[WMTech] Sticky Multiple Account Info v1.2.2
Change log
Changelog
1.2.2
CHANGED: the detection check no longer runs on a random 1-in-N page views. A browser now checks in at most once per Check Interval (new option, default 60 minutes), and immediately whenever a different account logs in, which is the only thing a repeat check can ever discover.
At the old default a member browsing forty pages an hour triggered roughly nine checks. It is now
one. Each check costs a request, two database writes, and -with fingerprinting on- a canvas
render and around a hundred font measurements on the visitor’s own machine.
REMOVED: option Random Check Trigger Frequency, together with the hourly cron entry and the online-member counter that existed only to feed it.
CHANGED: the device fingerprint is now computed at most once a week per browser instead of on every check. This also makes it more stable, which is what Hardware Matches relies on.
CHANGED: Sightings on a member’s device list now counts check-ins rather than page views, so new numbers are much smaller than ones recorded before this release.
CHANGED: Hardware Matches now judges a row by network as well. A fingerprint shared by accounts on different networks is listed and badged, but no longer counted as something to act on, on a board with many identical phones those were drowning the number that matters. Rows worth reviewing sort to the top.
If you are upgrading from 1.2.0 or 1.2.1, read this:
The old setting cannot be carried over, the two mean different things, so every board lands on 60 minutes regardless of what it had. If you had Random Check Trigger Frequency set to 0 believing detection was off, note that it never was: the forum index was always checked. Those boards will now check once an hour per browser.
1.2.0
Detection engine replaced.
NEW: device identity issued and signed by your own server, stored across an HTTP cookie,
ocalStorage, sessionStorage, IndexedDB and the Cache Storage API.
NEW: the cookie is set server-side, HttpOnly and SameSite=Lax, Safari caps script-set cookies at seven days, so the old engine’s cookie expired weekly there.
NEW: optional device fingerprinting, with three modes and an IP co-factor. Defaults to Record only, which never acts on a match.
NEW: options Device Fingerprint Handling and Fingerprint Match Window.
SECURITY: device identities are signed per installation. The old value was derived from the user ID by a published formula, so anyone could impersonate another member’s browser and force a false detection against them. Which, with Moderate All Multiple Accounts enabled, suspended that member’s account.
SECURITY: creating an exemption now requires a CSRF token. It was reachable from a plain link, so a crafted page could make a logged-in moderator create exemptions unknowingly.
FIXED: the 1.1.x engine did not run at all. colorname.js referenced an undefined global and threw before the script started, so boards detected nothing while appearing healthy.
FIXED: exemptions matched member IDs as substrings, so user 1 matched the pair 5-51 and user 5 matched 15-25, unrelated members appeared exempted, which dissolved real detections.
FIXED: exemptions were ignored entirely in sets of more than two accounts.
FIXED: a failed rebuild called a method that does not exist and would have crashed.
FIXED: a rebuild that died part-way locked detection out permanently. The lock now expires.
FIXED: one deleted member broke the whole Admin CP list page.
FIXED: duplicate exemption rows could accumulate; the pair column is now unique.
FIXED: report dates ignored the board language and the viewer’s timezone.
FIXED: the file health check reported six files as missing on every board, because it listed files the add-on has not shipped for years.
REMOVED: Flash, evercookie, WebSQL, userData, globalStorage, window.name, and the PNG, ETag and web-cache revival endpoints.
REMOVED: the Disable Flash Detection Engine option
CHANGED: changing the cookie name no longer resets detection.
CHANGED: pruning and the member lists no longer issue one query per member.
NEW: the Admin CP member tab lists that member’s devices, and any fingerprint matches, which is what makes the default Record only mode visible.
FIXED: Deny Registration of Multiple Accounts could never fire, because it tested the device ID as if it were an account token.
FIXED: the device cookie was set but never read back, so clearing a browser’s site data while keeping cookies defeated detection, the longest-lived store contributed nothing.
FIXED: a browser that had just been cleared could never be matched by fingerprint, which is the one case fingerprinting exists to cover.
FIXED: diagnostic warnings were serialised to an empty string and lost.
FIXED: a detection request that did not ask for JSON was answered with a full HTML page.
FIXED: deleting a member left their device sightings behind.
FIXED: removing a member from a set could drop a different member instead, when the member being removed was not in the set.
FIXED: a failed table creation during install reported success.
