How to ID a web user uploading a file

Question

I just used a great PDF Converter, but I noted that they have a 30 minute intermission between conversions (to get paying customers). So I got curious as to how the restriction might be is implemented; and afaik it doesn't seem to be (solely?) cookie-based.

IP-address doesn't seem likely (wouldn't that block entire NATted organizations collectively?), and using filename would be too blunt. Can Javascript generate hardware-unique info these days? What other other ways are there? What is secure, what is easy to implement and what is just rotten?

score 1 · Accepted Answer · edited May 23 '17 at 10:30

I think the problem here is to uniquely identify a client's browser.

Can Javascript generate hardware-unique info these days? What other other ways are there?

A simple solution (may not be exhaustive) I can imagine, is to consider not just the cookie or the ip address but all possible parameters like

cookies
ip address
browser details
flash cookies and
then those information that can be pulled off from a client's browser via Javascript (which is enabled for most of the browsers and needed by most sites like the one you mentioned) such as plugins installed, their versions.

With all these information, one can identify a machine uniquely on the internet to a great extent.

What is secure, what is easy to implement and what is just rotten?

Personally, I have never implemented this, but it seems quite doable.

Some interesting links that I found during the course of this short interesting research are:

How to ID a web user uploading a file

1 Answers1

Linked