1

Let's say I have account A on site example.com that has a policy of strictly one account per real person. I then create a new Gmail address, use that Gmail address to open a new Chrome user (not incognito), then use that Chrome user and session to create a new account B on example.com.

I know that example.com can see that two accounts A and B are currently logged into the website from the same IP address. But can it know that it is the same person operating both accounts? For example can it track the ID of the browser (if there is such thing), or the ID of the computer / internet session?

Does it matter if I operate using desktop / laptop / smartphone?

To ask my question in another way, how is two people using two accounts on the same device different from one user using two accounts in the same device from the point of view of example.com?

9
  • 3
    Let's take a step back and try to figure out what problem you're really trying to solve. For what reason are you concerned that someone would be able to detect that two accounts are really the same person? – Dan Landberg Dec 28 '20 at 17:55
  • 1
    Servers are able to know your IP adress and type of your browser via request headers. If they have an algorithm for detecting this, I am sure they can do it. – Ekrem Dinçel Dec 28 '20 at 18:16
  • What is a "professional website"? – Conor Mancone Dec 28 '20 at 19:37
  • Thanks @DanLandberg for your concern, let's just say that I want to use two accounts for myself. Any ideas on the question I posted? – Freelensia Dec 31 '20 at 15:21
  • Thanks @EkremDinçel. As far as I can see, IP address and browser type are not enough to guarantee it is the same person on both accounts. The story is different however, if each INTERNET SESSION has an ID, or each BROWSER on a computer has an ID (like the IMEI on a phone). Then the site can know for sure THIS browser on THIS computer logged into both accts. Can you confirm or deny this? – Freelensia Dec 31 '20 at 15:23
2

For example can it track the ID of the browser (if there is such thing), or the ID of the computer / internet session?

No,If you changed chrome user account and the gmail associated with it and didn't use any sync methods,all the cookies and data would be invalidated from the first user to the second,there would be no sure way for example.com to figure it out with a 100% accuracy,they are only left with device/browser finger printing techniques to get accurate result.

Would a site do that?

No,because there is no know way for websites to impose 1 account per person on a website,unless they go out of their way and perform physical checks with surveillance.

4
  • by using a cookie they could identify you even if you switch user How exacly? – Ekrem Dinçel Dec 31 '20 at 17:24
  • 1
    @EkremDinçel just use another cookie that doesn't invalidate,give to the user on the first get request,the guy can sign in/sign out change accounts as long as that cookie is submitted you would know which browser it is – yeah_well Dec 31 '20 at 17:27
  • @yeah_well is this really true? If I switch the Chrome user, it is the same as going incognito mode. Cookies submitted by the previous Chrome user are not carried over. – Lun Jan 1 at 6:21
  • 1
    @Lun i changed my answer,i guess i miss read the initial question. – yeah_well Jan 1 at 9:56
2

how is two people using two accounts on the same device different from one user using two accounts in the same device from the point of view of example.com?

Nothing. example.com may know that there is two accounts connected to itself on the same device and even know that accounts are open in the same browser, but can only guess whether it is the same person or not. Your question is logically out of context, I can open another account on the same device and give it to my brother for him to use. How on earth server will know it is me or not?

2
  • Thanks! So if I switch the Chrome user, does example.com know that it is still the same device? If yes, what is the mechanism by which it knows this? Is there a unique ID for each internet session and example knows that 2 requests were made from the same internet session? Or does each browser installed on a computer get a unique ID and example.com knows that even if two chrome users are logging in, it is still the same browser on the same device? – Freelensia Dec 31 '20 at 15:46
  • Unless client use someting like VPN, the IP adress any browser uses on the same device will be same. Server can look for same IP adresses in the list of active clients or something. Browsers don't get an ID, they have an user agent HTTP header that speficies the type of browser and which web technologies the browser uses. But you can also change the user agent, it is not exists for identification. – Ekrem Dinçel Dec 31 '20 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.