Questionable MP item ..

[Innula Zenovka]

35 minutes ago, Qie Niangao said:

(And here we are, giving product improvement ideas for a device we both find, uh, unfortunate.)

One product improvement idea I will suggest is that if the only purpose of the device is to prevent people cheating by bringing in an army of alts to rig a vote or a sploder or whatever, then there's no need to store anything other than a list of pre-approved avatars whom you don't check.

Everyone else, check the IP addresses of new arrivals against a temporary strided list of avatars already on the parcel, list lAlreadyChecked,  and either, if the address is not already on the list, admit them and add their UUID and address to lAlreadyChecked, or refuse them entry if the address duplicates the address of someone already there.

Either every few minutes or at the end of the event, as appropriate, check the list to see who's still on the parcel and remove the entries for anyone who has left.

If all you want to ensure is that everyone on the parcel has a unique IP address, that's all you need, I think.

 

 

Edited June 9, 2021 by Innula Zenovka

[Qie Niangao]

In fact, what venue actually cares about alts on the parcel? Aren't they really only concerned with multiple alts simultaneously engaged in some activity? So instead of running llGetAgentList() on a timer, just ask each goldfish-groomer to "register" their IP with llLoadURL and keep track of them only as long as they're participating.

Practically, though, the alt-protected activity must (directly or indirectly) use the code, not merely inherit the ham-fisted effect of a parcel-wide banhammer. In some applications this could be a tidy modular add-on; for example, if all groomers have to sit on a modifiable goldfish, it would be possible to add a script to "register" all sitters, and unsit any with non-unique IPs.

In any case, returning to my earlier objection, there's really no reason to require Experience KVP unless to share alt-detection across all parcels equipped with the device anywhere on the grid. That should make any venue operator extremely reluctant to expose their visitors to this thing—and might be reason to provide a less offensive alternative, because some specific activities have legitimate cause to want locally IP-unique participants.

[Chaser Zaks]

3 hours ago, Innula Zenovka said:

How about using the (hashed) IP address as the key?

That way, when someone opens the webpage, thus exposing their IP address,  the script tries to read the KVP value for which the hashed IP address is the key.   

If llReadKeyValue(strHashedAddress) returns a key not found error, it's a new visitor (or, at least, a visitor who has not used this IP address here in the past) so admit the visitor and call llCreateKeyValue(strHashedAddress, (string)llGetUnixTime()+"~"+(string)kAvUUID);

If, however, it does return a value, then compare the avatar UUID associated with the IP address with that of the avatar currently using it.    If they match, then welcome back.  If not, then assume (possibly mistakenly) they're someone's alt, and ban them either permanently or temporarily using llAddToLandBanList.

 

 

That is possible. I suspect they are actually using hash, but I didn't in the example for the sake of clarity.

However, even hashed, it still violates the terms of service because it doesn't take long to generate a rainbow table to look up IP address hashes. I have one myself, it is about 63 GiB when stored correctly, and takes less than a second to locate the hash because of how it is stored.

There are ways to get around the rules, but I'm not going to mention it here because it'll tell people with bad intents how to get around the rules.

[Coffee Pancake]

 

44 minutes ago, Chaser Zaks said:

However, even hashed, it still violates the terms of service because it doesn't take long to generate a rainbow table to look up IP address hashes. I have one myself, it is about 63 GiB when stored correctly, and takes less than a second to locate the hash because of how it is stored.

tl;dr / wtf - Getting an IP address from a hash with a good GPU and the right tools is easy. Rainbow tables make it so fast they might as well have not bothered hashing it in the first place.

(This also goes for passwords .. you can't know if a site uses a weak hash to store your password, so the best defense when that site you like gets hacked and all the passwords end up published online, is to have a different password for everything. You, yes you reading this, you do have a different password for everything? Right? Keepass is a good open source way to generate and store those passwords, safely, no subscription or anything silly)

[Innula Zenovka]

2 hours ago, Chaser Zaks said:

However, even hashed, it still violates the terms of service because it doesn't take long to generate a rainbow table to look up IP address hashes.

