How badly do you want to keep open registration?

Badly enough to do things like permabanning every account that's used the same IP address as a permabanned user? ANY of the IP addresses that user's logged in on? I've heard of stuff like this, and it scares me, but I can see how you'd get pushed into the situation where it's necessary. I mean, if you're going to actually punish people using free anonymous accounts to do their dirty work, what else are you going to do?

We have multiple ways to identify accounts that are linked and potentially owned by a single individual who has violated the community standards or Terms of Service to the extent that a permanent ban is warranted. IP address is one way, but it is somewhat unreliable. For example, at one point we banned an IP address and ended up banning the entire state of Vermont (this was early on). Clearly that was not the desired result!

There is a lot of exciting work being done to create portable identity on the Internet, allowing for better authentication of identity and the ability to tie an account to a specific individual. As we bring these new technologies into Second Life, we'll be able to replace the existing "verified with payment information" system with something both more reliable and more fair. I hope we'll start to see this transformation in the first half of 2007.