Advice Required: Security/Cookies/IPs/Sessions

[Taylor_1978]

Hiya,

I operate gaming leagues, and as part of this it is important to store player information such as their IP address to ensure that there are no multiple accounts and that no rank manipulation occours.

At the moment I do a cross reference three pieces of information: IP, Email and Password.

Although my system does not allow a player to sign up with an email address that is already registered, it does keep a record of people who attempt to so that I have that connection on record.

My problem is that obviously IPs change according to which computer they log in at the time, and if the ISP has changed the IP address since they last logged in.

I am wondering, and bare in mind I have little knowledge about cookies, if they can help me at all with this. If there a certain bit of information I can obtain from cookies and store into my database to also cross reference?

If I understand correctly, this will only work if a player has their cookies on?? If so, I have no problem stating at the beginning of the site that cookies must be turned on in order to participate.

Any advice or direction would be much appreciated!

Thanks in advance! :thumbsup:

Taylor.

[marek_mar]

I don't see how cookies can be anyway secure as someone can just delete the cookies when he want's to switch accounts.

[missing-score]

My suggestion would be instead to only impose very basic checking, and manually see if people are messing around, and then contact them personally. If you do it all automatically, people will just find a way round your system and that will make it harder to track them.

[Taylor_1978]

None of it is done "automatically" so to speak. The program just highlights those whose accounts become "suspicious" and the an Administrator checks into it.

And yes, they can delete cookies etc. However the purpose I am trying to obtain is a way of easily sighting those who do not know how to "beat the system" - which will free up man time to concentrate on those who do know how :)

[marek_mar]

Well you could check if two accounts that have communicated in any way were ever accessed from the same IP. As multi-accont players must do that.

[Taylor_1978]

Yeah it already does that. As originally stated though, sometimes an ISP changes the IP after logging off. So I'm looking into cookies being like a back-up to be able to check this.

[marek_mar]

You could do the same with cookeis if you think it'll help. But even if someones IP changes he should be visiting one account with many IP's.