Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been confronted with claims from one user of online game, that, according to his talk with one of moderators, the game engine allows to immediately identify the case, when the user is playing with multiple accounts, when they were created on the same computer. He have understood that it has to do more with network card, then computer, so I've quickly identified, that the only possibility would be to read MAC address (the user can use multiple browsers, can reinstall the system, and that security is to work anyway).

I was very intrigued by that statement. Is it possible for browser game (written in PHP) to actually access and read my MAC address? ActiveX are not the case, since only a limited part of gamers is using IE. I know no standard mechanism allowing it, but I'm not an expert...

Ability to read MAC address would be the great danger for privacy, so this is very disturbing...

share|improve this question

migrated from webapps.stackexchange.com Dec 29 '12 at 5:33

This question came from our site for power users of web applications.

    
I'm searching for the solution targeting browsers other than IE. –  Donaudampfschifffreizeitfahrt Dec 28 '12 at 16:53

1 Answer 1

up vote 8 down vote accepted

Typically unless the web server and the client are on the same ethernet segment, the host serving the PHP would only be able to discern the client IP address from the user's browser, not the affiliated MAC address. This is because the MAC is a link-local address and routers do not forward packets with link-local addresses. Therefore, if there is at least one router between the web server and the client, the web server will only see the MAC of the router closest to it.

That said, it is possible to detect the MAC in IE using client-side JavaScript which bridges to the NIC via ActiveX. See this Stack Overflow post for further details.

Alternately, a Java applet can be used in other browsers. The level of security for that is set in the Java Runtime Environment policy file, so if the user enabled access to system information, then the applet could potentially obtain the MAC.

TL;DR -- unless the browser has a technology enabled which can bridge to the OS (e.g., ActiveX, Java applet, etc.), it is not possible for the browser to detect the client MAC address.

share|improve this answer
    
But this is IE-only, if I have understood well? –  Donaudampfschifffreizeitfahrt Dec 28 '12 at 16:51
    
Correct -- the JavaScript code referenced above only has access to the MAC information since it is bridged with ActiveX. Alternately, a Java applet can be used in other browsers. The level of security for that is set in the Java Runtime Environment policy file, so if the user enabled access to system information, then the applet could potentially obtain the MAC. –  esquireofoz Dec 28 '12 at 18:50
    
So, without modifying Java policy and without using IE the answer would be no? Could you update answer with content of your comment? –  Donaudampfschifffreizeitfahrt Dec 28 '12 at 19:21
    
# So, without modifying Java policy and without using IE the answer would be no? --> Correct # Could you update answer with content of your comment? --> Sure thing. –  esquireofoz Dec 28 '12 at 20:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.