Wikipedia:Obvious sock is obvious

Yes, dear Wikipedians, an obvious sock is quite obvious. For instance: If Editor A is blocked for harassing Editor B and then a brand-new account, Editor C, comes along and mimics the harassing behaviour of blocked Editor A, then A and C are obviously the same user. This may also be called the DUH principle.

It all goes back to the old adage: "If it looks like a duck, swims like a duck and quacks like a duck, then it probably is a duck". It is very unlikely that new Editor C would share the same disdain for Editor B that was expressed by Editor A. Coincidences happen, but not that often.

Other applications
This also applies to plain vanilla vandalism. Long-term vandals often have their own "pet" articles that they like to target, so if Vandal B comes along and starts vandalizing some articles that are on Vandal A's pet article list similarly to Vandal A, then you are relatively safe in assuming that they are the same user. It can also be applied to when Vandal A gets blocked for vandalising an article, and Vandal B comes around and reverts the undo of the vandalism in the timeframe of seconds after the typical account creation, then it's a sock. The principle of "assume good faith" always applies, but  assume good faith is not a suicide pact and bad behaviour should not be ignored. Sometimes it is quite right to call a spade a spade.