Detecting a "unique" anonymous users

Question

It is impossible to identify a user or request as unique since duping is trivial.

However, there are a handful of methods that, combined, can hamper cheating attempts and give a user quasi-unique status.

I know of the following:

1. IP Address - store the IP address of each visitor in a database of some sort
   • Can be faked
   • Multiple computers/users can have the same address
   • Users with dynamic IP addresses (some ISP issue them)
2. Cookie tracking - store a cookie per visitor. Visitors that don't have it are considered "unique"
   • Can be faked
   • Cookies can be blocked or cleared via browser

Are there more ways to track non-authorized (non-login, non-authentication) website visitors?

Answer 1

Yes, it's impossible to tell anonymous visitors apart with 100% certainty. The best that you can do is to gather the information that you have, and try to tell as many visitors apart as you can.

There is one more piece of infomration that you can use:

1. Browser string
   • It's not unique, but in combination with the other information it increases the resolution.

If you need to tell the visitors apart with 100% certainty, then you need to make them log in.

Answer 2

There is no sure-fire way to achieve this, in my view. Of your options, cookies are the most likely to yield a reasonably realistic number. NATing and proxy servers can mask the IP addresses of a large number of users, and dynamic IP address allocation will confuse the results for a lot of others

Have you considered using e.g Google Analytics or similar? They do unique visitor tracking as part of their service, and they probably have a lot more money to throw at finding heuristic solutions to this problem than you or I. Just a thought!

Answer 3

What about checking other headers also, such as User-Agent, Accept-Language, or even Accept-Charset?

Or, to get a bit black-hat, you could grab and check cookies set by other common sites (big G) for this user's browser...

Answer 4

Panopticlick has a quite refined method for checking for unique users using fingerprinting. Apart from IP-adress and user-agent it used things like timezone, screen resolution, fonts installed on the system and plugins installed in the browser etc, so it comes up with a very distinct ID for each and every user without storing anything in their computers. False negatives (finding two different users with the exact same fingerprint) are very rare.

A problem with that approach is that it can yield some false positive, i.e. it considers the same user to be a new one if they've installed a new font for example. If this is ok or not depends on your application I suppose.