IP Address Privacy?

[ZenWarrior Fuosing]

What parties outside of LL has access to residents' IP addresses--assigned by their ISPs--if all communications between parties/residents are only inworld?  Specifically, do private sim owners have access to that information and/or is it provided to them by LL?  If yes, why wouldn't any problem simply be reported to LL to be resolved by it and without revealing to other residents information very helpful in ascertaining RL identities, or at least locales of residence? (This issue arose when someone, not even private sim owners but one of their employees, did in fact seem to know my IP address.)

[Ellla McMahon]

Hello ZenWarrior, one way could be through streaming audio or video. Overview of Music in Second Life

Pleasekeep in mind that the audio streams come directly to your Second Lifeviewer, they do not get streamed by Linden Lab's servers. None of thiscontent comes via Linden Lab's servers at all ..

The owner of the stream, or someone they gave the access details to, can see the IP addresses of listeners.

[ZenWarrior Fuosing]

Thank you, Ellla.  Your quick response is very appreciated.  Effective today, that ends the streaming of most music into SL via the viewer--and especially means the end of any live music for me in SL.

That said, and although in the Knowledge Base no one reads, shouldn't LL consider this a more important privacy issue than it apparently does? Surely there must be a technical solution to residents unwittingly and potentially revealing their identities, and LL should not be turning a blind eye to them.

And if not that, maybe this is information which should be far more widely disseminated.  I hate to say it, but maybe each place streaming music should somehow very visibly announce that opening the stream through the viewer will reveal information which could be used to identify them?  And, maybe it should be in a warning alongside the media entry area in the viewer.  And yes, I can imagine the effect that might have on the music scene in SL, but what does LL place first--entertainment of residents or protecting residents' supposed (and typically desired) anonymity when assuming other identities as avatars when inworld?

At the very least, revealing their IP addresses should be a conscious choice clearly made by residents instead of information I'm willing to bet is unknown by 99% of them.  I've actually read the Knowledge Base "cover-to-cover" but never connected those dots.  If I had, I'd have been streaming Pandora outside SL for at least a year now.  Oh, and are there any other ways IP addresses are revealed of which residents should be aware?   (Your "one way" didn't escape my attention. )

[Unklebob Hotaling]

Not sure if this is any consolation but should any RL info be shared, thats a huge transgression - number 4 on the 'big six' list.  This is a very interesting thread - I deal with streams lots inworld and i'll have to do some looking into this.

 

The Community Standards sets out six behaviors, the 'Big Six', that will result in suspension or, with repeated violations, expulsion from the Second Life Community.

All Second Life Community Standards apply to all areas of Second Life, the Second Life Forums, and the Second Life Website.

1. Intolerance

   Combating intolerance is a cornerstone of Second Life's Community Standards. Actions that marginalize, belittle, or defame individuals or groups inhibit the satisfying exchange of ideas and diminish the Second Life community as a whole. The use of derogatory or demeaning language or images in reference to another Resident's race, ethnicity, gender, religion, or sexual orientation is never allowed in Second Life.

2. Harassment

   Given the myriad capabilities of Second Life, harassment can take many forms. Communicating or behaving in a manner which is offensively coarse, intimidating or threatening, constitutes unwelcome sexual advances or requests for sexual favors, or is otherwise likely to cause annoyance or alarm is Harassment.

3. Assault

   Most areas in Second Life are identified as Safe. Assault in Second Life means: shooting, pushing, or shoving another Resident in a Safe Area (see Global Standards below); creating or using scripted objects which singularly or persistently target another Resident in a manner which prevents their enjoyment of Second Life.

4. Disclosure

   Residents are entitled to a reasonable level of privacy with regard to their Second Life experience. Sharing personal information about a fellow Resident --including gender, religion, age, marital status, race, sexual preference, and real-world location beyond what is provided by the Resident in the First Life page of their Resident profile is a violation of that Resident's privacy. Remotely monitoring conversations, posting conversation logs, or sharing conversation logs without consent are all prohibited in Second Life and on the Second Life Forums.

