remember user...how can i do that?

tucker

I have a script where people can vote for a website, but I ony want people to vote once. I was using ip addresses to track that, but I found that ip addresses can change on a computer. Is there a better way to identify a person's computer without using cookies? Thanks for the help!

-tucker-

thinfile

There is no sure way because people can use proxies etc. Options you might want to consider.

1) Set a cookie (user can delete this).
2) Build a hash with user's IP address and browser's user agent string.
3) Ask people to type in a number that can be read off an image (this can stop bots from voting).

--
Thin Upload
File Upload as easy as drag and drop.

tucker

thinfile wrote:
There is no sure way because people can use proxies etc. Options you might want to consider.

1) Set a cookie (user can delete this).
2) Build a hash with user's IP address and browser's user agent string.
3) Ask people to type in a number that can be read off an image (this can stop bots from voting).

--
Thin Upload
File Upload as easy as drag and drop.

What do you mean by build a hash with user's IP address and browser's user agent string?? Thanks for the help.

-tucker-

jc94062

md5($SERVER['REMOTE_ADDR'].$SERVER['HTTP_USER_AGENT']);

But I'm confused, thats even more more likely to let people vote more than once as they'll be able to vote from every different browser as well as when their IP changes.

Most people have broadband these days with a fairly static (sticky) IP, but there are those out there that this doesn't work for.
AOL for example operates a system where your IP can change on every page load, I'll refrain from commenting any more on that but the fact is unless you have a way of grabbing their mac address (which is impossible afaik in PHP but is probably something BB is looking at) you can't restrict it at all.

Even going by mac wouldn't stop anyone slightly determined...

I'd set a cookie and store results by IP and boot any results with stupid numbers of hits from similar IPs (do a check on number hits per first 3 octets and boot any in the top 10% at a rough guess, without seeing the numbers or data I can't reliably guess at how to examine the data).

Cookie will stop people voting again by mistake, IP logging will allow you to (to a degree) boot those needed.

Roger_Ramjet

Very few domestic users have static, or sticky IP adresses. There are just not enough IP addies to go around. The fact that it looks like you have your own IP is because of NAT. In fact, they all be going through an invisible proxy to reach the internet. You have to have been around for a long time, or be paying a fair old fee, to get a real static IP address. And businesses with a static IP will then be using NAT on their own proxy to share that IP across their LAN.

The user can then also use a proxy when they surf, there are loads of them around.

The one thing you can be sure of is that IP adresses do not equal unique computer or user identities.

Cookies are about as good as it gets when it comes to unique id.

To give it some perspective

IP class A networks begin 1. to 126.
10. is default so not allocated
127. is IP callback
So there are only 126 possible class A networks in the address space. and only 124 could be allocated, and they all went long ago - IBM, Dept of Defense, Sun Microsystems, Berkely Uni, etc

IP class B networks are in range 128.0 to 191.254
gives a possible set of 16,000 class B networks with up to 65,000 hosts on each =
1,040,000 possible ip addresses (less network and router overheads)

IP class C networks are in the range 192.0.0 to 254.0.0
gives up to 254 hosts on 2 million networks = 508million possible IP adresses

Now that sounds like a lot: over 500 million possible IP adresses, but there are more than that many people online in the world already. And the effective allocation is probably half that because companies get allocated a class of network whether they fill it or not. So an ISP with several class C network at it's disposal will sell them as and when it can, but no-one else can use any of them. They will have subnets and routers that cut down the effective number as well.

The truth is that we have already run out of IP adresses, did do years ago, and the internet is only possible because of technologies like NAT and CIDR. Only when IPv6 comes to full fruition will it be theoretcically possible to give all hosts an IP adresses that is unique - just as we give ethernet cards a MAC that is really unique.

Weedpacket

Or IPv9....

Roger_Ramjet

Nice one Little Weed 😃 I nearly took that seriously :rolleyes:

e4c5

My suggestion was to use a combination of those options.
the reason that you should use a hash is that the useragent string in most cases is very very long. It's much easier to store and to search if you build a hash.

--
Thin Upload
File Upload as easy as drag and drop.

tucker

Thanks for all the help....I was able to form a good method to do it from what you guys said.

-tucker-