Beefy Boxes and Bandwidth Generously Provided by pair Networks
No such thing as a small change
 
PerlMonks  

Re: Identifying clients

by serf (Chaplain)
on Dec 07, 2006 at 10:58 UTC ( #588290=note: print w/replies, xml ) Need Help??


in reply to Identifying clients

Hi ruzam,

In Re^6: Identifying clients you asked "So is my only option to literally forget the whole ip blocking strategy?" - I think the answer to this is yes.

If your application is trying to protect against unauthorised access from Internet users (as opposed to Intranet access) then the client IP is not a valid criteria to identify them by anyway.

At the moment I accessing the Net via tor. Every time I hit a page my request arrives at the server via a different route.

You can check this by installing Tor & going to a site like http://www.whatismyip.com/ - each time your IP will be different.

This has interesting effects when for example go to Google - instead of bringing up my normal google.co.uk start page, it bounces me to the country that it thinks I'm coming from.

Yesterday I got google.de a number of times, and once I even got the Bulgarian Google homepage - "What's this??? Google in Cyrillic!" :o)

DigitalKitty has a bit more on tor on her home node.

If someone is using tor then they have immediately rendered all your hard work and logic for blocking/penalising IPs irrelevant.

A white list *is* a possiblity, but even valid IPs can be hijacked or spoofed, so it's never 100% reliable as an identification method.

I would think a form of challenge-response type encrypted token passed between the server and the client and back to the server would be a more reliable way to go.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://588290]
help
Chatterbox?
[ambrus]: I'm currently in the process of rewriting my proof of concept programs. They sort of developped organically as I was experimenting, so now I've got an ugly mess of multiple programs and one-liners held together by nothing. I'll have to rewrite them to som
[ambrus]: ething that's both cleanly organized and mostly automated.
LanX in train, bad connection
[Corion]: ambrus: Yeah - we're in that situation too, except that there is no time to do the reorganizing :-/
[LanX]: ... so my boss started a project with the newest sun servers and invited the traders to come on weekend to test it... and they were so pleased, that they forced him to keep it in production...
[ambrus]: Corion: sure, this is the long-term plan. The short term is that I have to run this ungodly mess to get results from the new input data today.
[Corion]: ambrus: Most of our "automation" is tied to process exit codes and a shell pipeline :-\
[LanX]: ... a week later they realized that one of the databases - which recorded how much the other banks due to this bank - was not correctly plugged

How do I use this? | Other CB clients
Other Users?
Others wandering the Monastery: (16)
As of 2017-03-29 11:49 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Should Pluto Get Its Planethood Back?



    Results (350 votes). Check out past polls.