11

Here is my situation. I am part of a project creating a P2P charity website, where users connect and can give money to one another. Because of the nature of the site, we know scammers are going to be rampant. We have several preventative measure ideas, and one idea that came up was tying an IP address to the user's account. The reason for this would be to be able to detect when someone from the same IP address creates several accounts.

Would this be reliable? Why, or why not? I have been googling and found many conflicting ideas on the subject. Thanks for any help you can give.

3
  • Out of interest how is this project doing, sounds like an interesting idea?
    – Paul C
    Jul 28, 2011 at 8:06
  • thanks, its going well development-wise. the site isn't live as of yet, but within the month -- there are a few other competitors in this space already, but we have our own ideas how to tackle the problem.
    – JimDaniel
    Jul 28, 2011 at 23:44
  • What's the current status of our website? What's the URL?
    – Viral Jain
    May 28, 2014 at 5:58

12 Answers 12

23

No, it is not reliable. Because:

  1. Residential customers who aren't specifically paying for a static IP address will often see their addresses change frequently. I'm on AT&T DSL and I see my IP address change roughly twice per month on average
  2. People legitimately sharing an internet connection, whether they're using different workstations in the same office with a T1 line, or they're all connected to the same Wi-fi hotspot at Starbucks, will all have the same IP address.
  3. Related to the above, people who are mobile, such as people who use laptops to connect to Wi-fi at coffee shops, airports, hotels, etc, will have a different IP address for each location they visit.
  4. Even people who stay in one place with a static IP address can spoof your system by using a proxy server or a proxy tool like Tor. This makes IP restrictions trivial to bypass.
3
  • A lot of websites appear to record your IP for 'tracking' purposes or at least state they do. Why do they go through that effort if what you say, and I agree with you, is true?
    – Paul C
    Jul 27, 2011 at 17:40
  • 1
    @CodeBlend - For one thing, IPs often (but not always) correspond to a physical location. Many ads can guess where you are within 50 miles or so based on your IP, if you don't do anything to obscure it. Also, even if everybody at an office building or coffee shop has the same IP address, knowing that the site visitor works in that office or frequents that coffee shop can be useful data. And generally an un-hidden IP address will tell you who the client's ISP is. That's useful. Are they connecting from AT&T? Verizon would love to show them an ad. Jul 27, 2011 at 17:51
  • @CodeBlend - Of course, there is a margin of error, and proxy servers will still render all of the data I mentioned above inaccurate, so this data is only useful to marketing departments usually. But marketing departments don't need 100% accuracy to make money. Jul 27, 2011 at 17:53
11

No.

Many connections are behind NAT (One public gateway IP address for many people), or use DHCP (frequently changed IP addresses).

An IP address is one of the worst ways of identifying a user.

4

No, not least because:

  1. IP Addresses can change over time, thanks to DHCP leases expiring.
  2. People access websites from many different locations including home, work, coffee shops, etc.
  3. When behind a NAT firewall or a proxy server, many people can share the same IP address.

Will you have many people registering who are entitled to receive money? I'd suggest a manual verification process using real people if at all possible. If nothing else, you can claim to be exercising due diligence if there's a human involved.

4

There is a dicussion board I am part of that bans sock puppets ( that is, multiple accounts by the same user ). They have no means of automatically detecting them, becasue there is no means of definitively identifying them. IP addresses are captured, because they can be used to help identify sock puppets, but I know that the process of identifying these is laborious, manual, and error-prone.

This is only undertaken when there is suspicion that someone is using sock puppets for malicious or disruptive purposes. In your case, there is no real answer other than careful and manual monitoring of usage habits, using the information that you gather about users to attempt to identify suspicious habits. But you also have to accept that 80% of sock puppets will go undetected, and do what you can to warn other users of the possibility.

Your bigger issue, incidentally, may be Munchausen by Internet which we were also caught by.

