From NS Security to Stalking

[The Iron Rebel]

At a certain point the work that is conducted in a forum security check goes from a reasonable check into a possible new forum member, and it transitions to admin sanctioned stalking. I understand that people do not want those who commit abuses to return to their forums, or even those who are widely known as abusers to ever even join their forum. However I think the line of reason is taking an IP address, running it through your forums IP checker to make sure it’s not in use by a current member or previously used by a banned member. It is my belief that anything further is going too far, it should not be acceptable for someone to take that IP and run a search to see where it originates from. If you take away the security position and it was a just a user finding out IP’s and looking them up they would be called a stalker for finding out the near bouts of where someone lives. I don’t think anyone in this game should be encouraged to conduct this behavior, people have a right to privacy, not everyone wants a group of people to know just exactly where in the world they might be located, and those who take security to this level in my opinion are over glorified stalkers.

[Karafuto-cho]

What?

[Galiantus VII]

1. Only moderators get to see that.

2. It's your choice to use the site. The owners of the site get to have some idea who is using it.

3. Why is this not in Technical?

[Consular]

Kind of a weird post but okay.

Your IP address is not private. Any website you visit can see (roughly) where you are from.

[Fratt Armed Forces]

Is this in response to a specific incident?

IP addresses are 'personal information', but they cannot be used to meaningful identify someone in real life. Locations are vague enough that there would be thousand of people (at best) in that area and using that ISP.
You would need to do a lot more work to match that with a real-world identity (and even that, however creepy, would not constitute 'stalking' in most jurisdictions).

3. Why is this not in Technical?

It refers to security checks performed by forum administrators in offsite communities (to weed out IC or OOC threats to the region... in-game 'enemies', banned members who are trying to evade their bans, and so on), not to the NationStates site.

[Petyr]

1. Only moderators get to see that.

That is true if everyone is playing by the rules. There's a pretty common gameplay tactic to use an image to steal someone's IP without them even knowing, you can give your IP away if your browser so much as displays an image you didn't realize where was hosted.

A pretty high-profile gameplayer lost their main nation due to sending one such image to me in-game, but if I wasn't as experienced a player and known what I was looking at immediately he might have gotten away with it.

I say this not to encourage bad behavior (he did have his nation deleted and outed for his creepyness, so bad plan) but to warn others that you're IP isn't necessarily safe just because you stay on site. Looking at one sneaky factbook/dispatch/forum thread can give your IP away.

As Fratt says, that alone should not concern you: but if you have shared even just your RL first name, that can change things. For instance, if you Google my IP address it will give you my town, and if you go on Facebook and type "RealTown: John" (my name isn't really John) you get 3 results. One is me, two are not. So you'd need a little more info, but you've got it pretty close at that point. An age would pinpoint me.

Anywho, not to sound super-dark or like an old person who is scared of the internet: My point in all of this is you don't have much of a choice whether you share your IP while on the internet. That's how it works. But you do have a choice to share basically all other real info that could be used with an IP to identify you, so don't do it!

[Jonewest]

An unfortunate side effect to people hiding behind foreign ip's to circumvent bans/avoid detection, I have to side with the fuzz on this one. It is indeed creepy the precision that some will go to know exactly who you are, or at least who you are is who you say you are. I know in previous years some people shared logs of ips that they knew were dos or otherwise a threat to the game. While this practice is very meta it is somewhat needed to weed out possible forum crashers, undesirables, or otherwise threatening persons. In much the same way it is a gameplay duty it's also a duty to protect your community from malicious individuals. I've ran across more than one mentally unstable persons while browsing ns and as part of previous administration teams I've had to proverbially escort a creep or two to the door.

I think it's an unfortunate but currently necessary tactic to responsibly track would be malcontents. The image grabbing is probably going too far though...it's seriously effected my ability to display beautiful signatures and avatars

~Jone Winter

[Drop Your Pants]

Solution: Be a very open player so they don't need to check your IP.

[Jonewest]

Solution: Be a very open player so they don't need to check your IP.

Assume the position.

[USS Monitor]

If you're concerned about privacy, be careful of whose forums you visit and consider using proxies.

[Tim-Opolis]

If you're concerned about privacy, be careful of whose forums you visit and consider using proxies.

