RFC: Deprecate aliases

[calzoneman]

Background

User aliases were added over 5 years ago with the intention of helping channel moderators track when users were evading bans by using different names from the same IP address. This issue proposes a full deprecation of the feature.

Rationale

1. Confusing UX. The landscape of the internet in 2018 means that many users are sharing connections, either via NAT or VPNs. This leads to confusion when users are assigned aliases that don't actually correspond to the same person.
2. Ineffective. The proliferation of free VPN and proxy services means that most users evading bans will be switching IPs, not just names. This reduces the effectiveness of aliases as a moderation tool.
3. Privacy sensitive. In retrospect, tracking user aliases (even though they are temporary) rubs me the wrong way from a privacy standpoint. There has been some discussion about self-service alias clearing in #764, but I feel given (1) and (2) it may be more appropriate to just deprecate the feature.

Comments

I will leave this issue open prior to pushing the commit removing aliases in case there is any discussion from the community on points I haven't thought of.

[thexchan]

Leave it. It helps to keep track of users that join rooms. Not all are smart enough to evade and use VPNs. I really like the feature. It's not breaking anything or interfering. Personally, I don't find it confusing and if I ever had a question for a user, like, "Why is ____ also your alias, I thought that was another user," I just ask them. If it aint broke don't fix it. It's hardly a privacy issue, either.

[ZizzyDizzyMC]

I agree with xchan here, the aliases help to track troublesome users. If someone joins with 8 aliases you know what to expect generally. I've had people show up with my own username as an alias but I know they're probably in my general area passing though. I've used this feature a lot for room moderation, without it my job would be even harder.

[nonfictiongames]

We definitely use the aliases feature. It might not be super effective all the time in telling exactly who someone is, but it is at least a start if you see a user join with a bunch of aliases. Perhaps if you'd like to remove aliases, would it be possible to get some kind of built-in subnet matching (against a room's banlist) in it's place? It's useful in terms of profiling, so it's hard to see it go without some kind of replacement.

[calzoneman]

Thanks for the comments. I'll provide some responses below and pose some more questions in return.

It helps to keep track of users that join rooms.

I am explicitly against tracking users, especially if it is not necessary to operate the site.

It's hardly a privacy issue, either.

Perhaps from your perspective. But consider that on many other websites, users create different accounts for their business and personal uses. Imagine if Twitter displayed "alias: MrShitposter4000" on someone's business account. This is not a purely hypothetical scenario, I've received alias removal requests of this nature before.

If someone joins with 8 aliases you know what to expect generally

It might not be super effective all the time in telling exactly who someone is, but it is at least a start if you see a user join with a bunch of aliases

Incidentally, this is one of the things that makes me uncomfortable about the feature. It feels like it biases too much towards guilty-until-proven-innocent.

Let's review some data I pulled today. It's based on bans, so obviously this doesn't capture users that were dealt with by kicks/mutes/etc. -- feel free to chime in with evidence for that.

About 8.5% of IPs that logged in in the past week have more than one alias, and about 4% of IPs who logged in in the past week are banned. Of those banned IPs, about 21% have multiple aliases, while the other 79% have only one. Of all IPs in the past week with multiple aliases, only about 10% are banned.

My questions to you:

1. What actions do you take on aliased users? If it doesn't lead to anything actionable besides "I watch the user more closely", I don't see how it actually contributes to making moderation any easier, because you can't prove that they'll actually do something stupid until they do it.
2. Approximately, how many aliased users are banned from the same channel repeatedly vs. trolling the index page? If the latter, that seems like a different issue that aliases isn't the right solution for (CyTube should detect and mitigate cross-channel trolling)

I can't think of any other communications platform that I use that offers this functionality.

[calzoneman]

I'm also open to other suggestions people have about building more effective moderation tools. The appearances of the words "track" and "profiling" in the comments here leave a bad taste in my mouth -- I'd much rather build a different moderation feature that catches bad actors without intruding on the privacy of legitimate users.

[Xaekai]

My prerequisites to withhold opposition on this would be adding these features first:

• Captcha or some other form of human verification for account creation
• Optional email verification at the system level
• Checking against a list of known throwaway emails providers and disallowing them for verification
• Tooling in Channel Options for individual channels to make email verification not-optional for either joining at all or just for chatting

The captcha, simply because it's theoretically an open hole for scripted automated account creation using rotating VPNs to get around the accounts-per-ip limit. The verified email requirement, because if we're gonna start comparing to other platforms, it's glaringly absent. I believe this would make it a sufficient pain in the ass for abusive users to harass channels to sunset alias tracking, and are features we've needed for a long time.

That being said, I would still lament the loss of aliases. Perhaps the case of accidental collateral damage; real life example the users xchan and kotafish, brother and sister, once living in the same household. Without aliases, it wouldn't be readily apparent that ipbanning kotafish would also take out xchan.

[calzoneman]

These are all reasonable suggestions. I agree that for the ban use case, the UI should indicate when banning one user would result in banning other users as well.

I'd still be interested to hear more details on how people use aliases. The data I have tells me aliases empirically aren't useful, yet the commenters appear to feel (sometimes strongly so) that aliases are an important feature. The reason I opened this issue was to try to understand the disconnect between those datapoints.

[Xaekai]

I kinda see aliases like the pictures on postage stamps. They serve no utilitarian function at all, but I still like them.

[calzoneman]

Closing for now. Moving account validation discussion to #781. I'll proceed with (1) lowering the default expiration, and (2) the self-service purging as mentioned in #764