With a sticky fingerprint. I’ve built a system like this for managing trolls. You fingerprint the user and associate it with an IP. There are multiple mechanisms that can contribute to the fingerprint (cookie, user agent, supported media codecs, etc. See https://github.com/fingerprintjs/fingerprints for an example implementation).

Then if another user registers with the same fingerprint we link the accounts together.

In our case the whole thing is also requiring human moderator input to actually keep the whole thing going though.

I once helped nuked a user who was a persistent sexual harasser with access to multiple /16 ranges - but their device config (browser and etc.) was unique to users of the service in question, so we just hellbanned that.

(apologies for the level of vague here but I don't believe it's fair to anybody else involved to be less vague - including the user in question, who seemed relatively young and I hope has grown up since)

Your link 404s. I believe this is what you meant to include: https://github.com/fingerprintjs/fingerprintjs.

There is also a premium verson: https://fingerprint.com/

I wouldn't presume anything. But email, phone number, cookies, other machine finger printing stuff, wifi and other location giveaways are also possible.

Likely they drop a cookie with a session ID. I believe (but have no knowledge) that Disqus presents in an iframe, so the cookie persists whenever it loads on a page. So they can attribute all posts from that common session id. That said, chrome does not sync cookies, so this method only works as long as cookies don't get cleared (or computer replaced etc).

So it might be something else, given the implied age of the comments.

About the proposed clues in the sub-thread :

- cookies are temporary. Even 'ever-cookies' wouldn't have survived brower upgrades.

- email, tel : the parent insists having had privacy opsec so reusing those over time would not fit in this view

I have no idea. This was before all the machine learning stuff came into fashion.

They keep all the data posted since the early days of the internet, and are applying machine learning to it now (and will continue to into the future).

That's chilling.. The only long-going thread of attribution would rely on stylometry - a good fit for ML though..

Perhaps same email address?

3rd party cookies perhaps? I'm actually very curious how this was possible too