Since it's relevant to the conversation, I'd like to quickly address USS Monitor's suggestion in regards to proxies. On most of your well-established Gameplay Region off-site forums, especially if they're involved in any amount within R/D, using a proxy is going to get you banned on that forum unless you cease usage of it. Generally, you'll be told you're on a proxy and either need to provide a very valid excuse for it or have to cease usage of that proxy. Saying you're doing it for your "personal privacy" is a one-way ticket to being banned, given the ease with which someone could then infiltrate a region if we believed every half-baked excuse about wanting to use a proxy for privacy concerns.

Whether we like it or not, forum and operational security are major issues for GP Regions to address, and they're not going to stop addressing them any time soon. As much as I'd love to live in a world like The Iron Rebel describes, where the only thing we do with IP addresses is see if they're already registered on our forum, that's not going to happen. We run them through blacklists, we run them through proxy checks, and we run their geolocation data. If you're referring to those action being glorified stalking, you're going to have to address the fact that the entirety of R/D and beyond runs through similar security systems and is very unlikely to be stopping from doing that.

[USS Monitor]

If you're concerned about privacy, be careful of whose forums you visit and consider using proxies.

Since it's relevant to the conversation, I'd like to quickly address USS Monitor's suggestion in regards to proxies. On most of your well-established Gameplay Region off-site forums, especially if they're involved in any amount within R/D, using a proxy is going to get you banned on that forum unless you cease usage of it. Generally, you'll be told you're on a proxy and either need to provide a very valid excuse for it or have to cease usage of that proxy. Saying you're doing it for your "personal privacy" is a one-way ticket to being banned, given the ease with which someone could then infiltrate a region if we believed every half-baked excuse about wanting to use a proxy for privacy concerns.

Whether we like it or not, forum and operational security are major issues for GP Regions to address, and they're not going to stop addressing them any time soon. As much as I'd love to live in a world like The Iron Rebel describes, where the only thing we do with IP addresses is see if they're already registered on our forum, that's not going to happen. We run them through blacklists, we run them through proxy checks, and we run their geolocation data. If you're referring to those action being glorified stalking, you're going to have to address the fact that the entirety of R/D and beyond runs through similar security systems and is very unlikely to be stopping from doing that.

If those are your rules, and someone finds them unacceptable, then they don't have to use your offsite forums.

[Tim-Opolis]

Since it's relevant to the conversation, I'd like to quickly address USS Monitor's suggestion in regards to proxies. On most of your well-established Gameplay Region off-site forums, especially if they're involved in any amount within R/D, using a proxy is going to get you banned on that forum unless you cease usage of it. Generally, you'll be told you're on a proxy and either need to provide a very valid excuse for it or have to cease usage of that proxy. Saying you're doing it for your "personal privacy" is a one-way ticket to being banned, given the ease with which someone could then infiltrate a region if we believed every half-baked excuse about wanting to use a proxy for privacy concerns.

Whether we like it or not, forum and operational security are major issues for GP Regions to address, and they're not going to stop addressing them any time soon. As much as I'd love to live in a world like The Iron Rebel describes, where the only thing we do with IP addresses is see if they're already registered on our forum, that's not going to happen. We run them through blacklists, we run them through proxy checks, and we run their geolocation data. If you're referring to those action being glorified stalking, you're going to have to address the fact that the entirety of R/D and beyond runs through similar security systems and is very unlikely to be stopping from doing that.

If those are your rules, and someone finds them unacceptable, then they don't have to use your offsite forums.

I completely agree.

[Vaculatestar64]

If those are your rules, and someone finds them unacceptable, then they don't have to use your offsite forums.

I completely agree.

My fingers are physically hurting as I type this due to the fact that I am agreeing with Timmeh there but he is absolutely correct. We gave to protect not only our gameplay interests, but our players from some of the more malicious individuals that have played this game, and we have to protect our regions from mod action by keeping out DOS players. So I mean, until all of the trolls and criminals leave the internet (lol, RIP me, I'm a troll ) our security measures will have to remain in place not only so we can play the game, but to actually protect ourselves from people who take security measures to far and go after people IRL.

[Escade]

From what I understand here, an IP does not give a person your name\address\information that can help them appear at your house like a knife weilding psychopath.

