3 added some details to evercookies
source | link

How to uniquely identify users with the same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • Cookies
  • Evercookies (nasty JavaScriptJavaScript code that uses lots of different techniques to store identifying information, among them flash cookies, the various HTML5 storage options, the browsers visited links history, etc)
  • Device fingerprinting: use the HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • Device fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc.
  • Behavior: how fast do the users fill in forms, where on a button do they click, etc.

But most of these are not useful in defending against brute-force attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP address (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • Light throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP address can still login.
  • CAPTCHAs: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which brute-force attacks originate (of course, there are tools to automatically solve CAPTCHAs, but it's still harder than no CAPTCHA).
  • You could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc.). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.

How to uniquely identify users with the same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • Cookies
  • Evercookies (nasty JavaScript code that uses lots of different techniques to store identifying information)
  • Device fingerprinting: use the HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • Device fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc.
  • Behavior: how fast do the users fill in forms, where on a button do they click, etc.

But most of these are not useful in defending against brute-force attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP address (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • Light throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP address can still login.
  • CAPTCHAs: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which brute-force attacks originate (of course, there are tools to automatically solve CAPTCHAs, but it's still harder than no CAPTCHA).
  • You could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc.). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.

How to uniquely identify users with the same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • Cookies
  • Evercookies (JavaScript code that uses lots of different techniques to store identifying information, among them flash cookies, the various HTML5 storage options, the browsers visited links history, etc)
  • Device fingerprinting: use the HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • Device fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc.
  • Behavior: how fast do the users fill in forms, where on a button do they click, etc.

But most of these are not useful in defending against brute-force attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP address (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • Light throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP address can still login.
  • CAPTCHAs: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which brute-force attacks originate (of course, there are tools to automatically solve CAPTCHAs, but it's still harder than no CAPTCHA).
  • You could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc.). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.
2 Copy edited (e.g. ref. <https://en.wiktionary.org/wiki/CAPTCHA#Noun>).
source | link

How to uniquely identify users with the same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • cookiesCookies
  • evercookiesEvercookies (nasty JavaScript code that uses lots of different techniques to store identifying information)
  • deviceDevice fingerprinting: use the HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • deviceDevice fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc.
  • behaviorBehavior: how fast do the users fill in forms, where on a button do they click, etc.

But most of these are not useful in defending against bruteforcebrute-force attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP address (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • lightLight throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP address can still login.
  • captchasCAPTCHAs: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which bruteforcebrute-force attacks originate (of course, there are tools to automatically solve captchasCAPTCHAs, but it's still harder than no captchaCAPTCHA).
  • youYou could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc.). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.

How to uniquely identify users with same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • cookies
  • evercookies (nasty JavaScript that uses lots of different techniques to store identifying information)
  • device fingerprinting: use HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • device fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc
  • behavior: how fast do the users fill in forms, where on a button do they click, etc

But most of these are not useful in defending against bruteforce attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • light throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP can still login.
  • captchas: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which bruteforce attacks originate (of course, there are tools to automatically solve captchas, but it's still harder than no captcha).
  • you could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.

How to uniquely identify users with the same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • Cookies
  • Evercookies (nasty JavaScript code that uses lots of different techniques to store identifying information)
  • Device fingerprinting: use the HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • Device fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc.
  • Behavior: how fast do the users fill in forms, where on a button do they click, etc.

But most of these are not useful in defending against brute-force attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP address (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • Light throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP address can still login.
  • CAPTCHAs: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which brute-force attacks originate (of course, there are tools to automatically solve CAPTCHAs, but it's still harder than no CAPTCHA).
  • You could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc.). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.
1
source | link

How to uniquely identify users with same external IP address? Is there any way to uniquely identify such users?

Yes, there are lots of ways:

  • cookies
  • evercookies (nasty JavaScript that uses lots of different techniques to store identifying information)
  • device fingerprinting: use HTTP header (mainly User Agent, but the other headers and their order can help as well)
  • device fingerprinting with JavaScript: with JavaScript, you can get a lot of information, such as screen resolution, timezone, plugins, system fonts, etc
  • behavior: how fast do the users fill in forms, where on a button do they click, etc

But most of these are not useful in defending against bruteforce attacks, since the program doing them will probably not accept cookies or run JavaScript.

In your case, you might try:

  • HTTP header: these might actually already be enough to differentiate between users using the same IP (of course, an attacker can just randomly switch them, but I would assume most currently don't).
  • light throttling: you don't have to block IP addresses, you could just slow down the login process for them. That way, brute forcing becomes a lot less feasible, but real users using the same IP can still login.
  • captchas: these will annoy legitimate users, but hopefully not too many users actually use an IP address from which bruteforce attacks originate (of course, there are tools to automatically solve captchas, but it's still harder than no captcha).
  • you could require a user to accept cookies, and to send various identifying information before being allowed to login (such as the screen resolution, timezone, etc). Of course, an attacker can do this as well, but I don't think any currently existing bruteforce tools can do this, so they would have to write a custom script. But this might also annoy legitimate users.