Banning By Mobile Device?

Question

I am making some application that will be largely user driven and of course that means their will be trouble makers who probably will enter fake data into it using swear words or worse change valid data to bad data(ie changing to swear words)

Of course measures will be taken to try to curb this but in the end of the day I want to have the option to ban someone from my application.

My first thought is ban their account by email address. I was also thinking that maybe on top of that ban their devices.

My questions is is what unique id can I use from their phone if they use

Andriod
Iphone
Blackberry
Windows Phone 7/8

and how unique is it? Can it be easily changed?

'unique' is an ungradable adjective. It is not possible to qualify an absolute. — NickT, Apr 23 '13 at 19:08

score 1 · Accepted Answer · answered Apr 23 '13 at 21:11

For Windows Phone you should be able to use DeviceExtendedProperties. Specifically the DeviceUniqueId property.

Be aware though that, as they say in that article, if you use a device id to ban a user, then any future user of that same device will be banned from your app, even if they've done nothing wrong.

score 1 · Answer 2 · answered Apr 24 '13 at 13:16

There are 2 identifiers that can be used together to identify a specific device and user.

The DeviceUniqueId and WindowsLiveAnonymousId

the first one is the device, and as noted, anyone who uses the device after the banned user will also be banned.

The WindowsLiveAnonymousId is unique to the user. I have seen this same identifier across 3 separate devices and it is always the same for the users LiveId.

I use the following 2 methods to get these ids for identifying game players for leader-boards:

//Note: to get a result requires ID_CAP_IDENTITY_DEVICE
// to be added to the capabilities of the WMAppManifest
// this will then warn users in marketplace

public static byte[] GetDeviceUniqueId()
{
    byte[] result = null;
    object uniqueId;
    if (DeviceExtendedProperties.TryGetValue("DeviceUniqueId", out uniqueId)) 
        result = (byte[])uniqueId;
    return result;
}

// NOTE: to get a result requires ID_CAP_IDENTITY_USER
//  to be added to the capabilities of the WMAppManifest
// this will then warn users in marketplace

public static string GetWindowsLiveAnonymousId()
{
    string result = String.Empty;
    object anid;
    if (UserExtendedProperties.TryGetValue("ANID", out anid))
    {
        if (anid != null && anid.ToString().Length >= (AnidLength + AnidOffset))
        {
            result = anid.ToString().Substring(AnidOffset, AnidLength);
        }
    }
    return result;
}

They are used as such:

string deviceUniqueId = String.Empty;
for (int i = 0; i < GetDeviceUniqueId().GetLength(0); i++)
{
    deviceUniqueId += GetDeviceUniqueId().GetValue(i);
}

DeviceUniqueIDTextBlock.Text = deviceUniqueId;
WindowsLiveAnonymousIDTextBlock.Text = GetWindowsLiveAnonymousId().ToString(CultureInfo.InvariantCulture);

I did a post last May about getting system info on WP7. This code is found here: http://www.adambenoit.com/applications/system-info-windows-phone/

Hope this helps.

score 0 · Answer 3 · answered Apr 23 '13 at 20:11

0

All these devices have network interfaces with unique MAC addresses which by definition are constant - the MAC address is burned into the hardware and cannot be [easily] spoofed, especially on a mobile device. I would hash the MAC address and use that as the key. Pretty common practice on iOS once apple banned the use of UDIDs.

answered Apr 23 '13 at 20:11

Jai Govindani

3,181
21
26

I read something about UDIDs but did not they banned them. Hashing it would be just to keep it safe I guess as sort of like a password? I thought you code change mac address but I guess like you said harder to do on mobile instead of like a pc. – chobo2 Apr 23 '13 at 20:30
You hash it to 'anonymize' the data, and all that jazz. Especially with some articles out there about Apple having a huge database of everyone's MAC address, etc. With regards to changing - if you're writing a very secure app such as a banking app, I'd say do something else (probably something tied to the user account as well). For a regular app, I would say this is enough to act as a unique identifier. – Jai Govindani Apr 23 '13 at 21:22