如何可靠地识别互联网上的用户？
我知道这是一件大事。事实上，它可能用于某些 SO 社区 wiki。
无论如何，我正在运行一个不使用显式用户身份验证的网站。它是公开的，对所有人开放。然而，由于服务的性质，一些用户因不当行为而需要被锁定。
我目前正在阻止 IP 地址，但我知道许多人故意重置其 DHCP 客户端缓存以使 ISP 为他们分配新地址。这是事实吗？我认为对于一些想要避免被拒绝访问的人来说，这无疑是一个有利可图的可能性。 因此，IP 并不是解决此问题的最佳方法。但没有别的事了，不是吗？
MAC 地址无法在 WAN 上生存（从一跳到另一跳变化？），即使它们存在 - 这些也可能被欺骗，尽管我认为比 IP 更新更容易。
Cookie 甚至 Flash Cookie 都是不可能的，因为有大量的“教程”如何擦除这些内容，而那些意图在互联网上造成严重破坏的人很清楚并且有充分的准备来应对我将采用的这种基本措施。
还有什么可以依靠的吗？我正在考虑启发式分析 - 从客户端收集可用数据并用它形成一些密钥，但还没有达到实现它的程度 - 这是一种选择吗？
I know this is a big one. In fact, it may be used for some SO community wiki.
Anyways, I am running a website that DOES NOT use explicit authentication of users. It's public as in open to everybody. However, due to the nature of the service, some users need to be locked out due to misbehavior.
I am currently blocking IP addresses, but I am aware of the supposed fact that many people purposefully reset their DHCP client cache to have their ISP assign them new addresses. Is that a fact? I think it certainly is a lucrative possibility for some people who want to circumvent being denied access.
So IPs turn out to be a suboptimal way of dealing with this. But there is nothing else, is it?
MAC addresses don't survive on WAN (change from hop to hop?), and even if they did - these can also be spoofed, although I think less easily than IP renewal.
Cookies and even Flash cookies are out of the question, because there are tons of "tutorials" how to wipe these, and those intent on wreaking havoc on Internet are well aware and well equipped against such rudimentary measures I would employ.
Is there anything else to lean on? I was thinking heuristical profiling - collecting available data from client-side and forming some key with it, but have not gone as far as to implementing it - is it an option?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
由于互联网的性质，这实际上是不可能的。是的，您可以阻止特定的 IP，但正如您所说，对于普通“行为不当者”来说，简单地更改其 IP 是很容易的。甚至 MAC 地址也可能被欺骗。这就是存在这些问题的网站使用身份验证的原因。这是唯一真正的解决方案。
Due to the nature of the internet, this isn't practically possible. Yes, you can block specfic IPs, but as you've said, it's easy enough for the average "misbehaver" to simply change their IP. Even MAC addresses can be spoofed. This is why sites with these problems use authentication. It's the only real solution.
您无法完全阻止决心访问您网站的用户。然而，你可以让他们变得非常困难，以至于不值得他们花时间。
You are not going to be able to completely block a user who is determined to access your site. You can, however, make it difficult enough for them that it isn't worth their time.
正如其他人所说，这是一个不可能的问题。任何有足够决心的人总能找到另一种方法。这个问题的典型例子是维基百科，你可以在这里阅读他们采取的各种阻止步骤：http://en.wikipedia.org/wiki/Blocking_policy
As others have said, this is an impossible problem. Anyone determined enough can always find another way in. The canonical example of this problem is with Wikipedia, and you can read about the various blocking steps they take here: http://en.wikipedia.org/wiki/Blocking_policy
简单的答案是这是不可能的。正如其他人（包括你自己）已经说过的那样，任何有决心的人都会找到另一种方法。
您可以阻止 IP 或使用 cookie，以阻止不经意的麻烦制造者。只想在博客评论中发表粗鲁言论的人可能会去其他地方，但这不会吓跑那些想在您的网站上制造麻烦的人，
如果这种不当行为对您来说是一个严重的问题，那么我认为您唯一的办法要求对可能遭受此类滥用的任何类型的访问进行身份验证。
您可以通过使用 OAuth 并接受许多不同的提供商（就像 SO 所做的那样）来最大程度地减少用户的烦恼，而不是强迫所有用户注册并记住另一组登录凭据。
The simple answer is that this is impossible. As others (including yourself) have already said, anyone determined will find another way.
You can block IPs or use cookies, to deter the casual troublemaker. Someone who just wants to post rude words in blog comments will probably go elsewhere, but it won't scare off someone who wants to cause trouble on your site specifically,
If this misbehaviour is a serious problem for you, then I think your only recourse is to require authentication for any kind of access that could be subject to such abuse.
You can minimise the annoyance to your users by using OAuth, and accepting many different providers, much as SO does, rather than forcing all your users to sign up and memorise yet another set of login credentials.