FIXED: the rebuild tool did not actually repair inconsistent data — where one account appeared in two records it left one of them listing somebody who no longer belonged to it, and the Admin CP then showed staff a link between people who were not linked. It now merges such records.
FIXED: a device shared by more than 30 accounts, a school or library machine, permanently broke detection for that device and logged an error on every page view. The surplus accounts are now left out of the set with a warning, as the code always claimed.
FIXED: the last IP vanished from the Admin CP device list when fingerprinting was switched off.
CHANGED: set_members widened so a full 30-account set fits on boards with very large user IDs.
FIXED: the cookie left behind by 1.1.x had the same name as the new one but a different scope, so the two coexisted and the stale one took precedence — which quietly disabled the cookie’s role in restoring a device after a member cleared their browser storage. It is now cleared on the first detection request after upgrading.
FIXED: a member with Protect From Multiple Account Detection had their device fingerprint and IP recorded even though they were correctly never detected. Nothing is recorded for them now.
FIXED: the new detection script never ran in a browser. XenForo moves required JavaScript into the page head, ahead of the inline settings block below it, so the script read its configuration before that configuration existed and stopped without doing anything. Nothing was recorded from any real visit. It was invisible because the automated tests supplied the configuration first, which is the opposite of what a page does.
NEW: Admin CP → Users → Multiple Account Info → Hardware Matches, a board-wide list of fingerprints seen under more than one account, the one place a pair of accounts shows up when they share a machine but never shared a browser. It reports how many of its own rows are actually new information, so you can judge whether it earns its place on your board.
NEW: option Accounts sets per page, so the Multiple Accounts list is no longer fixed at ten.
CHANGED: both Admin CP screens now sit under their own Multiple Account Info heading in the Users menu, between Users and Data Portability, rather than loose at the bottom of the Users list.
FIXED: the device fingerprint was recorded but shown nowhere unless it already matched another browser, so on most accounts Record only mode looked like it was doing nothing. The member’s Devices list now shows the fingerprint itself.
FIXED: the Custom Cookie Name documentation claimed a rename cost nothing. It does issue every visitor a new device ID, accounts already detected stay detected, but linking new pairs through a browser somebody has already used starts again. The option’s description now says so.
FIXED: the public Confirm removal of exemption page showed breadcrumbs copied from a different add-on. They linked to that add-on’s attachment manager, and on any board without it installed the breadcrumb rendered as a raw phrase title. It now points back at the member.
FIXED: the German language pack did not match what it claimed to be. It carried seven Admin CP phrases plus one the add-on had stopped defining, while missing four that front-end code can emit, those fell back to English mid-page. It now holds exactly the phrases used on public pages, and a test keeps it that way.
1.2.2
CHANGED: the detection check no longer runs on a random 1-in-N page views. A browser now checks in at most once per Check Interval (new option, default 60 minutes), and immediately whenever a different account logs in, which is the only thing a repeat check can ever discover.
At the old default a member browsing forty pages an hour triggered roughly nine checks. It is now
one. Each check costs a request, two database writes, and -with fingerprinting on- a canvas
render and around a hundred font measurements on the visitor’s own machine.
REMOVED: option Random Check Trigger Frequency, together with the hourly cron entry and the online-member counter that existed only to feed it.
CHANGED: the device fingerprint is now computed at most once a week per browser instead of on every check. This also makes it more stable, which is what Hardware Matches relies on.
CHANGED: Sightings on a member’s device list now counts check-ins rather than page views, so new numbers are much smaller than ones recorded before this release.
CHANGED: Hardware Matches now judges a row by network as well. A fingerprint shared by accounts on different networks is listed and badged, but no longer counted as something to act on, on a board with many identical phones those were drowning the number that matters. Rows worth reviewing sort to the top.
If you are upgrading from 1.2.0 or 1.2.1, read this:
The old setting cannot be carried over, the two mean different things, so every board lands on 60 minutes regardless of what it had. If you had Random Check Trigger Frequency set to 0 believing detection was off, note that it never was: the forum index was always checked. Those boards will now check once an hour per browser.
1.2.0
Detection engine replaced.
NEW: device identity issued and signed by your own server, stored across an HTTP cookie,
ocalStorage, sessionStorage, IndexedDB and the Cache Storage API.