[InsyX Piranha]

Any thing you do on the internet discloses your WAN IP Address. This of course being the address that goes out from ur modem to the real world and given to you by ur ISP. As a DJ and an owner of his own server ( i do not rent servers when i have business internet and can handle up to 600 listeners without even noticing drag) i rarely pay attention to the Shoutcast DNAS log except the number of people connected to the stream.

Yes IP addresses show up but that is how any server DOS dialog, prompt, or whatever streaming text shows when someone connects to something. Technically you are safe, and I can prove it. Just cause I can see IP addresses...none of them show who's belongs to who's. the list is sparse and so not well put together. Modems from Cable and DSL companies comes with firewall properties and they are not Switches or routers so getting in is not even close to doing, even for the best hackers, which is why they use spy/ad/and malware to gain entry, which usually some dumbass aquires by clicking on things and using ineternet explore (awful web browser).

If you are on DSL...Guess what, ur WAN IP address changes every time you disconnect from your ISP's network. If you are using Cable/Fiber or Business Internet, then you have a static IP address and usually your port 80 (internet out) is off. The only thing you are doing is depriving yourself of music and fine speech in SL and you are not really saving your computer from nothing by not listening to Live music or DJs.

[Zardoz Firanelli]

The streams have allready been covered but there is one other crafty way people gather your IP info.

Sometimes I will be out shopping or just hanging around and someone will come up to me and ask me to take an online survey. I would imagine that some of them may be legitimate, but I've had a few that were pretty insistant that I had to do it right away. Avoid opening web pages that are given to you inworld by scripts or residents if you are worried about anyone discovering your IP. A visitor tracker in world that gives out web urls could be used to match up IP addresses to avitars quite easily, as would any mysql database driven inworld application.

[Ben Turas]

You have to explain the MySQL related remark you are making. How can a MySQL database get the IP address of an avatar ?

[Zardoz Firanelli]

You can store the avitar name in the database and get the ip address and insert it right along with it with a simple php function. You could also just check the server access logs against the database insertion time stamp.

[Ben Turas]

Ok. What you mean is acquire the ip address in one of the above described methods and store the avatar name and ip address in a MySQL database. The MySQL database is just the storage. Right?

(I thought you had discovered a new way of getting an IP address).

There is a valid use of an ip address by the way, banning griefers. I know an ip address can be changed and more than one avatar can be on the same ip address. Still it is a way to hinder the pest activities of a griefer to a point that he/she might give up. I know, wishful thinking ;-)

[Ellla McMahon]

Thank you, ZenWarrior, for your comments

I used the words "one way" because, as the later comments in this thread show, I thought that there might be other ways that I am not aware of.

Unklebob makes a great comment, that you can send an Abuse Report if FL information is disclosed.

[Kira Welty]

Of course you are only looking at the common home user setup...

How about Users who work from home? How about Users who play from work?
Static IP with registered Domain... hmm... perhaps a huge privacy issue?

Name, Address, phone number of the registering person of the domain, all through a simple WHOIS lookup.
Of course for an extra fee through the registrar you can hide that, just like your phone listing.  But if you run any servers chances are that info can be found anyway.

On another note there was a thread in the official forums, about Vivox and the voice system SL uses exposing IP's.  I'm not entirely sure what conditions make a peer to peer connection in the voice chat, but several savvy users were concerned.

[Zardoz Firanelli]

Nope, the SQL database an inworld user would use would be outside of Linden Labs control. I can see all of the IP information of anyone that accesses any of my servers. That's not saying that I sit around looking for this info, but it is definately no hard task to gather it and make it easily readable on a webserver. It's even easy to take it one step further and use GeoIP and narrow it right down to the town that the visitor is in within nanoseconds, so it is possible to write a script that would launch a webpage in world and do something like:

Hello (Avitar Name), the current temperature in (Avatars city/town) is 8 degress celcius with a chance of rain.

