HWID locking a PHP page?

Question

Currently I sell a program, that accesses my webpage. The program is HWID (Hard Ware ID) locked, and the only reason I use the program to access the webpage instead of direct access via a webbrowser, is so that I can use HWID authentication.

However, I've just been told I can code a script to get computer information, such as hardware ID etc.

Is this actually possible completely server-side? If so, can I do it with PHP? If not, what language would this be, and what functions would I have to look into for this?

Answer 1

Whoever told you that is confused with something else.

Browsers do not expose that kind of hardware information to a web server at any point, so there is no existing mechanism for a server-side PHP script to get a visitor's HWID. JavaScript provides very limited information about display resolution and color depth, but certainly not something like HWID. A very long time ago, it used to be possible to use ActiveX objects in JavaScript in IE to retrieve hardware information via WMI, but you can bet that's not possible anymore, especially on a non-intranet zone site. You'd most certainly need some kind of browser plugin or extension; Flash does not provide the HWID, so you're looking at something custom-written by you that must be installed on a visitor's machine either prior to or during their visit.

You're better off continuing to sell the app that gets the HWID itself and then accesses your web site, because that's going to be far less painful than writing browser extensions and plug-ins for all major browsers to provide that information in a secure way.

Answer 2

Write an application, that can read this kind of information from PC. Teach it to encrypt and sign this data (encrypted SHA1 for example) and to pass it to your site (just open browser via ShellExecute with base64_encoded encrypted data in URL) with some incrementing counter so that the same link could not be used twice. Have your PHP script decrypt and verify this information. Authorize access via session variable, bind it to IP (store IP in session) and you are done.