[Brainstorm] Mechanism for Enforcing One Account Per Person

[Meeplelowda]

This problem ripe for an implementation of a zero knowledge proof. The proposition is how can we set up a system in which BGA can verify the truth of the statement "there is no other existing account associated with me on BGA" without the person having to reveal anything about themselves, which many users would not be comfortable with?

From the start I'm removing cryptographically hashed biometric information from consideration because 1) I'm not sure that meets the criteria of not revealing anything about your identify and 2) it likely violates the criterion of not requiring the disclosure of information to BGA that people aren't comfortable giving.

[Meeplelowda]

So far the only zero knowledge proof protections against a Sybil attack (which is basically what multi-accounting is) that I can find all involve cryptographically hashing something that's sensitive, like biometric data or something encoded in a government-issued ID.

I'm geeking out here. Here's a paper about how to protect against Sybil attacks even if someone colludes with the attacker and lets them use their ID to make another account: SybilGuard: Defending Against Sybil Attacks via Social Networks. Can BGA learn something from how you detect "Sybil nodes" (discussed in the linked paper) that's more sophisticated than whatever they are doing now to try to detect alts?

However, given my premise above that the average BGA user doesn't want to use any kind of ID or biometric data to make an account, this mechanism for policing new accounts won't work.

So, I'm wondering if instead it's possible to prove that you cannot definitively protect against a Sybil attack without using an ID or biometric data.

[Jellby]

So, I'm wondering if instead it's possible to prove that you cannot definitively protect against a Sybil attack without using an ID or biometric data.

Before you can prove that, you have to define what is "one person".

Are "me" and "me 5 years" ago the same person?
Are two twins the same person?
Were Prince and TAFKAP the same person?
If I get dual citizenship and therefore have two different government-issued IDs, am I a single person?
If Jane transitions to Joe, are they the same person?

[Meeplelowda]

So, I'm wondering if instead it's possible to prove that you cannot definitively protect against a Sybil attack without using an ID or biometric data.

Before you can prove that, you have to define what is "one person".

Are "me" and "me 5 years" ago the same person?
Are two twins the same person?
Were Prince and TAFKAP the same person?
If I get dual citizenship and therefore have two different government-issued IDs, am I a single person?
If Jane transitions to Joe, are they the same person?

I can't tell if you're joking or not, but I'll play along. One person is a human body, or portion thereof, under the control of a human brain within that body that could be uniquely identified with non-DNA biometric markers.

[FrankJones]

So, I'm wondering if instead it's possible to prove that you cannot definitively protect against a Sybil attack without using an ID or biometric data.

Before you can prove that, you have to define what is "one person".

Are "me" and "me 5 years" ago the same person?
Are two twins the same person?
Were Prince and TAFKAP the same person?
If I get dual citizenship and therefore have two different government-issued IDs, am I a single person?
If Jane transitions to Joe, are they the same person?

1) Yes. The only counterargument would a metaphorical one: "Give me a second chance, I'm not the same person I was 5 years ago."
2) No. Two different bodies and two different brains.
3) Yes. A name change does not create a different person.
4) Yes. Having different pieces of paper or plastic saying different things about a person does not create a second person.
5) Yes. Similar reasoning as numbers 1 and 3 on this list. Different point in time, different name, but still the same person.

[FrankJones]

What makes me curious is:

How prevalent is this "problem" exactly? I assume it is only a problem in partnership games, because I have played a large number of games this year and I cannot recall ever feeling as though I were experiencing being cheated by a multi-accouter.

I've played a lot of spades also (Well, maybe not "a lot" in comparison to people who mainly play that game and nothing else) and I've never encountered colluding opponents.

BGA should take steps to minimize the occurrence of this form of cheating while acknowledging that it is impossible to completely avoid or eliminate.

If banks cannot completely eliminate fraud and phishing, wouldn't we be asking a lot of a board game site to try to eliminate or prevent all forms of board game fraud? Especially when the "solution" becomes more of a problem than the original problem? (Such as the ridiculous Elo penalty for a 3rd consecutive win against the same opponent).

[Jellby]

I can't tell if you're joking or not, but I'll play along.

Only half-joking. I'm serious in that I believe it's a bit like the definition of "life": we all know what it means, but no one has come with a definition that satisfies everyone in all cases.

One person is a human body, or portion thereof, under the control of a human brain within that body that could be uniquely identified with non-DNA biometric markers.

What is identified with biometric markers, the brain or the body? We all know bodies change with time, and I'm pretty sure brains do too. At atomic level most, if not all, of the atoms that form our bodies are completely replaced after some time. At cellular level is pretty much the same. (I'm not quite so sure about the brain: it was once said that neurons are not replaced, but I believe I saw some reports recently on the contrary. In any case, the connectivity of the brain definitely changes.) It's the Ship of Theseus paradox.

Ultimately, I guess we want to link a "person" with a "conscience", but how do define conscience? How do we know two are the same or not (from the outside)?

The thing with multiple or changing IDs is that even that is not a sure way to uniquely identify a person, since one can have many (and in some cases many can share one, even if it's by some administrative error/mistake).

[Cappa]

What makes me curious is:

How prevalent is this "problem" exactly? I assume it is only a problem in partnership games, because I have played a large number of games this year and I cannot recall ever feeling as though I were experiencing being cheated by a multi-accouter.

I've played a lot of spades also (Well, maybe not "a lot" in comparison to people who mainly play that game and nothing else) and I've never encountered colluding opponents.

BGA should take steps to minimize the occurrence of this form of cheating while acknowledging that it is impossible to completely avoid or eliminate.

If banks cannot completely eliminate fraud and phishing, wouldn't we be asking a lot of a board game site to try to eliminate or prevent all forms of board game fraud? Especially when the "solution" becomes more of a problem than the original problem? (Such as the ridiculous Elo penalty for a 3rd consecutive win against the same opponent).

its a non issue outside of maybe one or two, coop games.

[ResonanceSM]

What makes me curious is:

How prevalent is this "problem" exactly? I assume it is only a problem in partnership games, because I have played a large number of games this year and I cannot recall ever feeling as though I were experiencing being cheated by a multi-accouter.

I've played a lot of spades also (Well, maybe not "a lot" in comparison to people who mainly play that game and nothing else) and I've never encountered colluding opponents.

BGA should take steps to minimize the occurrence of this form of cheating while acknowledging that it is impossible to completely avoid or eliminate.

If banks cannot completely eliminate fraud and phishing, wouldn't we be asking a lot of a board game site to try to eliminate or prevent all forms of board game fraud? Especially when the "solution" becomes more of a problem than the original problem? (Such as the ridiculous Elo penalty for a 3rd consecutive win against the same opponent).

Can't speak to.how prevalent, but I definitely know of at least one highly likely situation in a different team based card game.

You do also hear a about this in games like Catan where someone can actively support someone else with trades, attacks/non-attacks. But those are probably easier notice and prove as collision.

At the same time there are four people in our family who play and we often share devices (we don't cheat... But that's exactly what a cheater would say...). So it would probably be really hard to distinguish us online.

[Countes-Olivia-Manny]

Security needs to be significantly improved on this site.
Anyone can create as many accounts as they want, and nothing is done about it.