IP Addresses / Privacy

Come to my notice just today is the owner of a well known SL game HUD removing accounts of alts. Now as far as I know the only way to find alts is through comparing the IP addresses of users. So is it possible to glean IP addresses through a HUD within SL connected to an outside non-LL server? If that is possible is it a flouting of privacy since an IP Address is personally identifiable information especially when that IP address is applied to the identity of a real person? And if that's possible, what other information is being gleaned?

Why would someone want to remove customers, alts or not?

QUOTE: "Why would someone want to remove customers, alts or not?"

Possibly a power trip but that's not essentially what my question is about.

Sorry, I guess that's off topic. Just bewildered my fuzzy, early AM, pre-coffee brain.

If it's the HUD I'm thinking of, the HUD has nothing to do with it: the "game" requires a website visit, whence it would be mind-numbingly simple to detect the IP address.

Alternatively, if the "game" required a visit to an in-world location, and the viewer enabled parcel media or had parcel audio on, then the client machine's IP address is visible to the streaming host.

The other possibility that comes to mind is if the game involved a third-party viewer which could obviously push the IP address either in-world (perhaps caught and forwarded by the HUD) or to an arbitrary web server. This would be by far the most dangerous scenario because practically anything on the client machine could be shared (or even manipulated); this is why not to use third party viewers unless one is pretty damned sure that somebody trustworthy has examined every line of source that differs from the official viewer on which it's based.

For that particular game, SL (as the client/hud) is just the interface to access to the online game (hosted on a website). As any other web hosted game, is perfect legit to find and eliminate ALT's because of "cheating" (when creating multiple accounts would give to the users an unfair advantage). So when u log into that website your IP is traced, logged, and eventually used to determine if you are "cheating". There's nothing wrong, imo.

But some people use alts for RP situations without "cheating" or whatever. Hard to envision, since the game is not stated here.

I would just add that if the HUD were to send info directly to an external webserver (as with llHTTPRequest()), it would not reveal the IP address of the *viewer*, but rather that of the *sim* in which the HUD's scripts were executing. (Of course there are much simpler ways to track the sim location of an attachment.) So, to reveal their viewer IP address, I think the user would have to actually visit the website directly, perhaps by agreeing to a confirmation dialog popped by llLoadURL().

We're not privy to which "game" is involved, and the one I'd guess is one I've always avoided at all costs, so I'm not sure which of the address-revealing possibilities is at work here. (That is, I don't know if the HUD actually does call llLoadURL() to force the player to that website in order to proceed.)

If it's the game I think it is, the relevance of alts might be gleaned from a thread from across the street: http://www.sluniverse.com/php/vb/general-sl-discussion/21769-too-many-alts-permaban-second.html. In this case (500+ bot-generated alts), the downside was rather worse than just not being able to play the game anymore.

Any time you connect your avatar to a web-based service outside of the grid, you should be aware that you potentially expose information about yourself. That includes parcel media streams.

If the owner of the web-based game wants to restrict play to one avatar account per IP address, that is their decision. It is their game, their rules. They can't use that IP information in any _direct_ way to ban any alts in-world, and quite likely don't even bother to try to associate the names of the alts with the first successful login that used that IP address. All they would need to do is require a registration step on the web-based side to get started (as simple as "what login name would you like to use", or possibly the avatar name, passed via the HUD), and note the IP address associated with that name at the start, eliminating any requests to play from IP addresses that had already been used but which are not already linked to that IP address. The only data they would need to retain would be the list of already used IP addresses, each associated with one login ID, which may or may not be the avatar name of the Player.

Maintaining a cross-referenced database of all the alts that also used each IP address would be completely unnecessary. But even if they did, a Player can't use IP info directly to ban people in-world. They would have to accurately capture and associate the avatar name with the IP, and send that list of associated alts back in-world, to be applied to their parcel ban list or security orb ban list. Which would only affect their land.

And IP lists by themselves say nothing certain about who is an alt. What about families in which multiple family members all have SL accounts and use the same home computer? What about students who access SL from a computer lab at school, or from a computer in a dorm rec room? Several accounts with the same source IP address is a suspicious pointer, but not proof of alts.

If they _publicized_ that data about which alts are associated with which other accounts, they would be violating the TOS, and could get AR'ed for that.

in the forums i have Admined in we would ban with IP's and any name popping up using that IP or any ip that used that name..
if it were an IP used by many people then that person should have been curtious to others..you can play gray area with people that may be breaking a rule here or there but abusing them the gray areas are taken out and it goes to black and white..

i will say though it took a lot to get banned and if they some how did get back in more than once we just did a subdomain ban which took care of many ip's and left notice that this subdomain was banned and if they needed to get back in and were not part of the ban we would restore their ip itself once they contacted us..

like i said..it took a lot for a ban and a major amount of headaches for a sub domain ban..

any time you leave SL you put your information out there..click an outside link and your ip shows on that server just like it shows LL on their servers..
people in SL can't see your IP..they can see your ID number you use in SL.but thats just like an IP for secondlife itself anywas..just liek your name..

if you want to remain silent don't stream media or click links.

The IP that is broadcast to the world when you surf the internet is not really "personally identifiable information". I can give you my IP right now (well, one of them anyway) and the best you could ever find out from it is that I live in the Denver area. The Denver metro area has over 2.5 million people, so I don't think that is really going to do you much good.

Things I can do with your IP address:

1) Get a rough idea whereabouts in the world you are, normally to an accuracy of "nearest big city"
2) Find out who your ISP is
3) Report you to your ISP for breaking the law and have your service suspended and pass your IP and offence details to the FBI/Local Law Enforcement for your area etc.
4) Ping your router and have it say "i'm a router" although by default routers come out the factory saying "no no, nothing here, i'm not answering you".

Your IP address is not the end of the world, and I mention point 3 only because I had to do it once, during a case of some quite serious harassment when I was targetted for some anti-gay hate and had nasty videos made about me and all sorts, I reported the IP address to a department of the FBI which existed for such things who despatched the local sherrif to speak to the guy and his ISP discontinued service. I gained no further information on him than that.

Seriously, unless you are into serious crime, SL users knowing your IP address is not the end of the world and very little can be done with it.

I could get IP addresses of a lot of people in game via various meens, but I cant think of much I would then do with it that would make it worth the while *shrug*.

5) Identify the alt you're using if they can collect enough IP addresses to cross-reference them.

Using an alt as a "cut out" when dealing with someone may be simply playing it safe (you're visiting a location griefers are known to frequent), it may be self-defense (you're trying to avoid an obsessive ex-friend), or it may be malicious (you're a griefer). Regardless of the reasons, you need to be aware that there *are* people maintaining lists cross-referencing IP addresses and accounts.