tags:

views:

67

answers:

3

I am actually trying to detect a person, using a computer, Just like facebook. Whenever you sign into facebook using different machine, it detects the new machine and asks you the register it. How do they find out that the person is using another computer. May be they can track the clients MAC or actual IP (but this normally changes upon every reconnection).

How to detect this?

A: 

I don't know if facebook uses this method, but an obvious method is simply testing fro a cookie and setting it if it isn't there.

Mark Baker
A: 

I don't know what does facebook do but I suppose they check a cookie.
To be sure, you can setup some HTTP proxy like Fiddler and watch all HTTP headers being sent.

No, MAC address isn't accessible over internet and IP is not the same thing as "Machine"

Col. Shrapnel
+1  A: 

The obvious answer is cookies plus IP address.

However, as you say, IP addresses can change and cookies can be cleared by the user.

There are in fact a whole load of ways to determine information about a user's machine, ranging from the browser ID to detecting the list of fonts installed on the computer. A recent experiment managed to show that without using cookies, it was possible for them to detect unique computers with quite a good degree of accuracy.

However, it's highly unlikely that you'd need to do all of that -- most sites that do this just use cookies, and live with the fact that they can be reset. After all, if the user has cleared their cookies, they are expecting sites to forget who they are.

Also, pretty much any technique you use to identify people will be perceieved as an invasion of the user's privacy (even cookies have this image for many people, because of abuse by advertising companies, hence why browsers allow them to be cleared).

Spudley
You said `A recent experiment managed to show that without using cookies, it was possible for them to detect unique computers` can you tell me more about it
mrNepal
@mrNepal: see http://www.h-online.com/security/news/item/EFF-demonstrates-a-browser-s-finger-print-918786.html and http://www.eff.org/press/archives/2010/05/13
VolkerK
@mrNepal - yep, VolkerK has the one. I still wouldn't suggest going overboard with this sort of thing unless it's utterly critical. Even then, you'll never get absolute certainty.
Spudley