Please, though, explain to me which of the terms of service or community standards you say this would break, and how?   

If I somehow find out more personal data about someone than they're themselves prepared publicly to share, whether through their profile or other means, and then share it inside SL (or via LL's servers, so in these forums too) without their consent, to a third party, then I'm clearly breaking ToS.

So if, as did Red Zone, I run a service to scrape people's IP addresses without their consent and then share them inside SL without their consent, or any conclusions, correct or otherwise,  I may have drawn from their IP addresses about who their alts are or where they live in first life, then obviously I'm breaking ToS.    

I may also be breaking various data protection laws, too, but I'm only concerned about ToS there.

However, this device, as we've analysed it, at least, does no such thing.  

It learns my IP address only if I attempt to share it, and then stores it somewhere extremely inaccessible, even to the scripter to whom the experience belongs (KVP is for reading the value associated with a particular key, not for searching, analysing, or even retrieving, the keys and values in bulk).    It does not attempt to identify anyone else who uses the IP address, other than to add them to the parcel ban list, which reveals nothing personally identifying about anyone.

If I don't want to reveal my IP address to the system, I don't have to.   If I do, it reveals nothing of any significance to anyone save, perhaps, to lead someone at some point in the future, to suspect that the account uses, or has at some time used, an IP address that has at some time previously been used by another account, which isn't a whole lot.

I agree that the device is, to use Qie's term, "questionable" (though perhaps not for specific use cases like contests), but I just can't see how it violates ToS.

Please explain to me how it does, so I know what I should say in an Abuse Report, should I ever feel the need to AR one of these items.

Edited June 9, 2021 by Innula Zenovka

[Chaser Zaks]

1 hour ago, Innula Zenovka said:

Please, though, explain to me which of the terms of service or community standards you say this would break, and how?   

If I somehow find out more personal data about someone than they're themselves prepared publicly to share, whether through their profile or other means, and then share it inside SL (or via LL's servers, so in these forums too) without their consent, to a third party, then I'm clearly breaking ToS.

So if, as did Red Zone, I run a service to scrape people's IP addresses without their consent and then share them inside SL without their consent, or any conclusions, correct or otherwise,  I may have drawn from their IP addresses about who their alts are or where they live in first life, then obviously I'm breaking ToS.    

I may also be breaking various data protection laws, too, but I'm only concerned about ToS there.

However, this device, as we've analysed it, at least, does no such thing.  

It learns my IP address only if I attempt to share it, and then stores it somewhere extremely inaccessible, even to the scripter to whom the experience belongs (KVP is for reading the value associated with a particular key, not for searching, analysing, or even retrieving, the keys and values in bulk).    It does not attempt to identify anyone else who uses the IP address, other than to add them to the parcel ban list, which reveals nothing personally identifying about anyone.

If I don't want to reveal my IP address to the system, I don't have to.   If I do, it reveals nothing of any significance to anyone save, perhaps, to lead someone at some point in the future, to suspect that the account uses, or has at some time used, an IP address that has at some time previously been used by another account, which isn't a whole lot.

I agree that the device is, to use Qie's term, "questionable" (though perhaps not for specific use cases like contests), but I just can't see how it violates ToS.

Please explain to me how it does, so I know what I should say in an Abuse Report, should I ever feel the need to AR one of these items.

After reviewing the terms of service, I'll admit, I was incorrect about it being in violation. However one can argue that it is disclosure due to the fact when a alt is banned, both accounts are banned and they will have the same ban duration listed in the parcel listing, eg:

More precise timestamps can be acquired. For some, this is enough to identify alts.

EDIT:

Was going to edit the other posts crossing out the violation statements, but apparently can't do that after 24 hours.

Edited June 9, 2021 by Chaser Zaks

[Innula Zenovka]

1 minute ago, Chaser Zaks said:

After reviewing the terms of service, I'll admit, I was incorrect about it being in violation. However one can argue that it is disclosure due to the fact when a alt is banned, both accounts are banned and they will have the same ban duration listed in the parcel listing, eg:

More precise timestamps can be acquired. For some, this is enough to identify alts.

