0

I have a website where users can generate links. I'd like to limit 10 links to a user, but would also like to avoid requiring a login/email. I was thinking about using the IP Address as an identity system.

Is this a bad idea? I can see two possible issues:

  1. Is it possible for a user to automatically generate IP addresses and fill my database with a ton of spam?

  2. Is it possible for a user to spoof the IP address of another user, and gain access to their links.

  • 5
    What about users behind a NAT? Such as a university where all on-campus students will share a single public IP address, or a lot of wireless providers that put a huge number of phones behind a smaller number of IPs. – Kitsune Oct 14 '14 at 1:12
  • 1
    It might be a bad idea, yes. People share IP addresses, and people change IP addresses (though they can’t be spoofed with a full TCP connection). You can use them as a “hint” of sorts, though. – Ry- Oct 14 '14 at 1:15
  • You can use a Java application to ID computers by hardware. Not sure how hard it is to beat, but certainly harder than IP logging. – KnightOfNi Oct 14 '14 at 2:05
3

Is it possible for a user to automatically generate ip addresses and fill my database with a ton of spam?

Usually no. As the ISP DHCP leasing mechanisms nowadays try to pin a specific IP to a specific user as long as possible. They would need a zombie botnet of other people's computer to flood your system this way.

Is it possible for a user to spoof the ip address of another user, and gain access to their links.

Generally yes. Whilst IP spoofing has been made somewhat harder, depending on the protocol; you should assume the IP is not secure or consistent. Besides, users themselve often do not have static IPs


Overall, don't use an IP as the sole source of identity if you can think of other methods.

To avoid using a login you could simply cache their identity in a long term browser cookie or Flash LSO. Users that purge out LSOs (a minority) could get more links by "resetting" their identity (much like newspaper soft-paywalls) - but this depends on how important limiting users to 10 links is for your website.

  • 1
    For your first answer: Don't think localised to your own country. In Germany you get disconnected every 24 hours and get a new IP address every time you reconnect to your ISP. – Uwe Plonus Oct 14 '14 at 5:28
  • @UwePlonus Ah - but how do you know that your rapid DHCP re-leasing rate is normal? Rather than a local phenomenon due to depleted address blocks? And one every 24 hours within the limited pool available to the ISP doesn't make for a significant flooding attack. – LateralFractal Oct 14 '14 at 5:54
  • It is well known in Germany that your IP changes. This is a so called security feature of the ISPs. can also force the IP change by reconnecting to my ISP therefore I can change my IP always I want. Also the next problem is that my IP is later assigned to another user. And also I get an IP assigned that was assigned to another user before. For a background read the (translated german) wikipedia entry. – Uwe Plonus Oct 14 '14 at 7:05
  • @UwePlonus please remember that this is ISP specific, in the netherlands (yes, im your neighbour :D), ISP Ziggo claims to change it every week.... i've had mine for over 12 years now, and other ISP's like UPC, do indeed change them every 24hrs, while others as KPN never do (until manually disconnect/re-authorize) the modem. so its different per ISP ;) – Lighty Oct 14 '14 at 7:19
  • 1
    @UwePlonus I stand by my answer of usually no, in regards to the question as asked - for even if an ISP allows arbitrary reallocation of its IP pool by customers, you can't "fill" someone's database with just a couple of Class B subnets; unless the DB is the size of a teaspoon. Logging and identity mapping of IPs is a value proposition not asked in the first question, but answered in the second. In any case, a user playing round-robin with their ISP this way is playing with fire as the ISPs still log which user had which IP at what time. If a website complains to the ISP - it's all over. – LateralFractal Oct 14 '14 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.