If anyone has ever seen those adult ads that have fake IM popups of available girls in your town, this is how it is done. Yes, it's true - those aren't the girls next door... lol

[ZenWarrior Fuosing]

My concern is not a breach into my computer system.  My concern is anonymity.  Just because you don't look doesn't mean someone with ill intent would not.  Also, my IP address is indeed static and most certainly can easily reveal my residence--and from that, my identity.  (And even a dynamic IP address can remain the same long enough to provide location information.)  How do I know?  I've done it myself to prove to people how by knowing their IP address I can easily get to within at least 2 blocks of their login location/residence/workplace, and sometimes closer.

The vast majority of people in SL expect RL anonymity, but what is being said via this thread is that belief is merely an illusion in SL as long as an IP address can be associated with a given person.  You admit that is possible, even if you do not do it yourself.  It takes only a small bit of additional research to narrow that list down to the likely or sought person or persons.  I don't care if LL knows my IP address (and they do), but I do care if anyone who buys a sim and then shares that information with anyone else knows.  And let's face the fact that many, if not most, music venues are on private sims.  (And when has the TOS definitely stopped someone from doing something?)

Again, I myself have used IP addresses to find people. It's as easy as pie to do.  That is why I always recommend people not use e-mail or outworld IM for communication unless they trust the other party.  Each will provide a trackable IP address.  In SL, that address and anonymity between communications is protected by LL's servers.

And in fact, I have shared my RL information with some people in SL and have nothing to hide, but still don't like the idea of anyone who knows someone with access to the proper logs violating my anonymity without my provision or knowledge.  Thanks, but I'll do without music via SL streams from this point on (and warn others of the threat), and until a technical solution is found and provided.

[ZenWarrior Fuosing]

Yes, but in such cases I am making the conscious decision to share that information.  I was not making so conscious a decision when deciding to listen to live music at a venue in SL.

And let me repeat my real question as not to have it lost:  What parties outside of LL has access to residents' IP addresses--assigned by their ISPs--if all communications between parties/residents are only inworld? (Please note the "only inworld" part which I clearly didn't recognize was being violated by listening to a music stream.)

[InsyX Piranha]

oh i know. I was just making a point that online you are your IP address. Same way in RL you are your real name. There are ways of masking your WAN same as there is a way of giving yourself a nickname in RL. All in all tho, IP Privacy is a hard sell since this info is always useful in peer/client to server resources, like banning a bad user or greifer, or in case of game servers: reporting and banning cheaters. I know this really does not apply here but the principles sl and streaming music servers are based on this backbone.

Actually i had someone's alt full out lie to me that he was not someone else, and try to log on his other self at same time to fool me even more. I already knew he was fibbin and I hate dishonest alters, so i called him out on it. Tho his mannerisms in typing and such were identical, what really called him out on it was the fact that Shoutcast DNAS prompt tells me unigue connections as well as those connected. and two WANs were identical. This is not really a huge issue for banning, but just an example why these things log ip addresses that the admin can use to help protect themselves running servers that people connect to for any reason.

[ZenWarrior Fuosing]

Thanks, Ellla and Unklebob, but filing an abuse report is like closing the door to the chicken house after the fox has eaten all the chickens and made his escape. 

[InsyX Piranha]

when you are in sl, only LL and yourself are privy to your WAN IP. Tho i think there are huds and security stuff that can get your IP address, however usually most who has these are worried about greifer alts and those that cheat at clubs on contests.

[Zardoz Firanelli]

Q: What parties outside of LL has access to residents' IP addresses--assigned by their ISPs--if all communications between parties/residents are only inworld? (Please note the "only inworld" part which I clearly didn't recognize was being violated by listening to a music stream.)

 

A: Anyone that offers a service on a server not managed by Linden Labs. In world this is any stream, database enabled object, or web enabled object.

