I have two users in my website with the same IP. I asked them or him, idk, why does he have 2 accounts. He said that other account is owned by his roommate. His roommate uses other computer in my website.

So, my question. How can I detect whether he lies or tells truth? I can check if both browsers the same or not. What else?

Thank you.

  • 7
    Belongs on police.stackexchange.com
    – Quassnoi
    Mar 28, 2011 at 13:56
  • 1
    he could use two different browser with ease, you might need some kind of retina scan via js :)
    – Valerij
    Mar 28, 2011 at 13:57
  • 4
    @Vprimachenko: that would put his roommate under excessive risk. We don't know how far will he go to get to @hey's site.
    – Quassnoi
    Mar 28, 2011 at 14:00
  • 1
    Is it really a big deal that they do have 2 accounts anyways, if you really need to you can use cookies to assign people ID's and not let them login when you detect the same ID for multiple accounts.
    – Jesus Ramos
    Mar 28, 2011 at 14:04
  • 1
    I live in a university town. It's not unusual to have hundreds of users hit my web site from a single university IP address. In fact, everybody using any of their shared lab computers will show a single IP address. (And, probably, a single browser.)
    – Catcall
    Mar 28, 2011 at 14:12

10 Answers 10


Use http://samy.pl/evercookie/

  • 3
    While this might help in this specific case, it won't help in the more general case when two people use one computer.
    – Quentin
    Mar 28, 2011 at 14:03
  • Well, sure. But this is how internet works ;) Anonymity around. If you want to authenticate users on 99% correctly, sell them ID dongles with strong cryptography for $1.000.000 each and threaten to ban them if they ever share it with someone else. 1% that they will ignore the threat anyway... ;)
    – FractalizeR
    Mar 28, 2011 at 14:14

The actual answer is no you can't!

Sure there many things to simulate it. But think of the user uses the other persons computer/account or even browser!

You can modify local IP addresses, cookies, http-headers, java-applets or all other clientside things.

Most sites who want this has limits of accounts per IP-address.

You also may try to filter the multi-accounts by checking for suspicious activities, but that may also not be of much help, since it would be hard to distinguish friends just working together.

All in all, this is a problem to which no effective solution exists.

  • +1, I was thinking about posting the same answer. There is indeed no effective solution, internet protocols are very effective and therefore there is no 'good' way to check if a user is telling the truth. There are some approaches but none of them are proper and they won't work in all cases, unfortunately.
    – William
    Nov 9, 2014 at 10:30

Testing the User-Agent string will do you no good. Likewise client-side storage or cookie solutions are not an option if the same user utilizes different browsers. The only option to discern different clients in the local network would be a Java Applet which reads out the network-local address. E.g. http://www.rgagnon.com/javadetails/java-0095.html But that's quite an overkill solution, and can fail due to security restrictions, or if none of the two browsers (or users) has Java enabled.


You just have to live with this. Design your site so it would no matter. In SO if someone uses more than one account it just divides the reputation betwen them, so no incentive to do so.

Design your interaction in a way that gives no incentive for multiple accounts.


The network that the user is on might set the X-Forwarded-For http request header, which would allow you to log the private original IP address as well as the public IP address from which the request comes. You could then see if there are two different private IP addresses. But it won't work if they're just behind a NAT router, as that won't set X-Forwarded-For.


Or require all of your users to link their accounts to a Facebook account. Since Facebook's terms of service prohibit multiple accounts, you can then push enforcement of the policy off to Facebook, who probably have more resources than you do.

  • Even if Facebook have more resources you can't rely on them to enforce the policy you want, even if it's bad for the OP website to have 2 account per person it is good for Facebook, I am not sure Facebook will enforce that policy strictly.
    – Dominique
    Mar 29, 2011 at 12:20

I am guessing that in your case having multiple account could be used to gain unfair benefit, otherwise it would be good that you clarify your situation.

The approach that you should take in that case is to detect suspicious pattern between the account rather than try to detect if it's the same personn. Depending on what your website is about, the pattern can change a lot. Stack Overflow does this to prevent gaming the system.


If there is personal information in a typical user's account, like a CC number of a personal detail that is not meant to reach someone else's eyes, then in the edit account page make that personal detail available. No two people will ever wish to share accounts if they knew the other could access their personal data.

I don't think you can use technology to resolve such issues, a hacker will always find a way to out-smart you. However, if you have a CC on file, add a link on your user's back end that allows them to purchase $10 of flowers with a single click and mail it to anyone -- and watch how your double-accounts will disappear as no one will want one of their friends to order flowers with their CC.

Problem solved.


It is almost impossible to make 100% sure 2 user are the same person, what I would recommend would be to negate the benefit of having 2 account.

Example : if your site give referral bonus (in the case of a gaming website) you could track IP, log on date, sign up date, hashed password, similarities in email, those factors usually allow to find multiple account users.


You could use a Flashapp to take a picture of the user via webcam while login, and compare them... but the user would have to agree with this and can wear a mask or something. (I'm afraid what Face/Off-like-ideas @Quassnoi will get.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.