They both get 23 hour bans because that's set as the default time in the notecard, I think.

I don't really see what's being disclosed here.   I understand that someone could, theoretically, use this to gather sufficient data to identify someone's alt, but that's not disclosing anything -- how do you know whether I was banned for being someone's alt or because I didn't open the web page in time?  

[Chaser Zaks]

10 minutes ago, Innula Zenovka said:

They both get 23 hour bans because that's set as the default time in the notecard, I think.

I don't really see what's being disclosed here.   I understand that someone could, theoretically, use this to gather sufficient data to identify someone's alt, but that's not disclosing anything -- how do you know whether I was banned for being someone's alt or because I didn't open the web page in time?  

 

{
	ParcelAccessListReply Low 216 Trusted Zerocoded
	{
		Data	Single
		{	AgentID			LLUUID	}
		{	SequenceID		S32		}
		{	Flags			U32		}
		{	LocalID			S32		}
	}
	{
		List	Variable
		{	ID			LLUUID		}
		{	Time		S32			} // time_t
		{	Flags		U32			}
	}
}

ParcelAccessListReply returns results in unix timestamp, since the bans occur almost instantly within each other, someone with a modified viewer(such as myself, via list export) can see the exact time someone will be unbanned(provided they have access to the ban list).

So for example, unpacked it will look like:

ID	TIME
835096de-9f7e-42d2-b92d-6dc6677f7d8f	1623264689
918ff3eb-e8fe-4cfe-8bff-5963a461962e	1623264689
796b1537-70d8-497d-934e-0abcc2a60050	1623264127

In this example, Saltyalt and Parker Oh were both banned at the same time for being alts, while Chaser Zaks was banned at a previous time a few minutes or so ago for some reason(probably for breaking stuff).

Edited June 9, 2021 by Chaser Zaks

[Innula Zenovka]

1 minute ago, Chaser Zaks said:

 

{
	ParcelAccessListReply Low 216 Trusted Zerocoded
	{
		Data	Single
		{	AgentID			LLUUID	}
		{	SequenceID		S32		}
		{	Flags			U32		}
		{	LocalID			S32		}
	}
	{
		List	Variable
		{	ID			LLUUID		}
		{	Time		S32			} // time_t
		{	Flags		U32			}
	}
}

ParcelAccessListReply returns results in unix timestamp, since the bans occur almost instantly within each other, someone with a modified viewer(such as myself, via list export) can see the exact time someone will be unbanned(provided they have access to the ban list).

So for example, unpacked it will look like:

ID	TIME
835096de-9f7e-42d2-b92d-6dc6677f7d8f	1623264689
918ff3eb-e8fe-4cfe-8bff-5963a461962e	1623264689
796b1537-70d8-497d-934e-0abcc2a60050	1623264127

In this example, Saltyalt and Parker Oh were both banned at the same time for being alts, while Chaser Zaks was banned at a previous time a few minutes or so ago for some reason(probably for breaking stuff).

Yes, but that's generated by an add-on that you've written.    It's your code,  not anyone else's, that's doing it, so you're responsible for the product it generates for you, I would have thought.     You've now discovered, or think you have, whose alts Saltyalt and Parker Oh are, and should you publish that inside SL, then you're breaking ToS.

[XemmaN]

14 hours ago, Qie Niangao said:

In fact, what venue actually cares about alts on the parcel?

If the alts is officially allowed in sl, they are legal. why, over and over again, we read about persecutions and alt tests. in any case, asking for your IP address is a violation of privacy and discrimination of alt. this topic is mostly discussion by programmers. allegedly checked this product on the market. but excuse me this product is still a violation of rights and data protection. ethically it is outrageous and smells very much a violation of TOS

Edited June 10, 2021 by XemmaN

[Sid Nagy]

1 hour ago, XemmaN said:

If the alts is officially allowed in sl, they are legal. why, over and over again, we read about persecutions and alt tests.

