enough.

Joe

Maybe on both. LE has a lot more tools and can often gather enough data to make a case when private citizens can't.
 
What about from a cell phone, I was told one time that their IPs are different every time you use the internet with them?
 
- murders have been solved by tracing back dynamic IP addresses. There is a trace for anything, a sufficiently motivated entity would be able to track it down.

- If POA was faced with a subpoena or national security letter for an IP address for a particular post, do you think they will:
A. Hem and haw and hand it over after about 30 seconds.
B. Spend the scant assets of the organization to fight a case about 1st amendment rights and digital privacy to the US supreme court.
 
What about from a cell phone,
Even less security and privacy. All calls, even data ones are logged and tracked through the system to show which base station, sector, and location you are initiating a call from. This information is available to any law enforcement officer or government agency with a simple request to a judge, no warrant is needed.
 
If a person posts a message in an unregistered status, can the sender be identified by the administrators? Via IP address or any of the other computer addresses that are probably tracked on registered members? For that matter, can the unregistered person be identified if requested by authorities?
Might want to check out this thread.
Users are reminded that your ip address is recorded with each post, even when not logged in, and can be used to trace back to your identity. Anonymous personal attacks against other posters are not allowed, regardless of whether one is logged in or not.

Keep it civil.
 
What's it all about? (what's going on?)
I don't know. I think someone want to confess to something in order to cleanse their soul but doesn't want anybody to know who it is.

One of the great things about being Catholic is that you can do that. There might be more, I'm not sure.


My all time favorite is a story about the government's anonymous payment program. I don't know the details but as I understand it you can send money to this program with a (semi) guarantee that it won't be investigated.

The way I remember this is:

I cheated on my taxes and I feel so bad that I can't sleep so I've enclosed a money order for $10,000. If I still can't sleep, I will send you the rest.
 
Here's a few answers:

- Proving beyond reasonable doubt that you were the person using a web service merely because of your IP address is almost impossible if you have a good lawyer (see some current RIAA cases) and enough money. Wireless access points and trojans, as well as the possibility that someone else was using your computer, make it very difficult to establish that you yourself were accessing content by IP address alone.

- IP address is not everything and many people don't realize this. Take a look at this. I bet your browser will be unique or close to unique. This combined with the IP make it rather likely that it can be established that a specific computer made the request. It still doesn't mean that you were the one using your computer, though.

- PoA says that your IP can be traced back to your identity. That's not true; it can be traced back to a specific computer in certain cases (and not all cases by far).

- If PoA wants to ensure anonymity, they'd have to purge IP records as well as ANY logs related to that transaction (server logs, application logs, anything that contains HTTP request information).

- If you want to make a post that is reasonably anonymous, download and boot from one of the various linux boot CDs and access PoA from there using a free wifi connection (like at a coffee store). This is still not perfectly anonymous because there could be security cameras at that store (better park your car outside), etc., but it's going to take a lot of effort to trace this back to your computer and it will be incredibly hard to establish your identity as the person making the web request.

....and so on. This is a complicated topic :)

-Felix
 
Are MAC addresses communicated with e-mail or web browsing? I understand these are unique...
 
Are MAC addresses communicated with e-mail or web browsing? I understand these are unique...
No not really. Mac addresses are used at layer-2 which generally does not extend outside your network. Requests across the internet are done with internet protocol which is layer 3 and your local mac address is not involved with the request beyond your network.

That said - you could probably get a user's mac address with javascript and then send that to the server with an AJAX request. That would be an interesting way to track users.... (Of course you can forge a mac address easily but the non-techies would never realize what was happening).
 
No not really. Mac addresses are used at layer-2 which generally does not extend outside your network. Requests across the internet are done with internet protocol which is layer 3 and your local mac address is not involved with the request beyond your network.

That said - you could probably get a user's mac address with javascript and then send that to the server with an AJAX request. That would be an interesting way to track users.... (Of course you can forge a mac address easily but the non-techies would never realize what was happening).
Well, on most non-IE browsers, security settings will prevent you from getting a MAC address. Even on IE browsers, this generally doesn't work.

Using a Virtual Machine like I described solves this and other issues that we can't think of. That would be my suggestion...
 
What about when using www.anonymizer.com ?

Here's what Wiki says:

Risks and security

Anonymizers are not entirely secure. If an anonymizer keeps logs of incoming and outgoing connections and the anonymizer is physically located in a country where it is subjected to warrant searches then there is a potential risk that government officials can reverse engineer and identify all users who used the anonymizer and how they used it. Most anonymizers state they do not keep logs but there is currently no way to confirm that. However, if the user used another anonymizer to connect to the exposed anonymizer, that user is still anonymous. This is sometimes called daisy-chaining.
 
However, if the user used another anonymizer to connect to the exposed anonymizer, that user is still anonymous. This is sometimes called daisy-chaining.
The Wiki isn't right about this. Doing this will make things a bit less transparent, but in no way does this make the user more anonymous.

-Felix
 
Well, on most non-IE browsers, security settings will prevent you from getting a MAC address. Even on IE browsers, this generally doesn't work.

Using a Virtual Machine like I described solves this and other issues that we can't think of. That would be my suggestion...
You're probably right - I'm not a javascript guy - don't really know what exactly you can or can't do other then the fact that people figure out ways to do what you shouldn't be able to do.

Everytime I work with javascript it leaves me with the impression that I don't want to work with it any further.
 
Back
Top