NEW: the cookie is set server-side, HttpOnly and SameSite=Lax, Safari caps script-set cookies at seven days, so the old engine’s cookie expired weekly there.
NEW: optional device fingerprinting, with three modes and an IP co-factor. Defaults to Record only, which never acts on a match.
NEW: options Device Fingerprint Handling and Fingerprint Match Window.
SECURITY: device identities are signed per installation. The old value was derived from the user ID by a published formula, so anyone could impersonate another member’s browser and force a false detection against them. Which, with Moderate All Multiple Accounts enabled, suspended that member’s account.
SECURITY: creating an exemption now requires a CSRF token. It was reachable from a plain link, so a crafted page could make a logged-in moderator create exemptions unknowingly.
FIXED: the 1.1.x engine did not run at all. colorname.js referenced an undefined global and threw before the script started, so boards detected nothing while appearing healthy.
FIXED: exemptions matched member IDs as substrings, so user 1 matched the pair 5-51 and user 5 matched 15-25, unrelated members appeared exempted, which dissolved real detections.
FIXED: exemptions were ignored entirely in sets of more than two accounts.
FIXED: a failed rebuild called a method that does not exist and would have crashed.
FIXED: a rebuild that died part-way locked detection out permanently. The lock now expires.
FIXED: one deleted member broke the whole Admin CP list page.
FIXED: duplicate exemption rows could accumulate; the pair column is now unique.
FIXED: report dates ignored the board language and the viewer’s timezone.
FIXED: the file health check reported six files as missing on every board, because it listed files the add-on has not shipped for years.
REMOVED: Flash, evercookie, WebSQL, userData, globalStorage, window.name, and the PNG, ETag and web-cache revival endpoints.
REMOVED: the Disable Flash Detection Engine option
CHANGED: changing the cookie name no longer resets detection.
CHANGED: pruning and the member lists no longer issue one query per member.
NEW: the Admin CP member tab lists that member’s devices, and any fingerprint matches, which is what makes the default Record only mode visible.
FIXED: Deny Registration of Multiple Accounts could never fire, because it tested the device ID as if it were an account token.
FIXED: the device cookie was set but never read back, so clearing a browser’s site data while keeping cookies defeated detection, the longest-lived store contributed nothing.
FIXED: a browser that had just been cleared could never be matched by fingerprint, which is the one case fingerprinting exists to cover.
FIXED: diagnostic warnings were serialised to an empty string and lost.
FIXED: a detection request that did not ask for JSON was answered with a full HTML page.
FIXED: deleting a member left their device sightings behind.
FIXED: removing a member from a set could drop a different member instead, when the member being removed was not in the set.
FIXED: a failed table creation during install reported success.
FIXED: the rebuild tool did not actually repair inconsistent data — where one account appeared in two records it left one of them listing somebody who no longer belonged to it, and the Admin CP then showed staff a link between people who were not linked. It now merges such records.
FIXED: a device shared by more than 30 accounts, a school or library machine, permanently broke detection for that device and logged an error on every page view. The surplus accounts are now left out of the set with a warning, as the code always claimed.
FIXED: the last IP vanished from the Admin CP device list when fingerprinting was switched off.
CHANGED: set_members widened so a full 30-account set fits on boards with very large user IDs.
FIXED: the cookie left behind by 1.1.x had the same name as the new one but a different scope, so the two coexisted and the stale one took precedence — which quietly disabled the cookie’s role in restoring a device after a member cleared their browser storage. It is now cleared on the first detection request after upgrading.
FIXED: a member with Protect From Multiple Account Detection had their device fingerprint and IP recorded even though they were correctly never detected. Nothing is recorded for them now.
FIXED: the new detection script never ran in a browser. XenForo moves required JavaScript into the page head, ahead of the inline settings block below it, so the script read its configuration before that configuration existed and stopped without doing anything. Nothing was recorded from any real visit. It was invisible because the automated tests supplied the configuration first, which is the opposite of what a page does.
NEW: Admin CP → Users → Multiple Account Info → Hardware Matches, a board-wide list of fingerprints seen under more than one account, the one place a pair of accounts shows up when they share a machine but never shared a browser. It reports how many of its own rows are actually new information, so you can judge whether it earns its place on your board.
NEW: option Accounts sets per page, so the Multiple Accounts list is no longer fixed at ten.
