[RESOLVED] identifying individual users

OwenTheSamoan

I know that you can identify users using an ip address. But what if you have several users with different computers in one room sharing the same ip address. Is there anyway to differentiate each individual. Is there a unique signature from the computers that can be used? Thanks in advance.

Owen The Samoan

Piranha

No. And IP is not safe either, even not when there are only one computer in the IP.

You can use sessions. But when the browser is closed down and opened again you get a new session.

You can use cookies. But they could be deleted / not accepted. And copied.

IP is not safe since it is possible that the user have dynamic IP, then people could get new IP-addresses any time.

sneakyimp

Cookies are generally associated with a machine. If someone goes through the trouble of creating separate logins for each user on a particular windows machine, I think each user gets his/her own cookies. The cookies can stay there for quite a while until someone deletes them. Cookies can also be refused altogether.

On my machine, there's only one login so whoever is using the machine gets the same cookies. Or actually now that I think of it, Internet Explorer cookies are totally separate from FireFox cookies.

You can make them register and identify them when they login.

halojoy

something has to be done about this
IP adress does not work, and practically nothing can pinpoint a user

how about this:
- each computer must have auth of anybody using this computer
(it should be illegal to sell/use PC without this auth)
- user auth log in to PC is done with fingerprint scanning of at least 3 fingers!
- then this authentication follows individual when connecting and surfing in internet
- may be a unique string that is submitted along with User-Agent and this info
- servers will catch this auth-id from all visitors
and make it possible to use it in PHP scripts, server scripts

🙂

Piranha

I have a better idea halojoy. When you have to know if it is the same user or not just make sure to stand behind the person logging in, then you can see if it is the same person 😛

sneakyimp, I think that many persons do like I do, automatically delete the cookies when FF is closed. And I don't think that it is easy to get people to change those habits or get in an exception list.

bpat1434

There's no way to automatically differentiate between computers based on IP or even MAC addresses.

One thing that could work for authenticating that the user is who they say they are is to use an "image" key. Give them an "avatar" that isn't their avatar (i.e. has to be picked from your set, can't be uploaded) and then enter a secret phrase. Then when they log in again, you ask them to choose which picture and fill in the passphrase. If either don't match, you know it's not the same person. Some banks do this (well, half of it).

Other than that, there's no way to differentiate between me or my girlfriend using this forum (not that she would 😛 ) because we're using the same internet line. The only chance of differentiating computers would be MAC addresses; but, even they can be cloned.

sneakyimp

Personally I find it a relief to have a bit of anonymity. It does strike me as a bit odd how 'stateless' the http protocol is--it seems a complete failure on the original designer's part--but I like this better than living in halojoy's orwellian police state.

Weedpacket

sneakyimp wrote:
it seems a complete failure on the original designer's part

Intentional design decision: it's not like you need state to serve documents, and you can always add state control if you need it.
http://www.w3.org/Protocols/DesignIssues.html
http://www.w3.org/Protocols/HTTP/AsImplemented.html (particularly the last line - above the signature).
http://www.w3.org/DesignIssues/Axioms.html#state

halojoy

A visit to http://www.w3.org and looking at Weedpackets links.
And reading their privacy statement for public (non-member) users.
( They also have one privacy statement for members )

Public: W3C Privacy Statement for Non-Members

Summary:
[b]We make no effort to identify public users of our site.[/b] No identifying data is disclosed to any third party for any purpose. Data that we collect is used only for server administration and Web protocol research.
This statement applies to non-member interactions with the W3C Web servers. It does not apply to email sent to W3C staff or lists. Any questions regarding the web site and the privacy policy can be directed to site-policy@w3.org. Email interactions are guided by general net-etiquette conventions.

As is typical, we log http requests to our server. This means that we know the originating IP (e.g. 18.29.0.1) address of a user agent requesting a URL. We also know the Referer and User-Agent information accompanied with an HTTP request. We do not log the specific identity of visitors. We occasionally analyze the log files to determine which files are most requested and the previous site or user agent which prompted the request. Our logging is passive; we do not use technologies such as cookies to maintain any information on users.

We also log requests to our search, cgi, and list maintenance services. This data is only used for administration and researching the efficacy of our tools.

Logged information is kept indefinitely as admistrative and research material; it is not disclosed outside of W3C host site personnel. Aggregate (completely non-identifying) statistics generated from these logs may be reported as part of research results.

sneakyimp

Interesting links Weedpacket. Yes I have learned to add state control thanks to this website. What struck me about it was how tricky it can be to keep track of that session id when the user doesn't accept any cookies.

I guess I was imagining there could be some way that authentication and state might somehow be built into the protocol so it could be foolproof and simple. I'm not complaining though. If it was too simple I doubt I would get any work.

Weedpacket

halojoy wrote:
[elided]

Fascinating.

sneakyimp wrote:
I guess I was imagining there could be some way that authentication and state might somehow be built into the protocol so it could be foolproof and simple.

No doubt it could, but then it would have to be managed even when it wasn't wanted (which for HTTP is most of the time).