[ELQ Homewood]

<sigh> is correct. This is a great ploy to try and get people all upset and start some much unneeded drama. As you know full well, any presence anywhere on the web has your IP information. From the email you send to the javascript alert window that popped up when you visited that web page, right down to every company that has a banner ad on any webpage you've ever visited. They all have access to that information. It really has nothing to do with "sharing" that information because we can't live in this world (the real world - OR any other) without people having access to that information. It's a fact. There are ways to obfuscate your IP address, and if someone is incredibly, unrealistically concerned about "sharing" this information they'll use these methods to hide their IP.

Fact is, there is a way to keep your IP completely inviolate. Unplug your modem, sell your computer, and start a garden.

[Ty Brandenburg]

If anonymity is that big of a deal and there is a concern about your IP address, then do some address obfuscation. There are various ways to re-route your Internet traffic that will allow you to add additional layers of obfuscation to your source IP address.  Some work better than others and your mileage may vary. Proxy type services, TOR, etc. are all ways to do this although you may find that performance totally sucks (hey, at least nobody will know who you are).

If that level of anonymity is a big deal just elect not to use any Internet based applications from your home and only use free WiFi etc. where you will have a higher likelihood of hiding your identity. Frankly I would be more concerned about client side attacks on your PC (Metasploit QuickTime exploits for example) and the ability to do real damage that way rather than worrying that someone will know what city you're in etc.

Regards,
Ty

[Jenni Darkwatch]

Don't worry about it too much as the previous poster said. Turn off streams and media if you're worried, or use any of the gazillion open unsecured proxies or any of the equally obiquitous anonymity services.

No need to panic.

[ZenWarrior Fuosing]

Please read more carefully.  I have admitted to not connecting the dots about streaming music violating the resident-LL only relationship.  I then asked if there were other possible ways of which people might be unaware or which are less obvious.  My concern about privacy is only with regard to having the erroneous thought that I was dealing only with data between myself and LL.  I have also admitted that my concern about privacy is so little that I have revealed to some inworld who and what I am.  So again, not realizing that I was sharing data outworld when listening to music streams, I wondered how someone would know my IP address.  Clear enough now?

What this thread has done is assured me that my personal information is not shared with anyone by LL.  I need only be more thoughtful of the data's path.  That said, by visiting a private sim and listening to music, I am potentially sharing my information with other SL residents to whom it had not been consciously given or given without my explicit consent.  I repeat: Clear enough now?

[Master Crescendo]

You really should think about the fact that shoutcast servers (most SL media streams) list listener IP, but that is not Second Life related at all.

You are worse off with your facebook and twitter accounts, and a google search with your name comes up with 4000 hits.

Most blogs will record your IP, so will most (if not all) forums so think about that when posting something somewhere.

So if you want to be anonymous, pull the plug to Internet.

Best way is to ask yourself what someone could do with your IP, and more important: why they would bother.

[ELQ Homewood]

My point is that an IP address is not secret personal information. It is public, it is searchable, and it does not belong to you. Everyone and everything you come into contact with online has the potential to access your IP address. Streaming music, Streaming video, Instant Messages, group chat, on and on ad nauseum, none of these things are speciic to SL and in every instance of their use your IP address is exposed. Whether you are in SL, in a browser, or using a desktop application; On a private or mainland sim; reading your email which has a google adwords banner on the page..your IP is exposed.

[ZenWarrior Fuosing]

Many of you are entirely missing the point.  I'm willing to bet any amount of L$ that no small number of residents in SL would prefer to remain more (or even completely) anonymous regarding their activities when inworld than when shopping online or using Facebook.  I don't care that Proctor & Gamble has my IP address, but I do care if a mentally disturbed ex-girlfriend from SL has it. 

[ELQ Homewood]

SL is in the real world, and it is online (well, most of the time). Therefore those residents who prefer anonymity are pretty much SOL...I'm not trying to be a pain here, I'm simply stating the obvious reality on this subject.