We outsmarted CSGO cheaters with IdentityLogger

> If a player joins with a different Steam ID but with an IP address that is already banned, the system now re-bans them

This works great until you realize you're punishing innocent players because of CGNAT and IP addresses getting rotated. Cheaters usually know how to get their router to request a new IP address. That IP address then gets assigned to someone else later.

Yeah, you would think they would rely on their secret cookie in that situation instead, to minimize false positives like that.

They addressed this in the section entitled "Problematic cases of IP address fingerprinting"

That was addressed in the article.

This scenario definitely did pop up and we would review it on a case by case basis to unban users or make exceptions. However, it was quite rare. Only a handful of reported instances over several months. If our servers were more popular we definitely would have run into it a lot more.

I would wager most people just move onto a different server - leaving you with useless/suppressed data on how many people this may have impacted.

No, not specifically. That section is still written under the misconception that IPs are bound to households, or static networks like university networks. Instead they can swap at the very least country wide (or rather, however the provider manages the IP addresses it controls). Their mental model is just not how the internet works.

By using IP as the ban id they created a system that constantly and regularly banned completely innocent steam IDs, thinking they are somehow linked when a new steam id uses a banned IP, which is nonsense. They just did not notice because the banned gamers did not complain.

Being from country with lot of IPs for operators. I did some packet sniffing on DHCP broadcast traffic seen by my router(ISP should filter that...) and I saw at least 3 non-continuous public IP blocks... And that was just day or less of monitoring this traffic...

So if the same connection(plug in wall) can end up with IPs from different blocks, well, trying to do anything sensible with this is too complicated.

You would need to ban random people and see how many of them report it to estimate the real amount of such errors.

I always found it funny how ip bans seemed to be so popular despite being apparently completely ineffective until I realized this was mostly a US thing. In my country (2 of them that I've lived in, in fact) ISPs always assign the client a dynamic address from their very large pools every time I reconnect. This was as true back in the 28.8kb dial up days as it is in the 10gbit FTTH days we live in. Having a static IP address here has always been a service you have to pay for.

I remember this being hilarious when idiots would ip ban me back on the IRC days: "oh no, I have to press the reconnect button!"

Is it ? I'm not in the US and I've always had a fixed IP.

Which seems to have been best practice for IPv4 and is still best practice with IPv6 :

https://www.ripe.net/publications/docs/ripe-690/#5--end-user...