0

Let's say I am a member of a website. I always sign in from computer A, which is not linked at all with computer B, and I have always signed in from my home network.

Now let's say my ISP releases the old IP, and I'm given a new one (still using the same modem and plan). I do NOT sign in or connect to any servers associated with the website on computer A after this change occurs. And now I want to become a member on computer B, which has never visited any website or been linked with computer A in any way.

Is there a way that the website could know that the new IP is connected to the old one? Does the IP being under the same subnet or ASN affect this? How, and why?

1
  • Are you using a browser that syncs accounts/cookies?
    – schroeder
    Jan 18 at 12:15

3 Answers 3

0

You don't explicitly say so, but I assume you're not going to sign in with your old account from B, and that you'll use a new email address, etc. when you create a new account.


Short of compromising the ISP, or you copying data (e.g. transferring cookies) from A to B, not reliably. IP addresses are given out over moderately large geographic areas (ever seen a GeoIP service think you're a couple cities over from where you are? That's the level of resolution they have) and all IPs within that pool are interchangeable as far as an outsider is concerned.

It might be able to guess based on any number of signals (e.g. if you use the same browser on the same OS with the same extensions installed on both A and B, browser fingerprinting can do a surprisingly decent job of matching and if there's not a lot of people running that particular configuration it might be literally unique on that site to just your two machines) but it wouldn't be possible for the site to confidently assert that it's the same user.

0

Ooh! This is a tough question!

In short, yes inferring a connection is possible even if the IP address and computer change.

Let's dig into it a bit. Any number of clues can be used to infer a connection. With your description, we have already ruled out some of the more obvious clues like static IP, session cookies, web side-channel analysis, cached canaries, etc. Since you specifically stated ASN is in-bounds, let's start there.

The ASN for the IP issued by your ISP may change when you are issued a new IP, but that is unlikely for most ISPs. Regardless of if your ASN changes, the organization will not (unless you switch ISPs). The network size described by your ASN is very relevant. If you have a small ISP with a /23 then the pool of potential humans behind the IP is in the hundreds. A larger ISP with multiple /12 has a pool in the millions.

Reverse DNS could be a factor. Some ISPs issue DHCP leases from IP address pools pre-configured with reverse DNS local to a specific neighbourhood.

GeoIP, as others have mentioned, may be off by a couple cities. But it could be accurate to the neighbourhood. It depends on your IP block and which GeoIP database you look it up in. The free/public databases are rarely as good as certain paid services.

Keyboard layout and typing profiles can be identified by the timing of keypresses when entering your username/password or filling out account registration forms. Timing analysis of keystrokes can even guess what is being typed by measuring the delay between key presses. If the analysis is being performed by the site that you are entering data into, then they already know what keys are being pressed and that makes for an even more solid digital fingerprint of typing style.

What are your scrolling habits? What parts of the site are you more likely to peruse? What advertisements catch your eye? How long does it take you to click on a thing you are interested in? What times of day, or days of the week are you on the site? It sounds absurd and creepy that anyone would pay attention to this information but this is exactly the kind of data collected by online advertisers. And yes, a website can track mouse movement with javascript which optionally feeds the data back to the site. Not only can sites tell what you click on and when, but they can capture the shape of the path your mouse takes when moving from one link or button to another.

So far, we have considered some passive information gathering methods. There are active methods too. OS and browser specific exploits can be used to compromise computer B. From there, options spiral in dizzying directions. Enabling a camera or microphone, scanning the internal network for computer A, or scanning for another device that was also known to computer A, just to name a few. To the potential extreme of mapping out component serial numbers and stumbling across sequential serials between computer A and B. Memory modules, hard drives, mother boards and dozens of other chips inside the average computer all have unique identifiers.

In this hypothetical scenario, the breadcrumbs that a hypothetical investigator may determine conclusive are darn near impossible to predict. But the landscape of potential breadcrumbs in a digital world is vast. To be clear, any active information gathering takes far more effort than is financially viable for a small organization en-mass. There is also significant risk involved. So if you aren't carrying around nation-state secrets or the formula for WD-40, then this is just a thought experiment. And chances are, nobody will guess that you are the same person who already registered a free trial on some "cat picture" website.

Certainty is not required to infer a correlation.

0

As said by @Kenny

Certainty is not required to infer a correlation.

First of all, it depends on the nature of the website you're attending. Say it's a casual Internet forum: it's likely that nobody is spending their time scrubbing the logs, unless they need to perform ad hoc investigations in order to unmask duplicate accounts, nasty trolls or cyberbullies. Unless you are drawing attention to yourself, you would probably pass undetected. Because nobody is proactively looking for duplicate accounts.

Second, it depends on the data retention policies of the website in questions. The webserver logs are typically archived/pruned after a few weeks. On the other hand the forum software may record the IP address for every post in the database. So it means that your former self from computer A still has history, and that history can be mined for possible relationships. If you can identify the software used on the website, then you can find out by yourself what kind of data is available to the website operators.

Some websites do active auti-fraud screening, this is certainly true for the marketplaces and E-commerce sites. They look at the patterns, which means that a lot of factors are aggregated to find correlations, not just the IP address.

Say that you are a customer of a small regional ISP, that we call Acme Internet Services of Arizona (AISA). It happens that you are the only one member of that website using AISA. Even if your IP address changes, you still stand out from the crowd because you are a relative anomaly in the "dataset".

This is probably the most crucial factor.

And then there is personal engagement. What is your daily interaction with the website ? Back to the forum example: dupes are betrayed by their writing style, expressions, arguing tactics. The more content you post, the more data to compare and analyze. Some people try to hide but like a leopard they cannot change their spots :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.