Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have two users in my website with the same IP. I asked them or him, idk, why does he have 2 accounts. He said that other account is owned by his roommate. His roommate uses other computer in my website.

So, my question. How can I detect whether he lies or tells truth? I can check if both browsers the same or not. What else?

Thank you.

share|improve this question

migrated from stackoverflow.com Mar 28 '11 at 14:56

This question came from our site for professional and enthusiast programmers.

6  
Belongs on police.stackexchange.com –  Quassnoi Mar 28 '11 at 13:56
1  
he could use two different browser with ease, you might need some kind of retina scan via js :) –  Valerij Mar 28 '11 at 13:57
4  
@Vprimachenko: that would put his roommate under excessive risk. We don't know how far will he go to get to @hey's site. –  Quassnoi Mar 28 '11 at 14:00
1  
Is it really a big deal that they do have 2 accounts anyways, if you really need to you can use cookies to assign people ID's and not let them login when you detect the same ID for multiple accounts. –  Jesus Ramos Mar 28 '11 at 14:04
1  
I live in a university town. It's not unusual to have hundreds of users hit my web site from a single university IP address. In fact, everybody using any of their shared lab computers will show a single IP address. (And, probably, a single browser.) –  Catcall Mar 28 '11 at 14:12

9 Answers 9

Use http://samy.pl/evercookie/

share|improve this answer
3  
While this might help in this specific case, it won't help in the more general case when two people use one computer. –  Quentin Mar 28 '11 at 14:03
    
Well, sure. But this is how internet works ;) Anonymity around. If you want to authenticate users on 99% correctly, sell them ID dongles with strong cryptography for $1.000.000 each and threaten to ban them if they ever share it with someone else. 1% that they will ignore the threat anyway... ;) –  FractalizeR Mar 28 '11 at 14:14

Testing the User-Agent string will do you no good. Likewise client-side storage or cookie solutions are not an option if the same user utilizes different browsers. The only option to discern different clients in the local network would be a Java Applet which reads out the network-local address. E.g. http://www.rgagnon.com/javadetails/java-0095.html But that's quite an overkill solution, and can fail due to security restrictions, or if none of the two browsers (or users) has Java enabled.

share|improve this answer

You just have to live with this. Design your site so it would no matter. In SO if someone uses more than one account it just divides the reputation betwen them, so no incentive to do so.

Design your interaction in a way that gives no incentive for multiple accounts.

share|improve this answer

The network that the user is on might set the X-Forwarded-For http request header, which would allow you to log the private original IP address as well as the public IP address from which the request comes. You could then see if there are two different private IP addresses. But it won't work if they're just behind a NAT router, as that won't set X-Forwarded-For.

share|improve this answer

Or require all of your users to link their accounts to a Facebook account. Since Facebook's terms of service prohibit multiple accounts, you can then push enforcement of the policy off to Facebook, who probably have more resources than you do.

share|improve this answer
    
Even if Facebook have more resources you can't rely on them to enforce the policy you want, even if it's bad for the OP website to have 2 account per person it is good for Facebook, I am not sure Facebook will enforce that policy strictly. –  Dominique Mar 29 '11 at 12:20

I am guessing that in your case having multiple account could be used to gain unfair benefit, otherwise it would be good that you clarify your situation.

The approach that you should take in that case is to detect suspicious pattern between the account rather than try to detect if it's the same personn. Depending on what your website is about, the pattern can change a lot. Stack Overflow does this to prevent gaming the system.

share|improve this answer

If there is personal information in a typical user's account, like a CC number of a personal detail that is not meant to reach someone else's eyes, then in the edit account page make that personal detail available. No two people will ever wish to share accounts if they knew the other could access their personal data.

I don't think you can use technology to resolve such issues, a hacker will always find a way to out-smart you. However, if you have a CC on file, add a link on your user's back end that allows them to purchase $10 of flowers with a single click and mail it to anyone -- and watch how your double-accounts will disappear as no one will want one of their friends to order flowers with their CC.

Problem solved.

share|improve this answer

It is almost impossible to make 100% sure 2 user are the same person, what I would recommend would be to negate the benefit of having 2 account.

Example : if your site give referral bonus (in the case of a gaming website) you could track IP, log on date, sign up date, hashed password, similarities in email, those factors usually allow to find multiple account users.

share|improve this answer

You could use a Flashapp to take a picture of the user via webcam while login, and compare them... but the user would have to agree with this and can wear a mask or something. (I'm afraid what Face/Off-like-ideas @Quassnoi will get.)

share|improve this answer
    
Haha good one ! –  Brian McCarthy Mar 29 '11 at 16:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.