Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 15 guests online
EH-Net Donations

Enter Amount:
$

Google Ads
ChicagoCon 2008f
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Tracking MAC Address over internet
Ethical Hacker Community Forums
August 30, 2008, 04:42:39 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Registration Now Open for ChicagoCon 2008f Oct 27 - Nov 2! Visit www.chicagocon.com.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Tracking MAC Address over internet  (Read 4028 times)
0 Members and 1 Guest are viewing this topic.
idscore
Newbie
*
Offline Offline

Posts: 2


View Profile
« on: May 09, 2008, 02:02:23 PM »

Hi,
I am launching a site, which has a pre-requisite of having each member as a unique user. That means, no user ideally should have multiple accounts. I was hoping that i could track users MAC id only during registration process with a software that might be availble.

Is this a possible solution, or you would recommend something else? I know IP tracking is easy but has no relevance to unique user here.

Any thoughts would be highly appreciated.
Thx.
Logged
ChrisG
EH-Net Columnist
Hero Member
*****
Offline Offline

Posts: 978


View Profile WWW
« Reply #1 on: May 09, 2008, 02:41:08 PM »

thats a bad idea in many ways.

how bout if they need to access your site from work/home or they change their NIC or get a new wireless card, or they get a new wifi router/gateway...  lots of extra overhead IMO to keep up with that.

is there a big reason why you think people would have multiple accounts?
Logged

...tests i took go here...

http://carnal0wnage.blogspot.com/
Bogwitch
Newbie
*
Offline Offline

Posts: 48

Senno Ekto Gamat


View Profile
« Reply #2 on: May 09, 2008, 04:39:15 PM »

Many problems. MAC addresses are not usually transmitted across the Internet; you will need an application that will extract it and transmit it. It is possibly your users would not be too keen with what might be seen as spyware.
Users can change their MAC address easily.
Users can use multiple machines/ VMs which would have different MAC addresses.
It is VERY difficult to restric users to a single account for an online service. IP addresses are about the only way that you can hope to even get close to this but with the huge numbers of users that are assigned IP addresses at the time of connection it is in no way foolproof.
Perhaps if you gave us a little more detail of what you hope to achieve, we could help you a little more?
Logged

CISSP, C|EH, C|HFI
idscore
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #3 on: May 09, 2008, 08:31:30 PM »

Thanks guys...i did realize the limitations with MAC/IP.

So, to give you a little bit more without divulging my business completely, the business i am launching will be almost like "One-person-one-vote" voting system. I don't think the app fails if people open multiple ids as i have other means of validating uniqueness of an account... but, i am trying to see how best i can identify users multiple accounts through other means(MAC/IP etc), and have a procedure of identifying, alerting users, and deleting their multiple (duplicate) accounts.

It's almost like i can open multiple accounts and vote for democrats, if i want to influence democrats to power. I am trying a voting platform that will enable each user to cast their vote - only once on an issue.

Any help in your suggestions from technology perspective would be highly appreciated?
Logged
shawal
Jr. Member
**
Offline Offline

Posts: 86


View Profile
« Reply #4 on: May 10, 2008, 08:25:53 AM »

is there any credit card transcations involved? you need to use a third party method of verification certifcate/credit card/phone number that is unique, hard for the average user to fool around.
Logged

RHCE, GIAC GCIH.
RoleReversal
Sr. Member
****
Offline Offline

Posts: 389


View Profile WWW
« Reply #5 on: May 10, 2008, 10:38:54 AM »

idscore,

I think that on a diverse and distributed system like the Internet what you are proposing could be nearly impossible without physical authentication.

As has been said MAC/IP address isn't going to be the way forward even just due to people having access to multiple machines/public access/etc. before we even get into the realm of spoofing. Likewise multiple, unique individuals may try to access your system from the same IP or MAC address, a shared/public terminal for example.

As Shawal has suggested debit/credit card information should be unique, but a person can have more than one card legitimately (If I only had one my finances would look nicer Wink )

Even going to the extreme of requiring physical authentication (such as RSA keyfobs, swipe cards, etc) whilst each device is unique, again an individual could have access to more than one device, for example registering/recieving one from multiple addresses.

However, whilst it may/will be impossible to get a 100% perfect system it is important to remember that you only need to remove enough flaws to make the system usuable. Holes can and will be found in any non-simple system, online or otherwise, what is required is reducing the level of holes to an acceptable level depending on your context and requirements.

Hope this helps, good luck
Logged

A little bit of sanity:
http://www.infosanity.co.uk
pfinder00
Newbie
*
Offline Offline

Posts: 1


View Profile
« Reply #6 on: May 15, 2008, 09:33:30 AM »

I would like to know too. Where privacy is concerned, boards where we once used to post messages are tracking users with multiple accounts using similar methods.

Can anyone explain how they can still manage track users individually even when you keep changing IPs, mask your browser information headers and post behind proxies? What kind of unique id do they track besides MAC IDs?
Logged
dottom
Newbie
*
Offline Offline

Posts: 1


View Profile
« Reply #7 on: June 01, 2008, 11:33:02 AM »

Just issue each person a digital key.   Use two factor authentication.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.5 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.046 seconds with 23 queries.
 
Polls
Best for daily desktop use:
 
Support EH-Net
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.