3

Would it be possible to ask your ISP for all dynamic IP's that your modem has had/was given? I have to prove ownership of a game account but I do not know which dynamic IP I had when I registered the account.

  • This would depend varying on each ISP. Some countries have laws governing how long ISP's need to maintain IP addressing distribution information and others don't. The second piece to the puzzle is convincing your ISP to give it to you as I would imagine Level 1 support don't have access to those logs. – DKNUCKLES Mar 3 '17 at 18:40
  • 2
    on a human level, just being in the same subnet ip pool would be pretty convincing to me... – dandavis Mar 3 '17 at 20:15
  • @dandavis exactly thank for that I though that would be convincing as well but the customer support don't seem to be able to look at the facts. – 97980 Mar 3 '17 at 21:53
  • 1
    It doesn't hurt to ask your ISP. Some ISP's, especially small ones, might be happy to help you with that request. Generally, most ISP's have the ability to do this quickly as part of this type of request is frequently asked for by law enforcement and/or requested for a variety of lawsuits. Every ISP will behave a little bit differently when asked but it's a reasonable request. My question is how would the game company not know you just forged such an e-mail or letter. I kind of question the value of their authentication mechanism here. – Trey Blalock Mar 3 '17 at 23:26
  • @TreyBlalock he doesn't need the email, just the IP address. If it matches the IP stored in their database, he can recover his account more likely. – Rápli András Mar 4 '17 at 11:21
2

TL;DR: You shouldn't need to, linking account to IP is bad practice.

Requiring a specific public IP to identify an user is unwise from the perspective of the online game team.

Someone may create an account from his smartphone whilst connecting through several random free WiFi hotspots and he would never be able to reproduce the same public IPs. Binding an account to an IP is a bad idea, and using IPs to check a user's identity is as error prone as asking him questions about his behaviour. It is no wonder that Google calls your phone (or your backup phone) when you fail to remember part of your MFA (or lost you main phone).

Real world example

As someone who monitors user activity I never require exact IPs to prove that a certain user is himself. Instead I compare, in a handful of GeoIP databases (3 different ones), the location of the user's current IP and the one that was used during the registration (or other incident with the user). Although GeoIP databases are unreliable, using several of them and then taking the median is often good enough.

If I find that the location is very close and the same ISP is managing the IP, I have no reason to disbelieve the user. If the user registered his account in South Africa and is now, say, two days later, connected to my website from Alaska claiming "problems with the account" I cut communications on the spot.

On the other hand, if I am still in doubt about a user's intentions after I checked his location and ISP I actually perform a ruse and email him something random. For example:

Oh yes, I think, I see your problem! You created the account whilst you were in Marseilles, that's why I could not find it. Am not 100% sure if I'm looking at the right log though, was that you?

(Of course I never got any connection from the given user from Marseilles.) A user confirming this is obviously not the owner of the account.


That's a simplistic example but works pretty well in practice (moreover since this is in the same context of an online game). And as @dandavis already said, this is pretty similar to the fact that the same IP pool is convincing enough.

This kind of bad practice kills a business. Notably because of the example with the smartphone above, you can't ask a user who was surfing your page/app/game on a random free WiFi to get the IP address. And users who forget their passwords and erase cookies, or simply cannot remember how to login are very common.

0

It's unlikely that you will be able to navigate your ISP's bureaucracy in order to find your IP address history (if they even log it, and if any of their admins are able to find it... and they may have some legally motivated reasons not to).

Something you can try if you use any online cloud services (like Google or Gmail) is you can look at your account activity and see what IP addresses accessed your account at that time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.