On some big forums, some users have multiple accounts to support their own opinion, get an extra like, get an extra vote on polling or post offensive to other users.
How can we use discourse to handle issue like this?
Your question is a bit unclear. Are you asking if Discourse can be configured to allow someone to have multiple accounts with the same email address (so they can abuse the forum in the ways you mentioned)? Are you asking if Discourse can somehow stop someone from doing this?
Those kind of accounts are called sockpuppets.
We try to detect them like this: If a new user (i.e., registered in the last 24 hours) who started a topic and a new user who replies in that topic are at the same IP address, both their posts will automatically be flagged as spam. There’s a site setting flag_sockuppets which is enabled by default. Make sure it’s enabled on your site.
It doesn’t look at likes, and sockpuppets replying in someone else’s topic aren’t flagged either. Right now it’s aimed more at spammers who use multiple accounts. One starts a topic, and the other posts a reply that seems legit but links to a spammer site.
You’re describing real people who are trying to make themselves look good, which is different. We track the ip addresses of users, so you can look at the accounts in admin of the suspected sockpuppets and send them a warning or suspend them.
12 Likes
The IPs are visible to admins. So if you see a bunch of users mysteriously supporting each other, you could just look at their admin profile and correlate the IPs.
Eventually you want reports of IPs that have a bunch of users at the same IP, particularly users that tend to like each other’s posts, etc.
Of course, I want to prevent someone from having multiple accounts. Why would I allowing this?
IP addresses would really help on this case.
Multiple accounts were always a problem in discussion groups and were used quite effectively to intimidate honest user. Maybe, it would be nice if Discourse have feature to detect users with multiple accounts 
Your first line of defense is flagging and admins; the tools already exist to make this visible and handle it. There could be more, yes, but what is there now already works.
1 Like
Is there a way to look up all accounts that has an IP shared by a different account?
Click the IP Lookup button on the user admin page. It will show all users with the same IP address.
1 Like
Sorry I wasn’t clear enough! I was wondering if there’s a way to get a list of all accounts that have shared IPs with other accounts? I.e. search the users and find all duplicates.
1 Like
You’d need to do that with a Data Explorer query, I think. That might be a good query to have in our back pocket anyway @simon
3 Likes
Running this as a Data Explorer query will give a list of all users with shared registration_ip_addresses. It will exclude users created through the API, or SSO, where the registration_ip_address is NULL.
WITH users_per_ip AS (
SELECT
count(1) AS user_count,
u.registration_ip_address AS ip
FROM users u
GROUP BY ip
)
SELECT
u.id AS user_id,
upi.ip AS ip_address
FROM users_per_ip upi
JOIN users u
ON u.registration_ip_address = upi.ip
WHERE upi.user_count > 1
ORDER BY upi.ip, u.username
5 Likes
I don’t think you need quotes around all the field names there, unless the field names have a space?
1 Like
Thanks! Assuming you cannot run queries on hosted instance though?
If you don’t have the Data Explorer plugin you can run ActiveRecord queries in the ruby console or queries in the postgresql console. Syntax would be a bit different and most importantly the potential for making a mess of things is much greater so save a backup and know what you’re doing beforehand.
If you are on a Business plan, we can install the Data Explorer plugin for you. It’s not available on the Standard plan.
2 Likes
I have a small question regarding this.
If lets say, a duplicate user on a forum joins with a VPN so the IP addresses are not the same, but then unlinks the VPN - would I be able to then match up the two IP addresses?