Can you imagine a SL without drama, self importance or FIC behavior?
It is part of the package.

[XemmaN]

14 hours ago, Innula Zenovka said:

If I somehow find out more personal data about someone than they're themselves prepared publicly to share, whether through their profile or other means, and then share it inside SL (or via LL's servers, so in these forums too) without their consent, to a third party, then I'm clearly breaking ToS.

More recently, I read it, some experts and gurus of this forum argued that no one has the opportunity to find out your IP address. In addition to the administration of the sl.
In addition, the IP address can be the same for many completely different people living hundreds of kilometers from each other. There are also cases of a common SP address for an apartment building. in which unrelated families live in their separate real estate.
  Looking at the products of this seller, you can see that they are very old. dances in general in 2010.

Edited June 10, 2021 by XemmaN

[Qie Niangao]

3 hours ago, XemmaN said:

If the alts is officially allowed in sl, they are legal. why, over and over again, we read about persecutions and alt tests. in any case, asking for your IP address is a violation of privacy and discrimination of alt. this topic is mostly discussion by programmers. allegedly checked this product on the market. but excuse me this product is still a violation of rights and data protection. ethically it is outrageous and smells very much a violation of TOS

Almost everyone would agree that alt accounts are not inherently a problem. (Also, almost everyone has one or more alt accounts.)

That said, there are at least two ways alts can be used to create problems:

1. They can evade legitimate parcel (and Estate) bans imposed on another alt, and
2. They can interfere with certain activities that depend on the RL uniqueness of each participant in order to be fair or fun. (One example of many: giving away money is a lot less fun if a bunch of participants are secretly the same person, greedily gobbling up everybody else's fair shot at the take.)

Hence, it's not at all outrageous to want to limit these adverse effects of alts (and so the TOS rightly does not forbid alt-detection per se, nor the simple collection of IP address information).

This product might be used to prevent the specific adverse effect of alts, but this whole thread is about how it is very bad at that because:

• It's not limited to alts of banned agents on a parcel, but instead bans any alts it discovers.
• It's not constrained to alts simultaneously participating in an activity.
• It's not even constrained to an individual parcel but rather shares alt information across parcels, so anybody who has an alt who was detected anywhere on the grid can never visit any venue where the product is installed.
• We can't tell for sure what else it's doing because it's not open source. That's risky for anything that handles such potentially sensitive information, and this one is especially suspicious because it stores unknown information in a large in-world data store. (The part we can watch it retrieve from that store is pretty minimal, but we don't know what other data it may collect to manipulate elsewhere.)

Some of those reasons are bad for the resident with alt accounts, but they're also very bad for the venue where the device might be installed.

FWIW, the device could have been even worse than it turns out to be, and some posts early in the thread were finding information to dispel some of those concerns. (For example, the "alt detection" URL is an in-world LSL-scripted http server, and that limits the information available to the script. It can get IP address which is how this thing "works", but it can't see all fingerprinting metadata that would be exposed to an external web server.)

[Beq Janus]

5 hours ago, XemmaN said:

More recently, I read it, some experts and gurus of this forum argued that no one has the opportunity to find out your IP address. In addition to the administration of the sl.
In addition, the IP address can be the same for many completely different people living hundreds of kilometers from each other. There are also cases of a common SP address for an apartment building. in which unrelated families live in their separate real estate.
  Looking at the products of this seller, you can see that they are very old. dances in general in 2010

This is a different use case to many that get discussed. When people say that you cannot get a person's IP address form inside in SL this is a correct statement. The only way to associate users by IP is to go to an external service where you as the user have bypassed the anonymity by visiting a website outside of SL. The problem here is that for many people this is a subtle distinction and beyond their understanding. 

[Love Zhaoying]

6 hours ago, Sid Nagy said:

Can you imagine a SL without drama, self importance or FIC behavior?

The FIC is not amused.