An IP gives an approximate radius of a town or something?

The issue of doxing or the threat of doxing is separate from the issue of IPs and their general use on NS or forums, yes?

I am interested in the image thing, how would a standard user identify images or should you just avoid clicking on things from sketchy people? Also what about Discord? Does this apply on Discord as well?

[Cresenthia]

From what I understand here, an IP does not give a person your name\address\information that can help them appear at your house like a knife weilding psychopath.

An IP gives an approximate radius of a town or something?

The issue of doxing or the threat of doxing is separate from the issue of IPs and their general use on NS or forums, yes?

I am interested in the image thing, how would a standard user identify images or should you just avoid clicking on things from sketchy people? Also what about Discord? Does this apply on Discord as well?

Although an IP address would not give name or address, yes, it can sometimes give the town you live in.

With regards to Discord, they give a preview feature for images, that should be secure. But never, never click on something if you aren't sure about where it's coming from.

[The Blaatschapen]

<snip> and we have to protect our regions from mod action by keeping out DOS players. <snip>

We go after regions for having DOS people on their offsite forums?

To the best of my recollection, we don't.

After all, who you hang out with offsite is none of our concern. It becomes different when someone who has been disinvited from here, gets help from you(general you o7) to get onsite.

That said, it's not a bad practice to ban DOS people offsite

[Cerian Quilor]

But can't talking NS with DoS people quickly run the risk of running up against Modly action?

[Mallorea and Riva]

But can't talking NS with DoS people quickly run the risk of running up against Modly action?

It's a judgment call. Talking about NS with a DOS may not in every case be problematic. It certainly can become problematic quickly though. Solution? Don't put yourself in a situation where things are getting problematic, and if you find yourself in such a situation despite best efforts to avoid it, let us know via GHR. Candor serves players well.

[Vaculatestar64]

<snip> and we have to protect our regions from mod action by keeping out DOS players. <snip>

We go after regions for having DOS people on their offsite forums?

To the best of my recollection, we don't.

After all, who you hang out with offsite is none of our concern. It becomes different when someone who has been disinvited from here, gets help from you(general you o7) to get onsite.

That said, it's not a bad practice to ban DOS people offsite

Not specifically for having that person on the forum, but the situation quickly becomes an extremely slippery slope.

[Cerian Quilor]

But can't talking NS with DoS people quickly run the risk of running up against Modly action?

It's a judgment call. Talking about NS with a DOS may not in every case be problematic. It certainly can become problematic quickly though. Solution? Don't put yourself in a situation where things are getting problematic, and if you find yourself in such a situation despite best efforts to avoid it, let us know via GHR. Candor serves players well.

That's what I figured, hence why regions try hard to make sure DoS people aren't on their forums.

[Consular]

That's what I figured, hence why regions try hard to make sure DoS people aren't on their forums.

Do they?

[Biyah]

IPs will only give a geological location, and that can be incorrect too, depending on how the ISP updates its cache after reassigning IP blocks. I just switched out of a block that was incorrectly labeled as West Virginia, for example.

You have to have some pretty significant skills or access to a backbone to go any further than that. Anything else to narrow a person down (IE, age/name/city/etc) is entirely up to said person, you can share as much or as little of your personal identity online as you like. If you share enough, then sure enough, someone could probably pinpoint you.

Anyway, IPs are not private, they're the public identification agent for information being transferred back and forth on the web. Collecting them isn't illegal either, as you could go get full blocks of IPs from ARIN (American Registry for Internet Numbers, the defacto switchboard and sale agent for IP addresses. ) that includes ISP owner, geo-tag and location, amongst other things. This is all open information, and contrary to standard fears, it's rather difficult to track down and hack someone based on that.

This only becomes illegal if you start attaching personal information to those ips , like email addresses and fb accounts, and then giving away or selling that information. There are some shady people on NS, but I only know of one who has ever done that. Those of us who still play intel/counter-intel are paranoid careful about our IP bibles, and none I know would tolerate that kind of behavior. It's one of the things we look for.

I guess, in the end, the thing to know is that you can avoid regions in which you are going to be subject to scrutiny of this type. If you really want to be careful, stay put on the Official Forums. If you step off into military gameplay, you're going to be vetted.

~B