Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run a small local gaming website with a custom admin panel I coded to let trusted members do administrative tasks through the software's API. Since their IP Address is dynamic, can I authenticate them to the admin panel through their MAC ADDRESS ? Or any other practical solution.

Note: I run a windows server 2008 R2 with PHP installed.

My ultimate goal is to block access to anyone other than the trusted members. So anyone sniffing for the password or even the url of the admin panel will be blocked.

share|improve this question
up vote 11 down vote accepted

MAC address controls are only possible for hosts on the same network ("broadcast domain"). Any remote host that has to be routed to you, such as over the Internet, will appear to come from the MAC address of your router, and so can't be subject to MAC address controls.

That's why you see MAC address controls used with wireless access points, for example; by definition a wireless client is going to be "physically" connected to the access point without any intervening router.

I assume from your description that the "trusted members" are probably remote users, so MAC filtering won't work for you. Given your stated ultimate goal, you may want to consider two-factor authentication of some sort. Giving out SecurID or other hardware tokens might be overkill, but perhaps client SSL certificates would provide the combination of security and convenience for something on the order of a "local gaming website". Setting up client certs has an initial (time, energy) cost, but once you've handed them out and people have installed them, it provides stronger assurance that the right people are logging in with little to no added inconvenience for everyday use.

share|improve this answer
Nice suggestion in using client side SSL certificates. – this.josh Jul 29 '11 at 7:47
More importantly, MAC addresses are trivially spoofable, as @Justice said. – AviD Aug 5 '11 at 9:31
I fully agree with the certificates – Goez Aug 5 '11 at 11:02

MAC addresses are completely spoofable.

MAC addresses are not visible to servers over the Internet. They're only visible to computers to which your computer is talking directly over an Ethernet wire (such as your router).

So no.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.