[Finite]

1 hour ago, Beq Janus said:

This is a different use case to many that get discussed. When people say that you cannot get a person's IP address form inside in SL this is a correct statement. The only way to associate users by IP is to go to an external service where you as the user have bypassed the anonymity by visiting a website outside of SL. The problem here is that for many people this is a subtle distinction and beyond their understanding. 

There's a certain combat hud that records users IP addresses simply by wearing said hud. Initially you do have to register (not by entering any kind of personal information but setting up what you want your character to be) with the external sim but it records your IP every time you enter a sim where the system is enabled while wearing the hud even after that. The IP info can be accessed by anyone who is granted "GM" privileges which nowadays isn't a vetted process or anything. You merely just need to be a sim owner who purchased said system. Sim owners can also determine who they'd like to also have GM access. 

 

edit: It's been a long time since I was GM for this system so it's possible the creator has since changed it or created multiple tiers of GM capabilities where some don't have access to IP info. But when I was, we could search and sort IP's and determine whose people's alts were.

Edited June 10, 2021 by Finite

[Innula Zenovka]

2 hours ago, Finite said:

There's a certain combat hud that records users IP addresses simply by wearing said hud. Initially you do have to register (not by entering any kind of personal information but setting up what you want your character to be) with the external sim but it records your IP every time you enter a sim where the system is enabled while wearing the hud even after that. The IP info can be accessed by anyone who is granted "GM" privileges which nowadays isn't a vetted process or anything. You merely just need to be a sim owner who purchased said system. Sim owners can also determine who they'd like to also have GM access. 

 

edit: It's been a long time since I was GM for this system so it's possible the creator has since changed it or created multiple tiers of GM capabilities where some don't have access to IP info. But when I was, we could search and sort IP's and determine whose people's alts were.

That's all taking place outside SL, though, and is subject to the GDPR, which is considerably tougher than SL's ToS, so assuming that players have consented to what's being stored and what the GMs are doing with it (big GDPR compliance issues otherwise) that seems reasonable.

The GMs will, of course, be bound by ToS and community standards inside SL (so they can't share information in-world about who is whose alt).

[Malin Sabra]

Talk about a traffic killer, if I landed and got a popup forcing me to visit some website in order to stay I would just leave lol..

[Innula Zenovka]

On 6/10/2021 at 10:08 AM, Qie Niangao said:

Almost everyone would agree that alt accounts are not inherently a problem. (Also, almost everyone has one or more alt accounts.)

That said, there are at least two ways alts can be used to create problems:

1. They can evade legitimate parcel (and Estate) bans imposed on another alt, and
2. They can interfere with certain activities that depend on the RL uniqueness of each participant in order to be fair or fun. (One example of many: giving away money is a lot less fun if a bunch of participants are secretly the same person, greedily gobbling up everybody else's fair shot at the take.)

Hence, it's not at all outrageous to want to limit these adverse effects of alts (and so the TOS rightly does not forbid alt-detection per se, nor the simple collection of IP address information).

This product might be used to prevent the specific adverse effect of alts, but this whole thread is about how it is very bad at that because:

• It's not limited to alts of banned agents on a parcel, but instead bans any alts it discovers.
• It's not constrained to alts simultaneously participating in an activity.
• It's not even constrained to an individual parcel but rather shares alt information across parcels, so anybody who has an alt who was detected anywhere on the grid can never visit any venue where the product is installed.
• We can't tell for sure what else it's doing because it's not open source. That's risky for anything that handles such potentially sensitive information, and this one is especially suspicious because it stores unknown information in a large in-world data store. (The part we can watch it retrieve from that store is pretty minimal, but we don't know what other data it may collect to manipulate elsewhere.)

Some of those reasons are bad for the resident with alt accounts, but they're also very bad for the venue where the device might be installed.

FWIW, the device could have been even worse than it turns out to be, and some posts early in the thread were finding information to dispel some of those concerns. (For example, the "alt detection" URL is an in-world LSL-scripted http server, and that limits the information available to the script. It can get IP address which is how this thing "works", but it can't see all fingerprinting metadata that would be exposed to an external web server.)

