5

I can use the system function in PHP to get the MAC address of site visitors (probably most of you know). Why do we use IP addresss to check whether someone is stealing a cookie or not?

Does the system function have more overhead, or is it still insecure when we don't send any parameter to the function?

I know there are some situations in which users change their MAC address, but it happens less than IP address.

Could you shed some light on it?

Improve this question
  • 3
    Using IP address as a mitigation for cookie-leakage is wildly unreliable and shouldn't be done except possibly as part of a wider heuristic model. – bobince Dec 26 '11 at 16:33
  • @bobince, I understand that it is good practice to lock session cookies to the IP address. Is there some reason that is a bad idea, or are you just stating that this is an incomplete security measure? As far as I know, it only becomes a problem in mobile units where the IP address will change when switching WiFi stations or Wireless Towers. – Bryan Field Dec 26 '11 at 18:42
  • 4
    @George: The IP address visible to a server can change for a bunch of other reasons, not least ISP or workplace load-balanced proxies. It's plausible to detect patterns in IP usage and use that as part of a confidence estimate, for example to determine whether to prompt the user to reaffirm a login credential before performing a sensitive operation. But outright breaking the session on an IP change is unreasonably hostile. – bobince Dec 26 '11 at 19:26
  • @bobince, Thank you for the clarification of what you were describing. – Bryan Field Dec 26 '11 at 19:31
  • How about the fact a MAC Address can be duplicated with a trivial amount of work. – Ramhound Dec 27 '11 at 15:10
19

The reason for that is very simple: You won't get the MAC address of your website visitor over the Internet, because they are lost when the packets are routed. You can only get the MAC addresses from your subnet (through, for example, ARP).

Improve this answer
  • 3
    I didn't take routers into consideration when I tested system function in PHP to get MAC address! now I think my problem is solved. – ALH Dec 26 '11 at 12:34
2

The number one reason is probably that MAC addresses can be spoofed. All you need is a NIC that supports changing the MAC, and software to drive it. Spoofing an IP address, however, is pretty much impossible: if you change it, the response will go to the spoofed IP address instead of your own, so you never get to see it. The only way I can think of would be to use a large network of computers with different IP addresses, such as a botnet, but even then, you can only use IP addresses that you have access to.

Improve this answer
  • Spoofing an IP address is about as easy as spoofing a MAC address, if not easier. (I've seen networks where people were plugging in their own computer and configuring it with an IP address that was already allocated, not necessarily with bad intentions as such, but causing a number of problems.) MAC addresses, however, are limited to an ethernet area (a LAN) and will not go through routers that talk IP. – Bruno Dec 26 '11 at 19:48
  • @Bruno are you talking about spoofing the external or internal IP? – kenwarner Dec 26 '11 at 20:28
  • @qntmfred: "internal" I guess. I'm just comparing spoofing of IP address where the MAC address could also be spoofed (same LAN section, for example). Comparing ease of spoofing between IP and MAC anywhere further than the range of application of the MAC address doesn't really make sense. – Bruno Dec 26 '11 at 22:00
  • @Bruno - As pointed out. You can spoof an ip address but the traffic will be redirected to that address, unless you have access to multiple ip addresses, spoofing an ip address would serve no purpose. You can assign yourself any ip address you want, that doesn't mean it will be able to access anything outside of your network, seems you have a few things to learn about networking. – Ramhound Dec 27 '11 at 15:14
  • @Ramhound All I'm saying is that both IP and MAC address can easily be spoofed, but that the scope will be limited anyway. The question is about a server (accessed via a WAN). In this case, a client spoofing its MAC address is pointless too. The real reason MAC addresses aren't used here has nothing to do with ease of spoofing, it's just that the remote client's MAC address won't go anywhere near the server. (Even if IP address spoofing in a way that works up to the server is harder indeed, it could potentially be done. In contrast, MAC spoofing there doesn't make sense at all.) – Bruno Dec 27 '11 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.