How can I best detect that the same person / computer is using my
website under multiple nicknames? I run a Debian/Apache/PHP/mySQL
based site where I would like to identify users that register with
multiple user names. Identifing multiple nicks by IP is not effective,
because many users have different IPs every day - also from within
some organisation, many users may come from the same IP. Cookies may
be a solution, but one can delete a cookie and then register with
another nick again.

1. Can you tell me what may be the best solutions to identify users
coming from the same computer?

2. Do you know of any service of software for this purpose?

---

Request for Question Clarification by webadept-ga on 24 May 2006 17:20 PDT

So just to clarify here, you want to make sure that people do not use
your website from any other computer than their home (or original
login) computer. Once I get an account on your website, you want to
make sure I can't use your website from the office, my laptop, or at a
web kiosk, or at the library. Only my home computer. .. Is that your
goal?

webadept-ga

---

Clarification of Question by kaarlo-ga on 28 May 2006 11:20 PDT

I would like to restrict or at least identify users that use the same
computer to register and login to the website under multiple nicks. I
know it is impossible to do if a person uses more computers (eg. one
at home, one at work) - but I would like to, at least, identify
multiple nicks that come from the same computer.

Currently I allow one registration per e-mail address, but many users
use multiple free mail accounts to come in with multiple nicks. I also
watch IPs, but that is not perfect. I understand there may be no
perfect solution, but I am looking for something better than watching
identical IPs.

The reason for this effort is that the website has a voting system
that people try to abuse by using multiple nicks.

It is not possible, nor should it be. The best you can do is (a) use a
cookie, (b) require a valid email address (i.e., send an activation
email that contains a link they must click before their account
becomes active), (c) disallow 'free' email account services.

Dear mwarden,

(a) I do that, but cookies can be deleted.
(b) I do that already.
(c) This may be good, but how can I identify that an e-mail address is
a "free" one? There are millions of free mail account providers...

Thank you.

If someone wants to register or want to do login, he/she will find a way,

cookies, can be deleted
IP: can be fake, can use open proxyies, 

I think you can keep, USER_ID, IP and User's Browser details
HTTP_USER_AGENT ...etc, (user may use different browsers) user's may
have same browsers

you can also keep cookies, if they are not aware of deleting cookies
it will help you define them

regards,
Nurbek

In regard to the free emails accounts.
Concentrate on what is not free e.g. the ISP's and only allow access
to them, if ISP's offer free email addresses then disallow.
Or are there millions of ISP's as well?