I want to implement something similar to gmail where signing in from a new device will make the user confirm that it is them through some form of MFA. However, I am unsure what to use to determine that a new device has been used across different systems and devices (ie. desktops, tablets, etc.)
My first thought was to use the public IP address, but this can change very frequently so it isn't very useful.
My second thought is to use the private IP. Is storing users private IPs a bad idea?
Is there a better third option?
Edit: To clarify, I want to know what data to use to determine whether or not a new device is being used (not how to authenticate the user once I determine that a new device is being used).
GMail
usesCookies
to remember a trusted device. – Xaqron Apr 2 '17 at 3:02