So I was wondering if it's possible to uniquely identify a user accessing a site?
Essentially, is there a stagnant/static id or code produced by a machine within a web request or within a browser that could be used to uniquely identify somebody that is accessing a site?
I understand the use of IPs could be fairly powerful but considering they tend to change quite frequently, I wouldn't count on them being a reliable solution for my problem.
-
2Make them sign in securely... otherwise no. IP addresses can be entire towns behind one carrier-grade NAT.– TetsujinCommented Aug 2, 2019 at 16:31
Add a comment
|
1 Answer
You can be identified by what's called Device fingerprint, which in your case is Browser Fingerprint.
While the IP address is not a good identification, a combination of other factors that your browser passes on with the request can be used to identify you uniquely or almost uniquely. This fingerprint can still be used to identify you even if you are connecting from another place.
Browser Fingerprinting uses several items in combination:
- Cookies (even if they are disabled, this is already some data about you)
- JavaScript code that finds out the default font size and background color settings of the browser
- Installed add-ons
- Language preferences
- And much more.
You may surf to the website Am I Unique. It will calculate your fingerprint using a comprehensive list of 40 attributes (!). The most significant attributes include whether cookies are enabled, what platform you're using, what type of browser (as well as its version) and computer you’re using, and whether tracking cookies are blocked.
In all, Am I Unique uses 8 HTTP headers attributes and 32 JavaScript attributes. Surf to this site, which conserves the fingerprint of all its visitors, to see how unique is your fingerprint.
Browser Incognito or Private browsing can be used to cause the browser to reduce the information that it sends to the website. However, this does not stop attributes sent by JavaScript.