Another reason why it's very bad indeed is that there's no ready way I can see to remove anyone's key from the KVP store -- all I can do is whitelist all my accounts on any parcels I control, but I'd have to ask the maker to delete my details from the database altogether, which means my IP address is now in the system and all my accounts other than the one that first tried it are now classified as alts.     

This doesn't worry me because, as I said at the start of the thread, I'm not going to go to any venues that use this kind of device but it might bother others.

I'm almost tempted to write an OS version of this that works only on a particular parcel and applies a rule on the lines of two different agents not on the VIP list may not enter the same parcel using a shared IP address within so many hours of each other, which would stop people rigging contests and so on, using only local memory with no persistent storage.

But not tempted enough, I think, since I regard alt detectors as, at best, an unavoidable nuisance associated with contests and sploders in which I have no interest and almost certainly intrusive drama magnets, so I can't summon up the energy to write one.

 

Edited June 11, 2021 by Innula Zenovka

[Profaitchikenz Haiku]

1 hour ago, Innula Zenovka said:

I'm almost tempted to write an OS version of this that works only on a particular parcel and applies a rule on the lines of two different agents not on the VIP list may not enter the same parcel using a shared IP address within so many hours of each other, 

I'm curious to know how this might affect colleges, businesses, institutes etc that have one ISP provider for their users? I admit it's a bit of a forced scenario given that SL/Opensim is such a niche thing that the chances of there being more than one person at a shared IP address wanting to access the same region at the same time is of the same order as a dead-cert dropping dead on the final furlong, but....

[Qie Niangao]

24 minutes ago, Profaitchikenz Haiku said:

I'm curious to know how this might affect colleges, businesses, institutes etc that have one ISP provider for their users? I admit it's a bit of a forced scenario given that SL/Opensim is such a niche thing that the chances of there being more than one person at a shared IP address wanting to access the same region at the same time is of the same order as a dead-cert dropping dead on the final furlong, but....

In contrast to a sensible open source alternative that Innula described, this device would permanently ban all folks sharing an IP address at any time anywhere it encounters them on the grid. This is among the glaring misfeatures of this device that does make it somewhat tempting to provide an open source alternative.

As I earlier mumbled incoherently, I'd personally favor a module that could apply "surgical" alt-detection to individual rounds of some activity that could specifically benefit from it. Clearly, such a module could be applied to the "activity" of being present on a parcel, as a hypothetical module-interfacing script might discover from llGetAgentList(), but at least it would be possible to be precise enough about it that venues needn't deter many visitors, unavoidable with this device.

Edited June 11, 2021 by Qie Niangao

[Profaitchikenz Haiku]

The only time I ever had problems with a surfeit of alts on the island I ran would not have needed IP-matching to identify them, you could see instantly by their profile descriptions that it was "Oh them again...".

However, this was just an RP environment. I can see the justification for stopping alts invading contests, trying to crowd somebody, or swamping lucky chairs (from my previous experiences I got up to 10 alts of one person so it's not inconceivable somebody could get themselves 26...)

[Jaylinbridges]

14 minutes ago, Profaitchikenz Haiku said:

or swamping lucky chairs (from my previous experiences I got up to 10 alts of one person so it's not inconceivable somebody could get themselves 26...)

But, but, Alts need to dress too.  They hated the Lucky chairs though, because they kept getting the same dresses - I didn't need the drama of two alts wearing the same outfit.

[Jaylinbridges]

How about a vampire clan detector?  I once played at a club that would have costume contests, and there could be 4000 $L on the board for the winners.  One night the costume theme was dress in black.

This rather large Bloodlines clan shows up, they all vote for the Queen and King, who take the $4000 and leave once the winners were announced.  None of them ever tipped the venue or DJ.

I quit that club after I saw that crap, and will never play where money contests are used to bring in a crowd.

 

Edited June 11, 2021 by Jaylinbridges

[Kimmi Zehetbauer]

Then we got the Lindo thing --- which causes a lag fest in many places.

As for the questionable item, the Lab should look into that.