Question about security/tracking capabilities

[caldera]

Hi everyone,

A board of which I am an admin is looking to transition from an old BBS to perhaps vbulletin. We are a moderately trafficked regional sports-related message board.

One question that we've been discussing is related to the ability to keep some more negative users under control. We have a problem currently with banned users coming back under different accounts or impersonating others. We have the ability to block an IP, but sometimes this would block someone else that we don't intend to ban, or - well, it seems easy for people with know-how to skirt. (I'm not an expert on this at all)

I heard from someone else that vbulletin has more capability here, such as the ability to identify a user based on the device they are using (is this the MAC, or something else?) or some other way beyond just the simple IP. Can someone explain how this works? Is this a complete solution, or are there ways around whatever this feature is?

Thanks!


VK

[Wayne Luke]

We only track users by IP address. We also allow banning by email address or portion thereof in addition to banning by IP address or portion thereof. If you want to keep people off of your server, you should really do this at the server level. Typically the Device MAC address is not available outside the local network so we wouldn't have access to that. The best we would have is the Router MAC address. However, if blocking someone by IP Address blocks others, then blocking by a Router's MAC address would most likely do so as well. Everyone goes through a router somewhere. Mobile, Desktop, Home Network, etc... all use routers to keep traffic flowing between networks.

[caldera]

Ok, thanks Wayne. Someone I met who is an admin on another board said they are able to somehow identify a user's device, such as a specific laptop or tablet, and recognize re-registrations that way. I just wondered if that was part of vbulletin or maybe something else.

[BirdOPrey5]

There is a 3rd party add-on for older versions of vBulletin that uses a cookie to determine if a user returns with a different username but these days that is very easily defeated as all browsers make it easy to delete cookies for specific sites. It's not really useful anymore. I can't imagine any other option being used on a forum besides cookie or IP address.

[Wayne Luke]

Ok, thanks Wayne. Someone I met who is an admin on another board said they are able to somehow identify a user's device, such as a specific laptop or tablet, and recognize re-registrations that way. I just wondered if that was part of vbulletin or maybe something else.

If you're running an Enterprise network, there are many tools to track this.

For the average website running in a datacenter somewhere, the cost isn't worth it. There are thousands of sites out there that will mask your IP address through a proxy or VPN. They will even mask any other identifiers. Many of them are free. Or the user can just go get free WiFi at McDonalds and bypass any checking.