For a small webapp I want to be able to identify a user. The issue is, if the us

Question

For a small webapp I want to be able to identify a user.

The issue is, if the user cheats in some manner, I want to be able to forbid him the usage of my application.

I already have done extensive research on that topic, but to no avail.

What is not an option:

cookies: can be disabled or deleted (to easily overridable)
ip adress: is dynamic or hidden through NAT
MAC adress: cannot be retrieved (as far as I know, or at least not without terrifying the user)
Flash: is not supported on a wide range of devices
This is a central part, so I can decide which technology to use along this decision.

What are the options I have? (especially I do not want that the user gets a security warning as this is often the case with java applets)

Some kind of unique machine identifier would be okay.

-edit-

What I want to protect against:

It should be some kind of discussion board about recent topics. There will be people that proof that they have not the attitude to discuss in the public, e.g. insult other people etc.

And I want to have a possibility to keep these people away.

There will be somekind of login. But what keeps people from creating simply another account and keep going?

Fingerprinting seems to be to weak, as is has some well known flaws. Using a bank account is way to hard to use, at least since there is nothing you can buy right now, it will keep users from using the site.

Isn't there something in the middle? Like a device id, which keeps users from one device away, despite it might be wrong, this would do the job in a vast majority of cases I believe.

Explanation / Answer

There is no 100% solution to your problem.

A user can use a wide range of strategies to bypass any possible action: delete cookies, use a VPN, even change its device (mobile phone, pc, laptop). You mentioned them.

What are the options I have?

That said, IP adress and a browser fingerprint is your best bet. There are libraries for JAVA (and probably C#) that can extract a fingerprint from the HTTP Request. But again the user could just change his browser signature or switch to another device.

Therefore is might be helpful to change the idea behind it from "completely locking a user out" to "making it hard for a user to gain access."

Edit:

"A device id" would basically be the MAC address, which can not be obtained via a HTTP request. So no, there is no device id you could use. A device fingerprint is the closest thing you can get.

An Idea:

You could use a mobile app to authenticate a user. An app could obtain a device id (MAC address or IMEI for Android). Use the device id from the phone to register a user. You'll only need the mobile app for registration. If you ban a user, he won't be able to register again using the same phone. (This is of course not 100% reliable, but more reliable than anything browser based)

Related Questions

Navigate

• Browse (All)
• Browse F
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.