CHANGED: both Admin CP screens now sit under their own Multiple Account Info heading in the Users menu, between Users and Data Portability, rather than loose at the bottom of the Users list.
FIXED: the device fingerprint was recorded but shown nowhere unless it already matched another browser, so on most accounts Record only mode looked like it was doing nothing. The member’s Devices list now shows the fingerprint itself.
FIXED: the Custom Cookie Name documentation claimed a rename cost nothing. It does issue every visitor a new device ID, accounts already detected stay detected, but linking new pairs through a browser somebody has already used starts again. The option’s description now says so.
FIXED: the public Confirm removal of exemption page showed breadcrumbs copied from a different add-on. They linked to that add-on’s attachment manager, and on any board without it installed the breadcrumb rendered as a raw phrase title. It now points back at the member.
FIXED: the German language pack did not match what it claimed to be. It carried seven Admin CP phrases plus one the add-on had stopped defining, while missing four that front-end code can emit, those fell back to English mid-page. It now holds exactly the phrases used on public pages, and a test keeps it that way.
Release notes
The detection engine has been replaced. This is the whole point of the release.
The engine shipped from 1.0.0 to 1.1.5 was built on the ideas behind the evercookie library: Flash local shared objects, Internet Explorer userData, Firefox globalStorage, WebSQL, and three tricks that revived a deleted value out of the browser cache (a PNG image, an ETag, and a cached page). Every one of those is now dead. Flash was removed from browsers in 2020, WebSQL was dropped from Chrome in 2023, and the rest went years before that.
It was also hardly running at all. colorname.js referenced a variable that nothing defined, which threw a JavaScript error before the script did anything. Boards on 1.1.x have been detecting almost nothing, silently, while the add-on reported itself installed and healthy.
What replaces it:
A device identity issued and signed by your server, stored in the browser across an HTTP cookie, localStorage, sessionStorage, IndexedDB and the Cache Storage API. Clearing one of them restores the value from the others on the next page view.
The cookie is now set by the server rather than by JavaScript. That matters more than it sounds: Safari limits the lifetime of a script-set cookie to seven days, so on Safari the old engine’s strongest storage expired every week.
An optional device fingerprint as a second, weaker signal, see Device Fingerprint Handling. A security fix comes with it. The value the old engine kept in the browser was derived from the user’s own ID by a published formula. Anyone could work out another member’s value, put it in their own browser, and force the add-on to report that member as a multiple account and if Moderate All Multiple Accounts was enabled, that suspended the victim’s account. The new device identity is signed with a secret generated for your installation, so a value your server did not issue is discarded.
Also fixed: creating an exemption no longer works from a plain link, so a malicious page can no
longer make a logged-in moderator create exemptions without meaning to.
Removed: the Flash option (there is no Flash)
The engine shipped from 1.0.0 to 1.1.5 was built on the ideas behind the evercookie library: Flash local shared objects, Internet Explorer userData, Firefox globalStorage, WebSQL, and three tricks that revived a deleted value out of the browser cache (a PNG image, an ETag, and a cached page). Every one of those is now dead. Flash was removed from browsers in 2020, WebSQL was dropped from Chrome in 2023, and the rest went years before that.
It was also hardly running at all. colorname.js referenced a variable that nothing defined, which threw a JavaScript error before the script did anything. Boards on 1.1.x have been detecting almost nothing, silently, while the add-on reported itself installed and healthy.
What replaces it:
A device identity issued and signed by your server, stored in the browser across an HTTP cookie, localStorage, sessionStorage, IndexedDB and the Cache Storage API. Clearing one of them restores the value from the others on the next page view.
The cookie is now set by the server rather than by JavaScript. That matters more than it sounds: Safari limits the lifetime of a script-set cookie to seven days, so on Safari the old engine’s strongest storage expired every week.
An optional device fingerprint as a second, weaker signal, see Device Fingerprint Handling. A security fix comes with it. The value the old engine kept in the browser was derived from the user’s own ID by a published formula. Anyone could work out another member’s value, put it in their own browser, and force the add-on to report that member as a multiple account and if Moderate All Multiple Accounts was enabled, that suspended the victim’s account. The new device identity is signed with a secret generated for your installation, so a value your server did not issue is discarded.
Also fixed: creating an exemption no longer works from a plain link, so a malicious page can no
longer make a logged-in moderator create exemptions without meaning to.
Removed: the Flash option (there is no Flash)