2
  • wow, thank you very much for the information. I had never heard of MbI
    – JimDaniel
    Jul 26, 2011 at 15:58
  • 1
    You need to, because a site like you describe is a perfect target for it. And they are extremely damaging to a site that relies on trust and honesty. Jul 26, 2011 at 16:21
3

Totally unreliable...

  1. Somebody on dial-up will have a different IP address every time they "dial-up".

  2. DSL users will have a different IP address every time they reset or reconnect their account unless they pay for a static IP.

  3. Many users on a particular LAN will be sharing one public IP address.

  4. A particular user can login from home, work, public hotspot and have a different IP from each location.

2

No: for example, any company proxy will only have one external IP address, so everyone registering from within the network will appear to have the same IP address.

2

Recent legal case perhaps worth reading up on : http://yro.slashdot.org/story/11/05/03/2020205/An-IP-Address-Does-Not-Point-To-a-Person-Judge-Rules

1
  • Made me smile "... Judge Baker cited a recent child porn case where the US authorities raided the wrong people, because the real offenders were piggybacking on their Wi-Fi connections." =)
    – Paul C
    Jul 28, 2011 at 17:23
2

I do development for an ASP service, and we have recently went through a required 3rd party security audit to obtain status allowing us to host data for a certain government agency. So if I may share some of the information I gleaned turning the trainings, perhaps it would help.

First, IP addresses can be used to assist in what you are trying to accomplish, but they are definately not good by themselves. An example would be the wireless at McDonalds. Everyone at McDonalds is connected to the same wireless and are using the same public IP address through a NAT, which translates from a local address (i.e. 192.168.0.xxx) to a public address for all computers located behind it. The NAT keeps entries so it knows what traffic is allowed to come back into the network, and which computer it is going to.

We found that a good security measure is to use an encrypted session key that is included with all GET/POST submits. That session key contains a GUID which is a lookup to the current session. So even if someone breaks your session encryption, they still need to guess at a GUID in order to find a valid session. On top of that, by tracking IP addresses, if it changes suddenly, we can immediately invalidate the session (we also have whitelisting in case someone is load balancing multiple internet lines, which can cause the IP to change frequently). A cookie can also be used in place of the IP address tracking, as two people behind the same NAT can potentially hijack each other if they can find a way to steal the other person's session key.

Encrypted cookies are also a good way to enforce security. But make sure you are using a framework that is tried and tested, as they have already closed the known vulnerabilities for you. Believe it or not, our security company told us that .NET has emerged as one of the top secure frameworks that they know of. I almost fell out of my chair when I heard that.

1

Personally I don't think it'll be reliable.

The main reason will be for those using a shared IP. That includes most users connecting from inside a business and home users connecting through the same WIFI hub.

It's more than likely for multiple users to be coming to your site with the same IP address.

Adding to that the fact that IP addresses change over time and you're already losing track of your users.

It's also worth remembering that oftentimes multiple users will be using the same physical computer. Are you wanting to have only one member of a household able to signup etc?

0

It could be somewhat useful as part of a defense-in-depth approach, but I wouldn't call it "reliable".

0

If you want to identify users, you can use a cookie. One solution uses a combination of cookies, local storage, flash, and other state information that can be stored in a browser: http://samy.pl/evercookie/

Nothing is 100% reliable. These cookies can be erased by a determined user, or in some browsers with one click. Ultimately, in many countries outside of the USA, a user has the right not to be tracked.

2
  • 1
    Yeah, cookies are even less reliable than IP addresses. It's insanely easy to delete cookies, changing your IP address at least takes a modicum of effort.
    – ams
    Jul 26, 2011 at 15:55
  • @JimDaniel: On the flip side, client-side identification methods like cookies are confined to the one browser. One determined person can create several accounts simply by using several browsers.
    – Sparky
    Jul 26, 2011 at 15:57
0

As an alternative for the future: New Intel® Business Processors Deliver Leading Security, Manageability and Performance

As long as the connection between the browser and the CPU isn't interviened which I believe there is more risk of with a browser than a desktop application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.