I would like to discuss which are all the possibilities for a browser game to detect whether a registered user has multiple accounts.

With "multiple accounts" is named the practice of one single player having more than just one profile in the game.

However, this limits the possibilities of interaction in the game between family members (and in general, everyone sharing same computer and/or connection), even if they are actually different persons.

My question is exactly which ways can be used to identify multiple accounts?

I already know from some previous research that they can use the IP address. Is it enough in this case to use a VPN caring about WebRTC leak? Or running a game (using FlashPlayer or other programs) opens other possibilities to get the real IP?

I am also aware about cookies. In this case is it enough to use CCleaner, different browsers for each account and surfing under "private mode"?

What about MAC addresses? Which one can they get? Of which of them have I to take care of? Just the ones related to my hardware or also the router one (or other like that)?

Is there any other point I am missing?

closed as off-topic by DavidPostill, Ƭᴇcʜιᴇ007, Ramhound, nc4pk, Deltik Feb 7 '16 at 13:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – Ƭᴇcʜιᴇ007, Ramhound, nc4pk, Deltik
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There's nothing you can really do to completely prevent determined people doing that without affecting the other people. Just do the obvious things like making users enter a unique email address and require them to click a link in the email to verify the address is valid. – James P Feb 6 '16 at 13:18
  • 1
    Your question is really not clear? What are you trying to do? Are you to trying prevent people from the same place accessing your games? Or are you trying to get around some restrictions that are stopping you playing some games? – DavidPostill Feb 6 '16 at 14:15
  • @DavidPostill I am not the developer of the game. I would like to strat playing a browser game, which is already played by a friend of mines who uses my same connection. The interaction between two players does not bring any great advantage.Moreover, the same advantages can be obtained by any "private agreement" between players (as actually happens). So, I fell like this is not fair that me and my friend can not help each other just because we share the connection. Therefore, I wuold like to know how can I avoid this unfair restriction. I hope now my question is more clear. – user554811 Feb 10 '16 at 14:38
  • @user554811 You should address your concerns to the developer/provider of the game. – DavidPostill Feb 10 '16 at 14:41
  • @DavidPostill Already done. They apologise for the discomfort but they have no intention neither to change the rules nor to make an exception for our specific case. – user554811 Feb 10 '16 at 14:56

IP address checking is unreliable. Servers you connect to can see only your external IP address, ie. your router's one. It's perfectly legitimate for, say, 20 people to connect through one router. All of them will appear to have the same IP address to server.

MAC addresses never leave your local network. Only your router and other devices can see each other's MAC address. Using this to detect multiple accounts is impossible.

Cookies are too easy to remove to be reliable. Simply deleting them would do the job. One could use them, though - they are sufficient to detect multiple account logins of less tech-savvy users.

Evercookie would work. It's a toolkit for creating extremely hard to delete "cookies". It uses multiple storage mechanisms and recreates missing ones on first occasion, so you'd have to delete all of its "cookie" instances to hide yourself.

Browser fingerprinting could be useful. Collecting user-specific data exposed by browser and plugins can often be used to reliably identify a person, or at least narrow down the set of possible users to few dozen of people. You can check how unique your browser is with Panopticlick.

As you have noted, all of these methods have one main drawback: they are a PITA for people legitimately sharing computers and other devices. If you're designing a service that relies on users having only one account, then instead of preventing multi-accounts, design it in such a way that makes having multiple accounts pointless. This site is one example of such service: people gain reputation for doing things that are beneficial for the community. Newly created account has low reputation and is severely limited. As it gets reputation points, some capabilities are unlocked (eg. commenting everywhere) and user gets some bonuses (limited ads).

  • I am not by the "designer side". I am a potential player of a browser game. You can read my comment above for further details. I was unclear and misleading maybe, I apologise. Can you tell me how can I safely avoid this restriction? – user554811 Feb 10 '16 at 14:45
  • You shouldn't avoid it. It's there to prevent you from using multiple accounts. – gronostaj Feb 10 '16 at 17:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.