How to ID a web user uploading a file

Question

I just used a great PDF Converter, but I noted that they have a 30 minute intermission between conversions (to get paying customers). So I got curious as to how the restriction might be is implemented; and afaik it doesn't seem to be (solely?) cookie-based.

IP-address doesn't seem likely (wouldn't that block entire NATted organizations collectively?), and using filename would be too blunt. Can Javascript generate hardware-unique info these days? What other other ways are there? What is secure, what is easy to implement and what is just rotten?

Answer 1

I think the problem here is to uniquely identify a client's browser.

Can Javascript generate hardware-unique info these days? What other other ways are there?

A simple solution (may not be exhaustive) I can imagine, is to consider not just the cookie or the ip address but all possible parameters like

• cookies
• ip address
• browser details
• flash cookies and
• then those information that can be pulled off from a client's browser via Javascript (which is enabled for most of the browsers and needed by most sites like the one you mentioned) such as plugins installed, their versions.

With all these information, one can identify a machine uniquely on the internet to a great extent.

What is secure, what is easy to implement and what is just rotten?

Personally, I have never implemented this, but it seems quite doable.

Some interesting links that I found during the course of this short interesting research are:

1. Peter Eckersley. 2010. How unique is your web browser?. In Proceedings of the 10th international conference on Privacy enhancing technologies (PETS'10), Mikhail J. Atallah and Nicholas J. Hopper (Eds.). Springer-Verlag, Berlin, Heidelberg, 1-18.
2. How unique and trackable is your browser?
3. Is browser fingerprinting a viable technique for identifying anonymous users?
4. How do I uniquely identify computers visiting my web site?
5. Browser fingerprinting code snippet
6. Flash Cookies, a Little-Known Privacy Threat