What are some solutions for only letting specific users log into a
website? In other words, how do I prevent people from sharing
username/passwords?

So far, these are what I've considered:

1. IP security - Restrict access to website by IP address. To do this,
each username has an IP address or set/range of IP addresses
associated with it. When user logs in, the site checks the username
with the IP address(es) stored. If matched, let through. If user's IP
address changes, inform admin. That would work with static IPs. For
users with dynamic IPs, allow IP's for a certain region/hostname for
that user. If the dynamic IPs vary significantly, then if user can be
trusted, then make an exception for that user.  Any other thoughts?

2. Multiple login security - Prevent multiple, concurrent logins. When
a multiple login is attempted, it is reported.

3. Is there a solution with using cookies? If so, how?  In my case,
users will usually use the same computer because the computer is
connected to a large device that works with the website.

Others I haven't considered?

Am I on the right track?

Thanks for any advice.

---

Clarification of Question by riskmaster-ga on 24 May 2006 10:25 PDT

Of course, I would implement #2 in addition to other measures.

hi,
in order to indetify a user you can use 3 type of tests.
something you are (fingerprint ...)
something you have (smart card, computer IP, etc)
something you know (password, ...)

the problme is that to test something you are you must have special hardware,
to test something you have cost money or easy to fake (IP address)
you think about it.

4. Set policy that if users are caught sharing their password, harsh
consequences will ensue, i.e. termination of employment,
restricted/denied access to said website, whatever is appropriate for
the situation.

I'm not sure what the purpose of your website is, but if you are in
contact with your clients regularly then you could issue them new
passwords each week via email or phone, making it difficult for them
to share with many people.

Imposing an IP restriction may be more of a nuisance than it's worth,
simply monitoring who is using which account/password from what IP
should be enough to see if anything strange is going on.