How to identify a users device

Question

I want to implement something similar to gmail where signing in from a new device will make the user confirm that it is them through some form of MFA. However, I am unsure what to use to determine that a new device has been used across different systems and devices (ie. desktops, tablets, etc.)

My first thought was to use the public IP address, but this can change very frequently so it isn't very useful.

My second thought is to use the private IP. Is storing users private IPs a bad idea?

Is there a better third option?

Edit: To clarify, I want to know what data to use to determine whether or not a new device is being used (not how to authenticate the user once I determine that a new device is being used).

Answer 1

This can be implemented in a bunch of ways, but all the ones you've listed are terrible on their own.

Private IPs are never going to be useful. Multiple users in different networks can have the same private IP. Public IPs on their own are also just as bad - they can be spoofed, or in several cases, are used my multiple people at once (large organizations frequently use single static public IPs for many users).

What you should be looking at is a combination of the following:

• Public IP (store them so you know which is the user's most common login area)

• Hostname

• Screen resolution

• Platform (mobile vs desktop)

• OS versions (does the user generally use OSX but suddenly seems to have transitioned to windows?)

In fact, there's a lot of information that you can use. This site does a good job showing you what you can use.

Just remember - use a combination of the data that you recover. Don't just use IPs or OSes as the only way that you deny access.

Answer 2

An extremely common way to keep track of this is with standard http cookies. This will persist as a user moves from location to location, only gets lost when they clear their cookies or switch browsers (not often, if ever, for most users), and does a reasonably good job of confirming that this device is trusted.

Answer 3

Some form of 2fa like Google authenticator, you can add time based otp to your application, which seems to be the best way of doing it.

Edit: consider the variables that indicate the device is a new device of the user. Some kind of permanent device ID, eg imei etc, is great for identifying exact devices, but it is only after a valid authentication that you would know the device is from a valid user.